v0.3.12-pre.003

crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 3
+// version: 4
 
 //! External public, security, redaction and release-boundary hardening canaries for `pre.010`.
 
@@ -278,6 +278,40 @@ fn v0_3_12_pre_002_production_sources_keep_transport_confined_to_runtime_resourc
     return;
 }
 
+#[test]
+fn v0_3_12_pre_003_private_signal_debug_and_shape_do_not_expose_signature_filters_or_payload() {
+    let root = include_str!("../src/lib.rs");
+    let resources = include_str!("../src/runtime_resources.rs");
+    assert!(resources.contains("struct RawTransactionIngestSourceSignal"));
+    assert!(!root.contains("RawTransactionIngestSourceSignal"));
+    assert!(!resources.contains(".field(\"matched_filter_fingerprint\", &self.matched_filter_fingerprint)"));
+    assert!(!resources.contains(".field(\"signature\", &self.signature)"));
+    let signal_struct = match resources.split_once("struct RawTransactionIngestSourceSignal {") {
+        std::option::Option::Some((_, tail)) => match tail.split_once("}\n\nimpl std::fmt::Debug for RawTransactionIngestSourceSignal") {
+            std::option::Option::Some((value, _)) => value,
+            std::option::Option::None => "",
+        },
+        std::option::Option::None => "",
+    };
+    for forbidden in ["transaction:", "meta:", "error:", "payload:", "body:", "is_vote:"] {
+        assert!(!signal_struct.contains(forbidden), "payload/provider-specific field leaked into private source signal: {forbidden}");
+    }
+    for required in [
+        "created_at:",
+        "family:",
+        "matched_filter_count:",
+        "matched_filter_fingerprint:",
+        "network:",
+        "route:",
+        "signature:",
+        "slot:",
+        "transaction_index:",
+    ] {
+        assert!(signal_struct.contains(required), "required private signal field missing: {required}");
+    }
+    return;
+}
+
 #[test]
 fn v0_3_12_pre_002_runtime_resource_contract_performs_no_live_io_or_source_spawn() {
     let resources = include_str!("../src/runtime_resources.rs");