polyc-query 2026.9.6

//! Proves the projected-core types format shape, never content.
//!
//! Every type on this path is reachable from a `tracing` field or an
//! `#[instrument]` attribute, which derive their output from `Debug`. A
//! statement, a parameter value, a released row, an object key, a namespace,
//! a partition, a persona, a signer key, or a signature in that output is a
//! disclosure, so each of those is asserted absent here rather than left to
//! review.
//!
//! Errors are in scope too. Existing `tracing` practice is not authority to
//! render an identifier: a refusal reports what went wrong, never which
//! conversation it went wrong for. Every variant keeps its values so a
//! mechanism can read them, and neither `Display` nor `Debug` renders one.

#![cfg(test)]

use std::time::Duration;

use polyc_query_model as model;
use polyc_query_model::{
    ATTESTATION_SIGNATURE_BYTES, ATTESTATION_SIGNER_BYTES, COMMIT_ROOT_BYTES, Classification,
    DIGEST_BYTES, DataFrame, ErrorClass, ExactObjectRef, INCARNATION_BYTES, JournalAnchor,
    JournalAttestation, JournalSource, ObjectDescriptor, ProjectionKey, ProjectionManifest,
    PublisherFence, QueryOutcome, ResultFrame, Retention, SchemaFrame, SourceCheckpoint,
    SourceEvidence, SourcePin, TerminalFrame, Truncation,
};

use crate::core_execution::CoreExecutionError;
use crate::core_resolution::{
    CoreConsistency, CoreParameter, CoreQueryRequest, CoreRequestedBounds, CoreResolutionError,
};
use polyc_query_credential::session::{MemorySources, QueryScope};

/// Every string a formatted value must never contain.
const SECRETS: &[&str] = &[
    "select secret_column",
    "tenant-secret-value",
    "conv-secret-partition",
    "persona-secret",
    "secret-namespace",
    "secret/object/key",
    "secret-publisher",
    "secret-family",
];

fn assert_redacted(rendered: &str) {
    for secret in SECRETS {
        assert!(
            !rendered.contains(secret),
            "formatted output disclosed `{secret}`: {rendered}"
        );
    }
    // Byte arrays render as decimal lists, so a signer key or signature shows
    // up as a long run of the repeated byte this fixture uses.
    assert!(
        !rendered.contains("77, 77, 77, 77"),
        "formatted output disclosed signature or signer bytes: {rendered}"
    );
}

fn evidence() -> SourceEvidence {
    let key = ProjectionKey::try_new("secret-family".into(), "conv-secret-partition".into())
        .expect("the fixture key is well formed");
    let source = JournalSource::try_new("conv-secret-partition".into(), [77; INCARNATION_BYTES])
        .expect("the fixture source is well formed");
    let manifest = ProjectionManifest::try_new(
        key.clone(),
        4,
        model::ProjectionEvidence::Journal(SourceCheckpoint::new(
            source.clone(),
            11,
            12,
            13,
            JournalAttestation::new(
                [77; COMMIT_ROOT_BYTES],
                14,
                [77; ATTESTATION_SIGNATURE_BYTES],
                [77; ATTESTATION_SIGNER_BYTES],
            ),
        )),
        2,
        3,
        ObjectDescriptor::try_new(
            "secret/object/key".into(),
            4,
            [77; DIGEST_BYTES],
            "persona-secret".into(),
            Classification::Confidential,
            Retention::For(Duration::from_mins(1)),
            4096,
            "secret/object/key".into(),
        )
        .expect("the fixture descriptor is well formed"),
        ExactObjectRef::try_new("secret-namespace".into(), "secret/object/key".into(), 21)
            .expect("the fixture reference is well formed"),
        "secret-publisher".into(),
        PublisherFence::try_new(key, [77; INCARNATION_BYTES], 5)
            .expect("the fixture fence is well formed"),
    )
    .expect("the fixture manifest is well formed");

    SourceEvidence::try_new(vec![
        SourcePin::Projected(Box::new(manifest)),
        SourcePin::Journal(JournalAnchor::new(source, 42)),
    ])
    .expect("the fixture vector is canonical")
}

#[test]
fn the_terminal_frame_never_formats_its_source_evidence() {
    let terminal = TerminalFrame::new(
        QueryOutcome::Failed(ErrorClass::Bounds),
        Duration::from_millis(3),
        9,
        512,
        Truncation::TruncatedAt(9),
        evidence(),
    );

    assert_redacted(&format!("{terminal:?}"));
    assert_redacted(&format!("{:?}", ResultFrame::Terminal(terminal)));
}

