I1950 — Text a run printed is redacted by one rule set
Port the credential table that lib/capture.sh applies into one Rust redactor, held equal to the shell table by one fixture, so that every text the evidence publication carries passes through one rule set (ADR 0087 decision 14).
DONE wave 0 · p1 · implementation profile · parallel safe
Objective
Port the credential table that lib/capture.sh applies into one Rust redactor, held equal to the shell table by one fixture, so that every text the evidence publication carries passes through one rule set (ADR 0087 decision 14).
Why
The publication will carry text a run printed, such as the tail of a failure's log. The repository has a shell credential table, a redactor for schema-marked fields of structured input, and a refusal of machine paths in published artifacts, but no function that turns printed text into public text.
Current state
mj_capture_redact in lib/capture.sh applies MJ_CAPTURE_SECRETS and MJ_CAPTURE_SECRET_ASSIGN with sed; execution/redact.rs redacts schema-marked fields; generate::forbidden_in refuses machine paths and credential markers. The crate has no regex dependency.
Desired state
apps/majordomus-cli/src/redaction.rs offers redact_secrets, normalise_machine_paths and public_text with hand-written matchers; one fixture holds it equal to the shell table; and its output passes generate::forbidden_in.
Scope
- apps/majordomus-cli/src/redaction.rs
- apps/majordomus-cli/src/lib.rs
- apps/majordomus-cli/tests/redaction.rs
- test/fixtures/redaction
- test/cases/504_public_text_is_redacted_once.sh
Out of scope
- lib/capture.sh and lib/usecase.sh: switching the shell to call Rust is a later change
- apps/majordomus-cli/src/execution and apps/majordomus-cli/src/evidence
- A new crate dependency
- docs/CLAIMS.yaml: the publication slice claims the behaviour when it publishes text
Dependencies
None. This issue is a root of the graph.
What waits on this
Acceptance criteria
- The Rust redactor and the shell table produce the same output on one shared fixture
- The output of public_text passes generate::forbidden_in
- cargo test --test redaction and the redaction doctests pass
Validation
- bash test/run.sh 504_public_text_is_redacted_once
- cargo test --test redaction
Evidence required
- one_redactor
Evidence
| covers | type | command | result | at commit |
|---|---|---|---|---|
| one_redactor | test | bash test/run.sh 504_public_text_is_redacted_once | ok at 4090b2b8ae: the shell table is held to every line of test/fixtures/redaction/shapes.tsv and the Rust test to the same file; cargo test --test redaction was not run locally: CI validate run 37744906831 on a tree identical to 4090b2b8ae ran tests/redaction.rs with 10 passed, 0 failed | 4090b2b |
Timeline
- started
- 2026-10-08T10:50:03Z
- verified
- 2026-10-08T10:52:27Z
- completed
- 2026-10-08T10:52:30Z
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I1950.yaml. Read it back with majordomus plan show I1950.