ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

Spec 120: harden secret redaction integrity #146

Merged
ahmido merged 1 commits from 120-secret-redaction-integrity into dev 2026-03-07 16:43:02 +00:00
Conversation 0 Commits 1 Files Changed 64 +4124 -255
ahmido commented 2026-03-07 16:42:30 +00:00
Owner
Copy Link

Summary

  • replace broad substring-based masking with a shared exact/path-based secret classifier and workspace-scoped fingerprint hashing
  • persist protected snapshot metadata on policy_versions and keep secret-only changes visible in compare, drift, restore, review, verification, and ops surfaces
  • add Spec 120 artifacts, audit documentation, and focused Pest regression coverage for snapshot, audit, verification, review-pack, and notification behavior

Validation

  • vendor/bin/sail artisan test --compact tests/Feature/Intune/PolicySnapshotRedactionTest.php tests/Feature/Intune/PolicySnapshotFingerprintIsolationTest.php tests/Feature/ReviewPack/ReviewPackRedactionIntegrityTest.php tests/Feature/OpsUx/OperationRunNotificationRedactionTest.php tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php
  • vendor/bin/sail bin pint --dirty --format agent

Spec / checklist status

Checklist Total Completed Incomplete Status
requirements.md 16 16 0 ✓ PASS
  • tasks.md: T001-T032 complete
  • tasks.md: T033 manual quickstart validation is still open and noted for follow-up

Filament / platform notes

  • Livewire v4 compliance is unchanged
  • no panel provider changes; bootstrap/providers.php remains the registration location
  • no new globally searchable resources were introduced, so global search requirements are unchanged
  • no new destructive Filament actions were added
  • no new Filament assets were added; no filament:assets deployment change is required

Testing coverage touched

  • snapshot persistence and fingerprint isolation
  • compare/drift protected-change evidence
  • audit, verification, review-pack, ops-failure, and notification sanitization
  • viewer/read-only Filament presentation updates
## Summary - replace broad substring-based masking with a shared exact/path-based secret classifier and workspace-scoped fingerprint hashing - persist protected snapshot metadata on `policy_versions` and keep secret-only changes visible in compare, drift, restore, review, verification, and ops surfaces - add Spec 120 artifacts, audit documentation, and focused Pest regression coverage for snapshot, audit, verification, review-pack, and notification behavior ## Validation - `vendor/bin/sail artisan test --compact tests/Feature/Intune/PolicySnapshotRedactionTest.php tests/Feature/Intune/PolicySnapshotFingerprintIsolationTest.php tests/Feature/ReviewPack/ReviewPackRedactionIntegrityTest.php tests/Feature/OpsUx/OperationRunNotificationRedactionTest.php tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php` - `vendor/bin/sail bin pint --dirty --format agent` ## Spec / checklist status | Checklist | Total | Completed | Incomplete | Status | |-----------|-------|-----------|------------|--------| | requirements.md | 16 | 16 | 0 | ✓ PASS | - `tasks.md`: T001-T032 complete - `tasks.md`: T033 manual quickstart validation is still open and noted for follow-up ## Filament / platform notes - Livewire v4 compliance is unchanged - no panel provider changes; `bootstrap/providers.php` remains the registration location - no new globally searchable resources were introduced, so global search requirements are unchanged - no new destructive Filament actions were added - no new Filament assets were added; no `filament:assets` deployment change is required ## Testing coverage touched - snapshot persistence and fingerprint isolation - compare/drift protected-change evidence - audit, verification, review-pack, ops-failure, and notification sanitization - viewer/read-only Filament presentation updates
ahmido added 1 commit 2026-03-07 16:42:31 +00:00
ahmido merged commit cd811cff4f into dev 2026-03-07 16:43:02 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: ahmido/TenantAtlas#146
No description provided.
Delete Branch "120-secret-redaction-integrity"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?