#[test]
fn result_frames_never_format_released_rows_or_schemas() {
    let schema = ResultFrame::Schema(
        SchemaFrame::try_new(vec![77; 32]).expect("the fixture frame is bounded"),
    );
    let data = ResultFrame::Data(
        DataFrame::try_new(0, 2, vec![77; 32]).expect("the fixture frame is bounded"),
    );

    assert_redacted(&format!("{schema:?}"));
    assert_redacted(&format!("{data:?}"));
    assert!(format!("{data:?}").contains("arrow_ipc_bytes: 32"));
}

#[test]
fn the_request_never_formats_its_statement_or_parameters() {
    let request = CoreQueryRequest::new(
        "select secret_column from messages".into(),
        vec![
            CoreParameter::Utf8("tenant-secret-value".into()),
            CoreParameter::UInt64(7),
        ],
        CoreConsistency::Projected,
        CoreRequestedBounds::unbounded(),
    );

    let rendered = format!("{request:?}");
    assert_redacted(&rendered);
    assert!(rendered.contains("sql_bytes"), "{rendered}");
    assert!(rendered.contains("parameters: 2"), "{rendered}");
}

#[test]
fn the_scope_never_formats_its_conversations() {
    let scope = QueryScope::Conversations {
        conversations: vec!["conv-secret-partition".into(), "persona-secret".into()],
        memory: MemorySources::default(),
    };

    let rendered = format!("{scope:?}");
    assert_redacted(&rendered);
    assert!(rendered.contains("count: 2"), "{rendered}");
    assert_eq!(format!("{:?}", QueryScope::Fleet), "Fleet");
}

#[test]
fn a_parameter_formats_its_kind_only() {
    assert_eq!(
        format!("{:?}", CoreParameter::Utf8("tenant-secret-value".into())),
        "utf8"
    );
    assert_eq!(format!("{:?}", CoreParameter::Null), "null");
}

/// A refusal must name what failed, never which conversation it failed for.
#[test]
fn refusals_never_render_a_partition_or_a_statement() {
    let partition = polyc_state::id::PartitionId::new("conv-secret-partition");
    let refusals: Vec<CoreExecutionError> = vec![
        CoreExecutionError::SourceChanged(partition.clone()),
        CoreResolutionError::MissingSource(partition.clone()).into(),
        CoreResolutionError::SourceMismatch(partition.clone()).into(),
        CoreResolutionError::MissingProjection(partition.clone()).into(),
        CoreResolutionError::Superseded(partition.clone()).into(),
        CoreResolutionError::IncompatibleDescriptor(partition).into(),
        CoreResolutionError::Statement(crate::statement_gate::StatementRejected::DisallowedKind(
            "select secret_column from messages".to_owned(),
        ))
        .into(),
        CoreResolutionError::UnknownDependency("secret-namespace".to_owned()).into(),
    ];

    for refusal in refusals {
        assert_redacted(&format!("{refusal}"));
        assert_redacted(&format!("{refusal:?}"));
    }
}

/// A numeric ceiling is not an identifier, so a bound refusal keeps its counts.
#[test]
fn a_bound_refusal_still_reports_its_numbers() {
    let refusal = CoreExecutionError::ReleaseBound {
        observed: 4096,
        limit: 1024,
    };
    let rendered = format!("{refusal}");
    assert_redacted(&rendered);
    assert!(rendered.contains("4096"), "{rendered}");
    assert!(rendered.contains("1024"), "{rendered}");
    assert_eq!(format!("{refusal:?}"), "ReleaseBound");
}

/// The query-audit evidence renders its ordinal and nothing else.
///
/// The arm added to the manifest sweep above never runs: that fixture folds
/// from a journal, so only its journal arm is reached. Without this test a
/// derived `Debug` would print the lineage and the entry digest, and the file
/// whose whole subject is what a `tracing` field renders would stay green.
#[test]
fn audit_evidence_formats_shape_only() {
    let evidence = model::ProjectionEvidence::QueryAudit(model::AuditCheckpoint::new(
        "state.query_audit".to_owned(),
        [0xAB; model::INCARNATION_BYTES],
        7,
        [0xCD; model::DIGEST_BYTES],
    ));
    let rendered = format!("{evidence:?}");
    assert_redacted(&rendered);
    assert!(
        rendered.contains('7'),
        "the ordinal is shape and must render: {rendered}"
    );
    // The lineage and the entry digest are content. Neither may appear, in
    // any rendering a byte array can take.
    assert!(
        !rendered.to_lowercase().contains("ab") && !rendered.contains("171"),
        "the lineage reached a Debug rendering: {rendered}"
    );
    assert!(
        !rendered.to_lowercase().contains("cd") && !rendered.contains("205"),
        "the entry digest reached a Debug rendering: {rendered}"
    );
}

