Redact AppRole's Debug output

[sehkone]

Context

AppRole (src/bootroot_cmd.rs) holds the credential pair bootroot mints: role_id and secret_id. It derives Debug, so {:?} of an AppRole, or of anything that derives Debug over one, prints both values in clear text.

No deploy-core code formats an AppRole today. The hazard is downstream. bootler holds AppRoles in types that derive Debug. For example, RegistrationSteps (core/src/services.rs) derives Debug and holds service_add: Option<&AppRole>. A future tracing field, expect message or error string over any of them would print the secret id. bootler#617 redacted the records it owns, and it had to print the AppRole as "<redacted>" by hand because this type's own Debug leaks. Fixing the type here fixes every container at once.

deploy-core already redacts in the same way elsewhere: GenerationFile (src/generation.rs) has a hand-written Debug.

This is deploy-core's first release line (0.1.0, 2026-10-02). No compatibility shim is needed.

Scope

In src/bootroot_cmd.rs only:

• Remove Debug from AppRole's derive list. Keep Clone, PartialEq, Eq, Serialize and Deserialize, and every field, its type and its visibility, as they are.
• Add a hand-written impl std::fmt::Debug for AppRole that uses f.debug_struct("AppRole"), lists role_id and then secret_id, prints each as the &str "<redacted>", and ends with .finish(). Give it a one-line comment saying why it is hand-written.
• Add a #[cfg(test)] mod tests to the file with the test in the Test plan.

In CHANGELOG.md, open an ## [Unreleased] section above ## [0.1.0] with a ### Changed entry: an AppRole's Debug output no longer shows its role id or secret id, and both print as <redacted>. Add the matching link reference [Unreleased]: https://github.com/aicers/deploy-core/compare/0.1.0...main above the [0.1.0] reference. A user of 0.1.0 can observe this change, so it gets an entry. The entry carries no issue or PR reference.

Acceptance criteria

• AppRole no longer derives Debug, and its hand-written Debug prints AppRole { role_id: "<redacted>", secret_id: "<redacted>" }.
• The test shows that format!("{approle:?}") and format!("{approle:#?}") contain neither sentinel, and do contain <redacted> and the field names role_id and secret_id.
• The other derives and the serde attributes are unchanged, so serialized bytes and equality are unaffected. Every existing test passes unchanged.
• The CHANGELOG.md entry and link reference are present, and the Markdown job passes.
• CI passes: fmt, Clippy and Clippy with test-support, Docs, Test and Test with test-support, and the Platform jobs.

Constraints

• Hand-written Debug only: no wrapper type, newtype, helper, macro or dependency, and no change to field types or visibility.
• Use exactly the "<redacted>" literal and .finish(), not .finish_non_exhaustive(), so a field added later must be classified explicitly.
• Never format a secret through its own Debug inside the impl.
• Never compare secret values with assert_eq! or assert_ne!, which print both sides through Debug on failure. Use assert!(a == b).
• First version: add no compatibility shim or feature flag.
• Cut no release. Releasing is not this issue's.

Edge cases

• role_id. It is redacted too. It is one half of the AppRole login, and bootler's own redactions (#617's SecretsRecord, BootstrapMaterial) already treat the whole pair as secret.
• Pretty-printing. {:#?} goes through the same debug_struct and redacts the same way. The test covers both.

Test plan

• app_role_debug_redacts_both_ids: build an AppRole with a distinct sentinel in role_id and in secret_id. Assert that format!("{approle:?}") and format!("{approle:#?}") contain neither sentinel, and contain <redacted>, role_id and secret_id.
• cargo fmt --check, cargo clippy --all-targets -- -D warnings with and without --features test-support, cargo doc as the Docs job runs it, and cargo test with and without --features test-support.

Dependencies

• None blocking.
• bootler's issue "Redact Debug for bootroot's init capture" (aicers/bootler#NNN, filled in at filing) re-pins deploy-core to this issue's merge commit, so this merges first.

Out of scope

• service_add_args passing the secret id on bootroot service add's argv. Its rustdoc already records that as an accepted trade-off.
• Any other deploy-core type's Debug.
• Zeroizing memory, or a secret wrapper type.

