# Verification record — `diagnostics-redaction-spike`

## Result

PASS. The PoC exit criterion (from
`docs/architecture/proof-of-concept-plan.md` §2: "Password and
identity-secret samples are redacted") is met, with full coverage of
REDACT-TC-001..010 from
`docs/security/diagnostic-redaction-audit-report.md` §4.

## Environment

| Field | Value |
|---|---|
| Date | 2026-05-13 |
| Host OS | Linux (Arch, kernel 7.0.5-arch1-1, x86_64) |
| Rust toolchain | stable 1.95.0 |
| `regex` | 1 |
| `serde` / `serde_json` | 1 |
| `once_cell` | 1 |

## Reproduction

```bash
cargo test
printf 'INFO password=hunter2 path=/home/milkice/x\n' \
    | cargo run --bin diagnostics-redaction-cli
```

## Test run

```
running 12 tests
test known_secret_is_scrubbed_even_when_no_regex_matches ... ok
test redact_tc_005_channel_name_with_unicode_excluded_by_default ... ok
test redact_tc_006_nickname_with_unicode_preserved_in_safe_field ... ok
test redact_tc_002_identity_secret_in_storage_error ... ok
test redact_tc_010_multilingual_safe_text_preserved ... ok
test redact_tc_009_long_hostile_protocol_string_truncated ... ok
test redact_tc_007_local_file_paths_user_segment_minimized ... ok
test empty_registered_secret_is_ignored ... ok
test redact_tc_004_chat_text_excluded_by_default ... ok
test redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields ... ok
test redact_tc_001_server_password_in_connection_data ... ok
test redact_tc_003_server_url_with_password_field ... ok

test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured;
                 0 filtered out; finished in 0.01s
```

## CLI run

Input:

```text
INFO connect host=cn.teamspeak.app password=hunter2 nickname=Chanora
DEBUG identity=MG0DAgeAAgEgAiAIXJBlj1hQbaH0Eq0DuLlCmH8bl+veTAO2k9EQjEYSgIgNnImcmKo7ls5mExb6skfK2Twu54aeDr0OP1ITsC50CIA8M5nmDBn
ERROR open /home/milkice/.local/share/chanora/db failed
NOTICE CHANORA_LITERAL_DEMO_SECRET seen on bus
```

Output:

```text
INFO connect host=cn.teamspeak.app password=[REDACTED] nickname=Chanora
DEBUG identity=[REDACTED]
ERROR open /home/[REDACTED]/.local/share/chanora/db failed
NOTICE [REDACTED] seen on bus
```

- Password: redacted (rule `password-kv`).
- Base64-ish identity blob: redacted (rule `identity-base64-blob`).
- Linux home-username segment: redacted (rule `linux-home-path`); the
  rest of the path is preserved.
- Pre-registered literal secret: redacted via
  `KnownSecretRegistry`, demonstrating the SS-AUD-003 defence-in-depth.
- Non-secret tokens (`host=`, `nickname=`, `INFO`, `ERROR`, …) all
  flow through unchanged.

## Audit-matrix coverage

| Audit ID | Test | Result |
|---|---|---|
| REDACT-TC-001 (server password in connection data) | `redact_tc_001_server_password_in_connection_data` | PASS |
| REDACT-TC-002 (identity secret in storage error) | `redact_tc_002_identity_secret_in_storage_error` | PASS — uses `KnownSecretRegistry`. |
| REDACT-TC-003 (URL with password field) | `redact_tc_003_server_url_with_password_field` | PASS — only the password value is redacted. |
| REDACT-TC-004 (chat text in export) | `redact_tc_004_chat_text_excluded_by_default` | PASS — default policy excludes. |
| REDACT-TC-005 (Unicode channel name) | `redact_tc_005_channel_name_with_unicode_excluded_by_default` | PASS — default policy excludes. |
| REDACT-TC-006 (Unicode nickname) | `redact_tc_006_nickname_with_unicode_preserved_in_safe_field` | PASS — preserved in non-sensitive extras. |
| REDACT-TC-007 (local file path) | `redact_tc_007_local_file_paths_user_segment_minimized` | PASS — username segment redacted on Linux/Windows/macOS path shapes. |
| REDACT-TC-008 (mixed sensitive bundle) | `redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields` | PASS — whole-bundle JSON scanned for plaintext. |
| REDACT-TC-009 (long hostile protocol string) | `redact_tc_009_long_hostile_protocol_string_truncated` | PASS — `MAX_PROTOCOL_STRING_LEN = 256` cap with truncation marker. |
| REDACT-TC-010 (multilingual safe text) | `redact_tc_010_multilingual_safe_text_preserved` | PASS — Chinese / Japanese / Korean / Latin-diacritic text preserved verbatim. |

## What this spike does NOT validate

- Integration as a `tracing` layer (production code will own this).
- Diagnostic export *file format* (zip / json-lines / archive layout).
- Mobile-platform path shapes (`/data/data/<pkg>/` on Android,
  iOS app-group containers).
- Memory / core dumps.
- Performance under sustained high-volume logging.
- Adversarial regex evasion beyond the trivial cases exercised.
- Process-level review of the audit report (SS-AUD-007 style sign-off).