/// The evidence types are reachable from a log line on their own.
#[test]
fn versioned_evidence_formats_shape_only() {
    // The partition and namespace are in the hunted `SECRETS` list, so a
    // derived `Debug` on any of the three Versioned types reds this. The
    // aggregate id is NOT in that list; it is here because a real source
    // carries one, not because this assertion would catch it.
    let evidence = model::ProjectionEvidence::Versioned(model::VersionedCheckpoint::new(
        model::VersionedSource::try_new(
            "conv-secret-aggregate".into(),
            "conv-secret-partition".into(),
            "secret-namespace".into(),
            [77; INCARNATION_BYTES],
        )
        .expect("the fixture source is well formed"),
        11,
        [77; DIGEST_BYTES],
    ));
    assert_redacted(&format!("{evidence:?}"));
    let model::ProjectionEvidence::Versioned(checkpoint) = &evidence else {
        panic!("the fixture folds from a Versioned feed");
    };
    assert_redacted(&format!("{checkpoint:?}"));
    assert_redacted(&format!("{:?}", checkpoint.source()));
}

#[test]
fn source_evidence_formats_shape_only_on_every_type() {
    let evidence = evidence();
    assert_redacted(&format!("{evidence:?}"));
    assert!(format!("{evidence:?}").contains("pins: 2"));

    for pin in evidence.pins() {
        assert_redacted(&format!("{pin:?}"));
        if let SourcePin::Projected(manifest) = pin {
            assert_redacted(&format!("{manifest:?}"));
            assert_redacted(&format!("{:?}", manifest.key()));
            assert_redacted(&format!("{:?}", manifest.object()));
            assert_redacted(&format!("{:?}", manifest.artifact_object()));
            assert_redacted(&format!("{:?}", manifest.fence()));
            assert_redacted(&format!("{:?}", manifest.evidence()));
            // This fixture folds from a journal, so only that arm runs here.
            // The Versioned arm is covered by
            // `versioned_evidence_formats_shape_only`; matching rather than
            // panicking keeps this from breaking when a fixture changes.
            match manifest.evidence() {
                model::ProjectionEvidence::Journal(checkpoint) => {
                    assert_redacted(&format!("{checkpoint:?}"));
                    assert_redacted(&format!("{:?}", checkpoint.source()));
                    assert_redacted(&format!("{:?}", checkpoint.covering_attestation()));
                }
                model::ProjectionEvidence::Versioned(checkpoint) => {
                    assert_redacted(&format!("{checkpoint:?}"));
                    assert_redacted(&format!("{:?}", checkpoint.source()));
                }
                model::ProjectionEvidence::QueryAudit(checkpoint) => {
                    assert_redacted(&format!("{checkpoint:?}"));
                }
                model::ProjectionEvidence::PersonaMemory(checkpoint) => {
                    assert_redacted(&format!("{checkpoint:?}"));
                }
                model::ProjectionEvidence::Observed(checkpoint) => {
                    assert_redacted(&format!("{checkpoint:?}"));
                }
            }
        }
    }
}

/// The retained credential must never render the token it retains.
///
/// The witness lives for the whole stream and is a natural `tracing` field on
/// the release path. A bearer token in that output is a session another
/// person can replay; a grant token is a conversation another person can
/// read. Only the kind may appear.
#[test]
fn a_credential_witness_formats_only_the_kind_it_holds() {
    use polyc_query_credential::credential::PresentedCredential;

    let bearer = PresentedCredential::Bearer("secret-bearer-token".to_owned());
    let grant = PresentedCredential::ConversationGrant("secret-grant-token".to_owned());

    for (credential, expected) in [(&bearer, "bearer"), (&grant, "conversation-grant")] {
        let rendered = format!("{credential:?}");
        assert_eq!(rendered, expected);
        assert!(
            !rendered.contains("secret-bearer-token") && !rendered.contains("secret-grant-token"),
            "the witness disclosed a credential: {rendered}"
        );
        assert_redacted(&rendered);
    }

    // The same holds one level up: a witness debugged as a field of the
    // structure that owns it must not widen what its credential renders.
    let owner = format!("{:?}", (&bearer, &grant));
    assert!(
        !owner.contains("secret-bearer-token") && !owner.contains("secret-grant-token"),
        "a nested render disclosed a credential: {owner}"
    );
}