v0.3.13-pre.003

crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 11
+// version: 12
 
 //! External public, security, redaction and release-boundary hardening canaries for `pre.010`.
 
@@ -159,7 +159,10 @@ fn pre_010_source_visibility_contract_uses_crate_root_for_shared_items() {
         (include_str!("../src/runtime.rs"), &["RawTransactionIngestHandle", "RawTransactionIngestWorker"]),
         (include_str!("../src/snapshot.rs"), &["RawTransactionIngestSnapshot", "RawTransactionIngestSnapshotSource"]),
         (include_str!("../src/persistence.rs"), &["RawTransactionIngestPersistenceOutcome", "RawTransactionIngestPersistencePort"]),
-        (include_str!("../src/runtime_resources.rs"), &["RawTransactionIngestYellowstoneSource", "RawTransactionIngestRuntimeResources"]),
+        (
+            include_str!("../src/runtime_resources.rs"),
+            &["RawTransactionIngestStandardLogsSource", "RawTransactionIngestYellowstoneSource", "RawTransactionIngestRuntimeResources"],
+        ),
     ];
     for (source, symbols) in source_contracts {
         for symbol in symbols {
@@ -317,7 +320,8 @@ fn v0_3_12_pre_003_private_signal_debug_and_shape_do_not_expose_signature_filter
 fn v0_3_12_pre_004_hydration_provenance_and_remote_material_are_bounded_and_redacted() {
     let resources = include_str!("../src/runtime_resources.rs");
     for required in [
-        "ys.{}:http.{}",
+        "route_prefix",
+        "{}.{}:http.{}",
         "composite_provider_unrepresentable",
         "composite_endpoint_unrepresentable",
         "RawAcquisitionOrigin::Live",
@@ -390,7 +394,7 @@ fn v0_3_12_pre_006_runtime_resource_contract_opens_one_supervised_transport_sour
         assert!(resources.contains(required), "productive runtime-resource source behavior missing: {required}");
     }
     assert!(runtime.contains("start_with_runtime_resources"));
-    assert!(runtime.contains("source.run(source_settings, stop_receiver, admission_sender, processing_frontier_sender)"));
+    assert!(runtime.contains("run_single_live_source(source_settings, stop_receiver, admission_sender, processing_frontier_sender)"));
     for forbidden in ["get_block_observed", "ksp_config_lib::", "ksp_store_postgres_lib::", "reqwest::", "tonic::", "yellowstone_grpc_proto::"] {
         assert!(!resources.contains(forbidden) && !runtime.contains(forbidden), "pre.006 runtime source crossed a forbidden boundary: {forbidden}");
     }
@@ -402,7 +406,7 @@ fn v0_3_12_pre_006_source_coalescence_is_bounded_stop_preemptible_and_redacted()
     let resources = include_str!("../src/runtime_resources.rs");
     for required in [
         "max_in_flight: settings.persistence_concurrency()",
-        "max_pending_signals: crate::MAX_RAW_TRANSACTION_INGEST_ADMISSION_QUEUE_CAPACITY",
+        "max_pending_signals: settings.admission_queue_capacity()",
         "pending_signal_count",
         "stop_receiver.changed()",
         "tasks.abort_all()",
@@ -523,6 +527,45 @@ fn v0_3_12_pre_008_reconnect_projection_is_source_neutral_bounded_and_contains_n
     return;
 }
 
+#[test]
+fn v0_3_13_pre_003_standard_logs_redaction_and_reference_only_contract_are_explicit() {
+    let resources = include_str!("../src/runtime_resources.rs");
+    for required in [
+        "RawTransactionIngestStandardLogsSource",
+        ".field(\"filter_kind\"",
+        ".field(\"filter_fingerprint_bytes\"",
+        ".field(\"source_key_bytes\"",
+        "project_standard_logs_signal",
+        "matched_filter_count: 1",
+        "transaction_index: std::option::Option::None",
+        "created_at: std::option::Option::None",
+    ] {
+        assert!(resources.contains(required), "required pre.003 redaction/reference guard missing: {required}");
+    }
+    let source_struct = match resources.split_once("pub struct RawTransactionIngestStandardLogsSource {") {
+        std::option::Option::Some((_, tail)) => match tail.split_once("impl crate::RawTransactionIngestStandardLogsSource") {
+            std::option::Option::Some((value, _)) => value,
+            std::option::Option::None => "",
+        },
+        std::option::Option::None => "",
+    };
+    assert!(source_struct.contains("filter: ksp_onchain_transport_lib::SolanaLogsSubscribeFilter"));
+    for forbidden in ["logs:", "err:", "payload:", "body:", "url:"] {
+        assert!(!source_struct.contains(forbidden), "remote/sensitive material stored in standard logs source: {forbidden}");
+    }
+    let projection = match resources.split_once("fn project_standard_logs_signal") {
+        std::option::Option::Some((_, tail)) => match tail.split_once("fn route_yellowstone_update") {
+            std::option::Option::Some((value, _)) => value,
+            std::option::Option::None => "",
+        },
+        std::option::Option::None => "",
+    };
+    for forbidden in [".logs()", ".err()"] {
+        assert!(!projection.contains(forbidden), "logs/error material copied into standard logs projection: {forbidden}");
+    }
+    return;
+}
+
 #[test]
 fn v0_3_12_pre_009_hydration_retry_ownership_and_no_orphan_cleanup_are_explicit() {
     let resources = include_str!("../src/runtime_resources.rs");