v0.3.13-pre.010

crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 21
+// version: 22
 
 //! External public, security, redaction and release-boundary hardening canaries for `pre.010`.
 
@@ -828,3 +828,29 @@ fn v0_3_13_pre_009_duplicate_storm_disagreement_and_starvation_guards_are_explic
     }
     return;
 }
+
+#[test]
+fn v0_3_13_pre_010_multi_source_health_is_conservative_counted_and_redacted() {
+    let snapshot = include_str!("../src/snapshot.rs");
+    let resources = include_str!("../src/runtime_resources.rs");
+    for required in [
+        "source_total: usize",
+        "source_active: usize",
+        "source_reconnecting: usize",
+        "source_failed: usize",
+        "source_reconnecting > 0",
+        "source_failed > 0",
+        "source_active < source_total",
+        "WorkerHealth::Degraded",
+        "WorkerHealth::Unhealthy",
+    ] {
+        assert!(snapshot.contains(required), "required pre.010 health guard missing: {required}");
+    }
+    for required in ["source_total = self.source_projections.len()", "with_source_counts(source_total, source_active, source_reconnecting, source_failed)"] {
+        assert!(resources.contains(required), "required pre.010 inventory count guard missing: {required}");
+    }
+    for forbidden in ["source_key: [u8; 32]", "provider_url", "endpoint_url", "filter_fingerprint", "credential", "api_key", "token_header"] {
+        assert!(!snapshot.contains(forbidden), "pre.010 snapshot leaks source/provider material: {forbidden}");
+    }
+    return;
+}