//! Chanora PoC — diagnostics redaction spike.
//!
//! Authority:
//!   * `docs/architecture/proof-of-concept-plan.md` §2 — Diagnostics
//!     redaction spike. Exit criterion: "Password and identity-secret
//!     samples are redacted."
//!   * `docs/security/diagnostic-redaction-audit-report.md` — policy
//!     in §2, surfaces in §3, test matrix REDACT-TC-001..010 in §4,
//!     bundle policy in §5.
//!   * SRS-093 / SysRS-152 / SysRS-154 / SysRS-155 — software-level
//!     redaction obligations for logs and diagnostic exports.
//!
//! Production code will own this redactor inside the `chanora_diagnostics`
//! crate and wire it as a `tracing` layer. The PoC is the same shape in
//! miniature: a typed policy, a redactor that applies it to free text
//! and to structured diagnostic bundles, plus an explicit list of
//! known-literal secrets the host application can register at runtime.

pub mod bundle;
pub mod policy;
pub mod redactor;

pub use bundle::{DiagnosticBundle, RedactedBundle};
pub use policy::{RedactionPolicy, RedactionRule};
pub use redactor::{KnownSecretRegistry, Redactor};

/// The replacement string used for redacted segments.
///
/// Chosen distinctly so audit tests can grep for either presence
/// (correct redaction occurred) or absence (no leak).
pub const REDACTION_MARKER: &str = "[REDACTED]";