Repository navigation
export-webhook: the auth header's value is redacted from Debug; the settings schema keeps to 1.5.5's pack rules (Q128 M2) - #27
Merged
Conversation
…ebug (Q128 export-webhook M2) Ruling (coordinator, 2026-10-18): the secret is handled as a secret, never shown through Debug. ExportAuthHeader derives Debug over its value, and WebhookSettings and the instance derive it over the header, so formatting any of them prints the credential. RED test: the_auth_header_value_is_redacted_from_debug
…rules accept (Q128 export-webhook M2) Ruling (coordinator, 2026-10-18, (B)): 1.5.5's busbar-plugin-pack refuses an x-busbar-secret marker that is not a direct root property (busbar qa/evidence/inventory/1.5.5-plugins-stores.md:1972), so the marker on auth_header.value is a declaration the release cannot pack; and an export's settings are not resolved, so "a secret reference resolves at open" is false. RED test: the_settings_schema_is_one_the_pack_rules_accept
…ettings schema carries no nested marker and no resolution claim (Q128 export-webhook M2)
ExportAuthHeader's Debug names the header and prints its value as <redacted>; WebhookSettings
and the instance format the header through it. The settings schema drops the nested
x-busbar-secret marker on auth_header.value (1.5.5's pack refuses it: busbar
qa/evidence/inventory/1.5.5-plugins-stores.md:1972; accepting it is owner-signable) and the false
"a secret reference resolves at open" (an export's settings are not resolved); the value is
described as 1.5.5 described it, riding the ${VAR} interpolation.
M2's protection is this redaction plus the host's whole-bag settings redaction in every admin view
(busbar crates/busbar-core-admin/src/v1/service.rs redact_settings_bags, held by
`cargo xtask gate settings-leak`).
MattJackson
force-pushed
the
lane-q128-webhook-m2-debug
branch
from
October 18, 2026 18:53
d1b2462 to
6c88aa3
Compare
…ug (Q128 export-webhook LOW, config.rs:14-19) RED test: the_url_userinfo_is_masked_in_debug
…Q128 export-webhook LOW, config.rs:14-19) WebhookSettings' Debug prints the url through mask_userinfo, as every line the sink writes does (§11.13), and the auth header through its redacting Debug: no formatted setting carries a credential.
…as 1.5.5 parity, with its cites
…, src/lib.rs:32-35, 533-570) The targeted contract lends check's instance list through the SDK (CheckIn: instances()), so the one allowed unsafe block, justified by 'the SDK has no safe reader', is not needed. RED test: no_source_file_allows_or_spells_unsafe
…lend, no unsafe; the in-flight doc states the fold (Q128 export-webhook LOW, NIT) instances() reads CheckIn's list through instances() and each name and settings blob through the lend's bytes(); the allowed unsafe block and its 'no safe reader' justification go. The MAX_INFLIGHT doc says check refuses the largest instance's bound (1.5.5's fold) and the host clamps each instance to at least one permit.
… named in 1.5.5's words (Q128 export-webhook LOW, src/lib.rs:391-403) RED test: a_refused_target_is_named_in_1_5_5_words_when_it_is_the_scheme
…f 1.5.5's three rules (Q128 export-webhook LOW) refusal_words keeps the scheme rule and adds 1.5.5's other two on this path, in its order (v1.5.5 observability.rs validate_webhook_url): a URL that does not parse (url::Url, the type reqwest::Url re-exports, so the parse error reads the same) and a parseable https target the host refused, the destination guard's line with the userinfo masked. The host's words stay for a host that gave no verdict and any failure that is not a refusal.
…ebug # Conflicts: # export-webhook/settings.schema.json # export-webhook/src/tests.rs
MattJackson
enabled auto-merge
October 19, 2026 09:03
…it (Q128 export-webhook NIT)
MattJackson
disabled auto-merge
October 19, 2026 09:17
… exchange on the settings it started under, and reports the target it was sent to; an unknown check phase is refused (Q128 export-webhook r91 LOW, NIT)
MattJackson
enabled auto-merge
October 19, 2026 09:18
MattJackson
disabled auto-merge
October 19, 2026 09:23
…ent-encoding and base64 crates 1.5.5's reqwest used; the in-flight ceiling's and the Statement test's comments say what the code does (Q128 export-webhook r111 NIT x2, comment sweep)
MattJackson
enabled auto-merge
October 19, 2026 09:24
MattJackson
disabled auto-merge
October 19, 2026 09:28
…ttings finishes its parked exchange, then drops the batch's remaining lines with a warn, so credentials and target stay paired (Q128 export-webhook r132 LOW)
…-7100 (ruling 10)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Q128 export-webhook M2 (the auth header value not handled as a secret). This is a follow-up to #24, under the coordinator's 2026-10-18 ruling (B).
ExportAuthHeader's Debug prints the value as<redacted>. WebhookSettings and the instance format the header through it.the_auth_header_value_is_redacted_from_debug(cd78d24).auth_header.valuex-busbar-secret, but 1.5.5's busbar-plugin-pack refuses a marker that is not a direct root property (busbar qa/evidence/inventory/1.5.5-plugins-stores.md:1972). The release could not pack that file. The marker is removed; accepting nested markers is listed as owner-signable.the_settings_schema_is_one_the_pack_rules_accept(cc7d994, branch lane-q128-webhook-m2-red, run 39156246877).redact_settings_bags), andcargo xtask gate settings-leakholds that.auth_headeris echoed in the refusal text, as 1.5.5 did (config/mod.rs:3541-3550). Redacting it is listed as owner-signable.Fix: 6c88aa3.