Pointers

• src/bootroot_cmd.rs (AppRole); src/registration.rs (ServiceAddSpec::approle, service_add_args).
• src/generation.rs (GenerationFile's hand-written Debug, the in-crate precedent).
• bootler: core/src/secrets.rs (SecretsRecord's Debug, which prints the AppRole as "<redacted>"); core/src/services.rs (RegistrationSteps).

[CoestPiper]

Verification summary

• Delivery: COMPLETE — the merged code delivers what the issue asked for. (the auditor's own verdict)
• Extra changes: NO_EXTRA_CHANGES — the merged code changed nothing beyond what the issue asked for. (the auditor's own verdict)
• Defects: NO_DEFECT — the merged pull requests left no defect of their own behind. (the auditor's own verdict)

Delivery decides whether this issue is closed or reopened. Defects widens what the follow-up filing considers. Extra changes gates nothing — it is an observation for a human; the report names what went beyond the issue.

Implementing pull requests, at the merge commits this audit read:

• Redact AppRole's Debug output (#145) #146 — bb3f9593bf063d372bc9eac29a7142c061743eea (the tree the audit read)

The full report — the assessment included verbatim — stays local, at:
~/.agentcoop/runs/aicers/deploy-core/verify/MTQ1/report.md

Findings this run did not file:

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
AppRole no longer derives Debug and retains Clone, PartialEq, Eq, Serialize, and Deserialize.
Explanation (the auditor's whole response):

`AppRole` no longer derives `Debug`, while retaining `Clone`, `PartialEq`, `Eq`, `Serialize`, and `Deserialize`. The merged declaration at `src/bootroot_cmd.rs:86` contains exactly those five derives. The evidence diff shows that only `Debug` was removed, and the supplied removal checker confirmed that the former derive declaration is absent from that file.

This fulfills the Scope instruction to remove `Debug` and keep the other derives unchanged. It is a confirmed delivery finding, with no violated requirement or introduced defect to correct, so it does not warrant a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue's explicit requirement is to remove Debug while retaining the other five derives; src/bootroot_cmd.rs:86 satisfies it.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves this finding uncertain. It is confirmed compliance, not a potential shortfall; my AMBIGUOUS classification was inaccurate, and none of the offered reasons describes it.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
AppRole's fields, types, visibility, and serde attributes are unchanged, preserving serialization and equality behavior.
Explanation (the auditor's whole response):

`AppRole`’s fields, types, visibility, and serde attributes are unchanged. The merged type retains `pub role_id: String` at `src/bootroot_cmd.rs:89` and `pub secret_id: String` at `src/bootroot_cmd.rs:91`, with `PartialEq`, `Eq`, `Serialize`, and `Deserialize` still derived at `src/bootroot_cmd.rs:86`. Comparison with the evidence diff confirms that none of these declarations or attributes changed.

This satisfies the issue’s explicit requirement to preserve serialization and equality behavior while changing `Debug`. It is confirmed compliance, with no shortfall or introduced defect requiring a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue explicitly requires unchanged fields, types, visibility, and serde attributes; the merged declarations and evidence diff confirm that requirement is satisfied.
Interpretation (the auditor's accepted statement):
There is no competing interpretation or unsettled compliance question. This is a positive audit finding, not a potential shortfall, so the offered non-filing classifications do not accurately describe it.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
AppRole has a hand-written Debug implementation with a one-line explanation of why it prevents credential leaks.
Explanation (the auditor's whole response):

`AppRole` has the requested hand-written `Debug` implementation, beginning at `src/bootroot_cmd.rs:95`. The one-line comment at `src/bootroot_cmd.rs:94` explains that it prevents either id from leaking through `Debug` formatting of the type or anything holding it.

This directly satisfies the Scope requirement to add the implementation and explain why it is hand-written. It is confirmed delivery, with no missing requirement, misleading statement, or introduced defect to address in a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue requires a hand-written Debug implementation with a one-line explanation; src/bootroot_cmd.rs:94 and src/bootroot_cmd.rs:95 confirm both are present.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. This is confirmed delivery rather than a potential shortfall, so AMBIGUOUS does not accurately describe it.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
The formatter uses debug_struct("AppRole"), lists role_id before secret_id, prints both as "<redacted>", and ends with finish().
Explanation (the auditor's whole response):

The formatter follows the exact structure required by #145. At `src/bootroot_cmd.rs:97`, it calls `f.debug_struct("AppRole")`; lines 98 and 99 list `role_id` followed by `secret_id`, each using `&"<redacted>"`; line 100 ends with `.finish()`.

