EdisonJwa
06ec6f2965
Proof-of-concept proving the diagnostics-redaction exit criterion from
docs/architecture/proof-of-concept-plan.md §2:
"Password and identity-secret samples are redacted."
Full coverage of the audit-report test matrix in
docs/security/diagnostic-redaction-audit-report.md §4
(REDACT-TC-001..010), plus two sanity tests.
The spike ships:
- RedactionPolicy: typed catalogue of regex rules
(identity-base64-blob, password-kv, ts3server-url-password,
authorization-bearer, linux/windows/macos user-path) with
optional capture-group narrowing.
- Structured-field redaction keyed on case-insensitive name
substrings (password, secret, token, ...).
- Bundle-level switches: chat and channel tree excluded by
default per audit-report §5.
- KnownSecretRegistry: literal-substring scrub for secrets the
host application has already loaded into memory (defense in
depth that regexes alone cannot guarantee — closes the gap
behind REDACT-TC-002).
- Length cap (MAX_PROTOCOL_STRING_LEN = 256) with truncation
marker for REDACT-TC-009.
- UTF-8 preserved in non-sensitive fields per REDACT-TC-010 /
ADR-008.
Test suite (12/12 PASS on 2026-05-13):
REDACT-TC-001 server password in connection data
REDACT-TC-002 identity secret in storage error (via KnownSecretRegistry)
REDACT-TC-003 server URL with password field
REDACT-TC-004 chat text excluded by default
REDACT-TC-005 channel name with Unicode excluded by default
REDACT-TC-006 nickname with Unicode preserved in safe field
REDACT-TC-007 local file path user segment minimized
REDACT-TC-008 mixed sensitive bundle (whole-bundle JSON scan)
REDACT-TC-009 long hostile protocol string truncated
REDACT-TC-010 multilingual safe text preserved
+ known-secret literal scrub
+ empty registered secret ignored
Out of scope: tracing-subscriber integration, diagnostic export
file format, memory/core dumps, performance, adversarial regex
evasion beyond trivial cases. These belong to chanora_diagnostics.
Authority: PoC plan §2, docs/security/diagnostic-redaction-audit-report.md,
SRS-093, SysRS-152/154/155.
Not product code; not promoted into chanora_diagnostics.
105 lines
4.5 KiB
Markdown
105 lines
4.5 KiB
Markdown
# Verification record — `diagnostics-redaction-spike`
|
|
|
|
## Result
|
|
|
|
PASS. The PoC exit criterion (from
|
|
`docs/architecture/proof-of-concept-plan.md` §2: "Password and
|
|
identity-secret samples are redacted") is met, with full coverage of
|
|
REDACT-TC-001..010 from
|
|
`docs/security/diagnostic-redaction-audit-report.md` §4.
|
|
|
|
## Environment
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Date | 2026-05-13 |
|
|
| Host OS | Linux (Arch, kernel 7.0.5-arch1-1, x86_64) |
|
|
| Rust toolchain | stable 1.95.0 |
|
|
| `regex` | 1 |
|
|
| `serde` / `serde_json` | 1 |
|
|
| `once_cell` | 1 |
|
|
|
|
## Reproduction
|
|
|
|
```bash
|
|
cargo test
|
|
printf 'INFO password=hunter2 path=/home/milkice/x\n' \
|
|
| cargo run --bin diagnostics-redaction-cli
|
|
```
|
|
|
|
## Test run
|
|
|
|
```
|
|
running 12 tests
|
|
test known_secret_is_scrubbed_even_when_no_regex_matches ... ok
|
|
test redact_tc_005_channel_name_with_unicode_excluded_by_default ... ok
|
|
test redact_tc_006_nickname_with_unicode_preserved_in_safe_field ... ok
|
|
test redact_tc_002_identity_secret_in_storage_error ... ok
|
|
test redact_tc_010_multilingual_safe_text_preserved ... ok
|
|
test redact_tc_009_long_hostile_protocol_string_truncated ... ok
|
|
test redact_tc_007_local_file_paths_user_segment_minimized ... ok
|
|
test empty_registered_secret_is_ignored ... ok
|
|
