Module redaction 

The redaction policy, rustev.redaction/1, its evaluation and the keyed digest (spec 028, 3.3 and 3.4).

Every value a telemetry exporter writes passes Redactor::apply, and every value a trace reader shows passes RedactionPolicy::view. Both are pure: no I/O, no clock, no async runtime. The field names and their class rules are the closed catalogue of crate::trace_fields.

The policy is a description of what may leave the process, never an authorization of any action (principle VI).

Structs

DigestKey

The host’s digest key (3.4.5): 32 to 64 bytes, named by an opaque key_id. It is never serialized, and its Debug form shows only the key_id.

FieldOverride

One fields override (3.4.1).

RedactionPolicy

A redaction policy, rustev.redaction/1 (3.4.1). Parse it with RedactionPolicy::parse_validated; a policy that has not passed RedactionPolicy::validate is never applied.

Redactor

A validated policy with the key its digest actions need: the only path by which an exporter turns a record value into an exported one (3.4.7).

Enums

Action

What happens to a field’s value on export (3.4.1).

Applied

One value after policy application.

FieldClass

Field classes (3.3.1). Every exportable field belongs to exactly one.

KeyError

Why a digest key was refused (3.4.5). Never carries key bytes.

PolicyError

Why a policy was refused (3.4.2). Each names the entry.

RedactorError

Why a Redactor could not be built.

View

How a reader may show one attribute of a trace line (3.11.3).

Constants

DIGEST_DOMAIN

The domain tag of the keyed digest (3.4.5).

KEY_BYTES

The bounds of a digest key, in bytes (3.4.5).

KEY_ID_BYTES

The bounds of a digest key’s key_id, in bytes (3.4.5).

MAX_FIELD_OVERRIDES

The most fields overrides a policy may carry (3.4.1).

REDACTION

The schema string of a redaction policy.

TRUNCATE_BYTES

The bounds of truncate{bytes} (3.4.1).

Functions

lineage_class

The lineage rule for values carried in a judgment (3.3.2): a boolean or enum value is enum; any other value takes the most restrictive provenance class among its lineage’s inputs, in the order attributed-claim, third-party, user-supplied, model-derived, authenticated-app-field, system-of-record; a value whose lineage has no input is plan-metadata. It never assigns a class less restrictive than an input the value may copy.

truncate_str

Cut s to at most max bytes at a UTF-8 character boundary; true when bytes were removed.

truncate_value

Cut every string of v to at most max bytes; other values are left as they are. True when any bytes were removed.