EdisonJwa
06ec6f2965
Proof-of-concept proving the diagnostics-redaction exit criterion from
docs/architecture/proof-of-concept-plan.md §2:
"Password and identity-secret samples are redacted."
Full coverage of the audit-report test matrix in
docs/security/diagnostic-redaction-audit-report.md §4
(REDACT-TC-001..010), plus two sanity tests.
The spike ships:
- RedactionPolicy: typed catalogue of regex rules
(identity-base64-blob, password-kv, ts3server-url-password,
authorization-bearer, linux/windows/macos user-path) with
optional capture-group narrowing.
- Structured-field redaction keyed on case-insensitive name
substrings (password, secret, token, ...).
- Bundle-level switches: chat and channel tree excluded by
default per audit-report §5.
- KnownSecretRegistry: literal-substring scrub for secrets the
host application has already loaded into memory (defense in
depth that regexes alone cannot guarantee — closes the gap
behind REDACT-TC-002).
- Length cap (MAX_PROTOCOL_STRING_LEN = 256) with truncation
marker for REDACT-TC-009.
- UTF-8 preserved in non-sensitive fields per REDACT-TC-010 /
ADR-008.
Test suite (12/12 PASS on 2026-05-13):
REDACT-TC-001 server password in connection data
REDACT-TC-002 identity secret in storage error (via KnownSecretRegistry)
REDACT-TC-003 server URL with password field
REDACT-TC-004 chat text excluded by default
REDACT-TC-005 channel name with Unicode excluded by default
REDACT-TC-006 nickname with Unicode preserved in safe field
REDACT-TC-007 local file path user segment minimized
REDACT-TC-008 mixed sensitive bundle (whole-bundle JSON scan)
REDACT-TC-009 long hostile protocol string truncated
REDACT-TC-010 multilingual safe text preserved
+ known-secret literal scrub
+ empty registered secret ignored
Out of scope: tracing-subscriber integration, diagnostic export
file format, memory/core dumps, performance, adversarial regex
evasion beyond trivial cases. These belong to chanora_diagnostics.
Authority: PoC plan §2, docs/security/diagnostic-redaction-audit-report.md,
SRS-093, SysRS-152/154/155.
Not product code; not promoted into chanora_diagnostics.
32 lines
1.3 KiB
Rust
32 lines
1.3 KiB
Rust
//! Chanora PoC — diagnostics redaction spike.
|
|
//!
|
|
//! Authority:
|
|
//! * `docs/architecture/proof-of-concept-plan.md` §2 — Diagnostics
|
|
//! redaction spike. Exit criterion: "Password and identity-secret
|
|
//! samples are redacted."
|
|
//! * `docs/security/diagnostic-redaction-audit-report.md` — policy
|
|
//! in §2, surfaces in §3, test matrix REDACT-TC-001..010 in §4,
|
|
//! bundle policy in §5.
|
|
//! * SRS-093 / SysRS-152 / SysRS-154 / SysRS-155 — software-level
|
|
//! redaction obligations for logs and diagnostic exports.
|
|
//!
|
|
//! Production code will own this redactor inside the `chanora_diagnostics`
|
|
//! crate and wire it as a `tracing` layer. The PoC is the same shape in
|
|
//! miniature: a typed policy, a redactor that applies it to free text
|
|
//! and to structured diagnostic bundles, plus an explicit list of
|
|
//! known-literal secrets the host application can register at runtime.
|
|
|
|
pub mod bundle;
|
|
pub mod policy;
|
|
pub mod redactor;
|
|
|
|
pub use bundle::{DiagnosticBundle, RedactedBundle};
|
|
pub use policy::{RedactionPolicy, RedactionRule};
|
|
pub use redactor::{KnownSecretRegistry, Redactor};
|
|
|
|
/// The replacement string used for redacted segments.
|
|
///
|
|
/// Chosen distinctly so audit tests can grep for either presence
|
|
/// (correct redaction occurred) or absence (no leak).
|
|
pub const REDACTION_MARKER: &str = "[REDACTED]";
|