test redact_tc_004_chat_text_excluded_by_default ... ok
|
|
test redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields ... ok
|
|
test redact_tc_001_server_password_in_connection_data ... ok
|
|
test redact_tc_003_server_url_with_password_field ... ok
|
|
|
|
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured;
|
|
0 filtered out; finished in 0.01s
|
|
```
|
|
|
|
## CLI run
|
|
|
|
Input:
|
|
|
|
```text
|
|
INFO connect host=cn.teamspeak.app password=hunter2 nickname=Chanora
|
|
DEBUG identity=MG0DAgeAAgEgAiAIXJBlj1hQbaH0Eq0DuLlCmH8bl+veTAO2k9EQjEYSgIgNnImcmKo7ls5mExb6skfK2Twu54aeDr0OP1ITsC50CIA8M5nmDBn
|
|
ERROR open /home/milkice/.local/share/chanora/db failed
|
|
NOTICE CHANORA_LITERAL_DEMO_SECRET seen on bus
|
|
```
|
|
|
|
Output:
|
|
|
|
```text
|
|
INFO connect host=cn.teamspeak.app password=[REDACTED] nickname=Chanora
|
|
DEBUG identity=[REDACTED]
|
|
ERROR open /home/[REDACTED]/.local/share/chanora/db failed
|
|
NOTICE [REDACTED] seen on bus
|
|
```
|
|
|
|
- Password: redacted (rule `password-kv`).
|
|
- Base64-ish identity blob: redacted (rule `identity-base64-blob`).
|
|
- Linux home-username segment: redacted (rule `linux-home-path`); the
|
|
rest of the path is preserved.
|
|
- Pre-registered literal secret: redacted via
|
|
`KnownSecretRegistry`, demonstrating the SS-AUD-003 defence-in-depth.
|
|
- Non-secret tokens (`host=`, `nickname=`, `INFO`, `ERROR`, …) all
|
|
flow through unchanged.
|
|
|
|
## Audit-matrix coverage
|
|
|
|
| Audit ID | Test | Result |
|
|
|---|---|---|
|
|
| REDACT-TC-001 (server password in connection data) | `redact_tc_001_server_password_in_connection_data` | PASS |
|
|
| REDACT-TC-002 (identity secret in storage error) | `redact_tc_002_identity_secret_in_storage_error` | PASS — uses `KnownSecretRegistry`. |
|
|
| REDACT-TC-003 (URL with password field) | `redact_tc_003_server_url_with_password_field` | PASS — only the password value is redacted. |
|
|
| REDACT-TC-004 (chat text in export) | `redact_tc_004_chat_text_excluded_by_default` | PASS — default policy excludes. |
|
|
| REDACT-TC-005 (Unicode channel name) | `redact_tc_005_channel_name_with_unicode_excluded_by_default` | PASS — default policy excludes. |
|
|
| REDACT-TC-006 (Unicode nickname) | `redact_tc_006_nickname_with_unicode_preserved_in_safe_field` | PASS — preserved in non-sensitive extras. |
|
|
| REDACT-TC-007 (local file path) | `redact_tc_007_local_file_paths_user_segment_minimized` | PASS — username segment redacted on Linux/Windows/macOS path shapes. |
|
|
| REDACT-TC-008 (mixed sensitive bundle) | `redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields` | PASS — whole-bundle JSON scanned for plaintext. |
|
|
| REDACT-TC-009 (long hostile protocol string) | `redact_tc_009_long_hostile_protocol_string_truncated` | PASS — `MAX_PROTOCOL_STRING_LEN = 256` cap with truncation marker. |
|
|
| REDACT-TC-010 (multilingual safe text) | `redact_tc_010_multilingual_safe_text_preserved` | PASS — Chinese / Japanese / Korean / Latin-diacritic text preserved verbatim. |
|
|
|
|
## What this spike does NOT validate
|
|
|
|
- Integration as a `tracing` layer (production code will own this).
|
|
- Diagnostic export *file format* (zip / json-lines / archive layout).
|
|
- Mobile-platform path shapes (`/data/data/<pkg>/` on Android,
|
|
iOS app-group containers).
|
|
- Memory / core dumps.
|
|
- Performance under sustained high-volume logging.
|
|
- Adversarial regex evasion beyond the trivial cases exercised.
|
|
- Process-level review of the audit report (SS-AUD-007 style sign-off).
|