Files

T

EdisonJwa 06ec6f2965 feat(poc/diagnostics): add diagnostics-redaction spike

Proof-of-concept proving the diagnostics-redaction exit criterion from
docs/architecture/proof-of-concept-plan.md §2:
  "Password and identity-secret samples are redacted."

Full coverage of the audit-report test matrix in
docs/security/diagnostic-redaction-audit-report.md §4
(REDACT-TC-001..010), plus two sanity tests.

The spike ships:
  - RedactionPolicy: typed catalogue of regex rules
    (identity-base64-blob, password-kv, ts3server-url-password,
     authorization-bearer, linux/windows/macos user-path) with
    optional capture-group narrowing.
  - Structured-field redaction keyed on case-insensitive name
    substrings (password, secret, token, ...).
  - Bundle-level switches: chat and channel tree excluded by
    default per audit-report §5.
  - KnownSecretRegistry: literal-substring scrub for secrets the
    host application has already loaded into memory (defense in
    depth that regexes alone cannot guarantee — closes the gap
    behind REDACT-TC-002).
  - Length cap (MAX_PROTOCOL_STRING_LEN = 256) with truncation
    marker for REDACT-TC-009.
  - UTF-8 preserved in non-sensitive fields per REDACT-TC-010 /
    ADR-008.

Test suite (12/12 PASS on 2026-05-13):
  REDACT-TC-001 server password in connection data
  REDACT-TC-002 identity secret in storage error (via KnownSecretRegistry)
  REDACT-TC-003 server URL with password field
  REDACT-TC-004 chat text excluded by default
  REDACT-TC-005 channel name with Unicode excluded by default
  REDACT-TC-006 nickname with Unicode preserved in safe field
  REDACT-TC-007 local file path user segment minimized
  REDACT-TC-008 mixed sensitive bundle (whole-bundle JSON scan)
  REDACT-TC-009 long hostile protocol string truncated
  REDACT-TC-010 multilingual safe text preserved
  + known-secret literal scrub
  + empty registered secret ignored

Out of scope: tracing-subscriber integration, diagnostic export
file format, memory/core dumps, performance, adversarial regex
evasion beyond trivial cases. These belong to chanora_diagnostics.

Authority: PoC plan §2, docs/security/diagnostic-redaction-audit-report.md,
SRS-093, SysRS-152/154/155.
Not product code; not promoted into chanora_diagnostics.

2026-05-14 12:26:49 +08:00

4.5 KiB

Raw Blame History

Verification record — `diagnostics-redaction-spike`

Result

PASS. The PoC exit criterion (from docs/architecture/proof-of-concept-plan.md §2: "Password and identity-secret samples are redacted") is met, with full coverage of REDACT-TC-001..010 from docs/security/diagnostic-redaction-audit-report.md §4.

Environment

Field	Value
Date	2026-05-13
Host OS	Linux (Arch, kernel 7.0.5-arch1-1, x86_64)
Rust toolchain	stable 1.95.0
`regex`	1
`serde` / `serde_json`	1
`once_cell`	1

Reproduction

cargo test
printf 'INFO password=hunter2 path=/home/milkice/x\n' \
    | cargo run --bin diagnostics-redaction-cli

Test run

running 12 tests
test known_secret_is_scrubbed_even_when_no_regex_matches ... ok
test redact_tc_005_channel_name_with_unicode_excluded_by_default ... ok
test redact_tc_006_nickname_with_unicode_preserved_in_safe_field ... ok
test redact_tc_002_identity_secret_in_storage_error ... ok
test redact_tc_010_multilingual_safe_text_preserved ... ok
test redact_tc_009_long_hostile_protocol_string_truncated ... ok
test redact_tc_007_local_file_paths_user_segment_minimized ... ok
test empty_registered_secret_is_ignored ... ok
test redact_tc_004_chat_text_excluded_by_default ... ok
test redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields ... ok
test redact_tc_001_server_password_in_connection_data ... ok
test redact_tc_003_server_url_with_password_field ... ok

test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured;
                 0 filtered out; finished in 0.01s

CLI run

Input:

INFO connect host=cn.teamspeak.app password=hunter2 nickname=Chanora
DEBUG identity=MG0DAgeAAgEgAiAIXJBlj1hQbaH0Eq0DuLlCmH8bl+veTAO2k9EQjEYSgIgNnImcmKo7ls5mExb6skfK2Twu54aeDr0OP1ITsC50CIA8M5nmDBn
ERROR open /home/milkice/.local/share/chanora/db failed
NOTICE CHANORA_LITERAL_DEMO_SECRET seen on bus

Output:

INFO connect host=cn.teamspeak.app password=[REDACTED] nickname=Chanora
DEBUG identity=[REDACTED]
ERROR open /home/[REDACTED]/.local/share/chanora/db failed
NOTICE [REDACTED] seen on bus

Password: redacted (rule password-kv).
Base64-ish identity blob: redacted (rule identity-base64-blob).
Linux home-username segment: redacted (rule linux-home-path); the rest of the path is preserved.
Pre-registered literal secret: redacted via KnownSecretRegistry, demonstrating the SS-AUD-003 defence-in-depth.
Non-secret tokens (host=, nickname=, INFO, ERROR, …) all flow through unchanged.

Audit-matrix coverage

Audit ID	Test	Result
REDACT-TC-001 (server password in connection data)	`redact_tc_001_server_password_in_connection_data`	PASS
REDACT-TC-002 (identity secret in storage error)	`redact_tc_002_identity_secret_in_storage_error`	PASS — uses `KnownSecretRegistry`.
REDACT-TC-003 (URL with password field)	`redact_tc_003_server_url_with_password_field`	PASS — only the password value is redacted.
REDACT-TC-004 (chat text in export)	`redact_tc_004_chat_text_excluded_by_default`	PASS — default policy excludes.
REDACT-TC-005 (Unicode channel name)	`redact_tc_005_channel_name_with_unicode_excluded_by_default`	PASS — default policy excludes.
REDACT-TC-006 (Unicode nickname)	`redact_tc_006_nickname_with_unicode_preserved_in_safe_field`	PASS — preserved in non-sensitive extras.
REDACT-TC-007 (local file path)	`redact_tc_007_local_file_paths_user_segment_minimized`	PASS — username segment redacted on Linux/Windows/macOS path shapes.
REDACT-TC-008 (mixed sensitive bundle)	`redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields`	PASS — whole-bundle JSON scanned for plaintext.
REDACT-TC-009 (long hostile protocol string)	`redact_tc_009_long_hostile_protocol_string_truncated`	PASS — `MAX_PROTOCOL_STRING_LEN = 256` cap with truncation marker.
REDACT-TC-010 (multilingual safe text)	`redact_tc_010_multilingual_safe_text_preserved`	PASS — Chinese / Japanese / Korean / Latin-diacritic text preserved verbatim.

What this spike does NOT validate

Integration as a tracing layer (production code will own this).
Diagnostic export file format (zip / json-lines / archive layout).
Mobile-platform path shapes (/data/data/<pkg>/ on Android, iOS app-group containers).
Memory / core dumps.
Performance under sustained high-volume logging.
Adversarial regex evasion beyond the trivial cases exercised.
Process-level review of the audit report (SS-AUD-007 style sign-off).

4.5 KiB Raw Blame History

Verification record — diagnostics-redaction-spike