These declarations satisfy the issue’s Scope and Constraints, including redacting both ids and using `.finish()` rather than `.finish_non_exhaustive()`. This is confirmed compliance, with no missing behavior or introduced defect requiring a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue explicitly prescribes debug_struct("AppRole"), role_id followed by secret_id, the "<redacted>" literal for both, and finish(); src/bootroot_cmd.rs:97 through line 100 implement exactly that.
Interpretation (the auditor's accepted statement):
There are no competing interpretations or unsettled certainty conditions for this positive finding. No violation exists, and my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
The formatter never accesses or formats either credential value through its own Debug.
Explanation (the auditor's whole response):

The hand-written formatter never accesses or formats either credential value through its own `Debug`. The implementation begins at `src/bootroot_cmd.rs:95`; its field calls at `src/bootroot_cmd.rs:98` and `src/bootroot_cmd.rs:99` receive only `&"<redacted>"`, with no use of `self.role_id` or `self.secret_id`.

This satisfies the explicit constraint “Never format a secret through its own `Debug` inside the impl.” It is confirmed compliance, so there is no violation or introduced defect to file as a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue prohibits formatting either credential through its own Debug; the merged formatter passes only the redaction literal to both field calls and satisfies that constraint.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. This is confirmed compliance rather than a potential shortfall, so my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
A cfg(test) module contains the required app_role_debug_redacts_both_ids regression test.
Explanation (the auditor's whole response):

The requested test-only module and named regression test are present. `#[cfg(test)] mod tests` begins at `src/bootroot_cmd.rs:104`, and `app_role_debug_redacts_both_ids` begins at `src/bootroot_cmd.rs:109`.

This satisfies the Scope instruction to add a test module with the test specified in the Test plan. It is confirmed delivery, with no missing requirement or introduced defect to address in a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue explicitly requires a cfg(test) module containing app_role_debug_redacts_both_ids; src/bootroot_cmd.rs:104 and src/bootroot_cmd.rs:109 confirm both are present.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. This is confirmed delivery rather than a potential shortfall, so my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
The regression test uses distinct credential sentinels and checks that ordinary and pretty formatting omit both sentinels while retaining the redaction marker and field names.
Explanation (the auditor's whole response):

`app_role_debug_redacts_both_ids` in `src/bootroot_cmd.rs:109` covers the requested credential sentinels and formatting modes. Distinct sentinels are declared beginning at line 110. Line 117 formats the `AppRole` with both `:?` and `:#?`; assertions beginning at line 118 reject both sentinels, and lines 126–128 require `<redacted>`, `role_id`, and `secret_id`. The adjusted merge-commit evidence confirms the test suites passed.

This satisfies the Test plan and the pretty-printing acceptance criterion. It is confirmed delivery, with no missing coverage or introduced defect requiring a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue requires distinct sentinels and assertions covering ordinary and pretty formatting; app_role_debug_redacts_both_ids contains those assertions, and the adjusted CI evidence confirms passing tests.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. This is confirmed delivery rather than a potential shortfall, so my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
The regression test additionally checks the exact required ordinary Debug output.
Explanation (the auditor's whole response):

The regression test `app_role_debug_redacts_both_ids` additionally checks the exact ordinary `Debug` output. The assertion at `src/bootroot_cmd.rs:130` compares `format!("{approle:?}")` with `AppRole { role_id: "<redacted>", secret_id: "<redacted>" }`. The adjusted merge-commit CI evidence confirms the test suites passed.

That expected string matches the issue’s first acceptance criterion. The assertion verifies requested behavior and introduces no defect or unrelated change, so there is no corrective work to file.

Interpretation (the auditor's accepted statement):
The issue requires the exact ordinary Debug output; the assertion at src/bootroot_cmd.rs:130 checks that output, and the adjusted CI evidence confirms passing tests.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. This is a positive verification finding, not a potential shortfall, so my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
The test uses no assert_eq! or assert_ne! comparison of secret values; its equality assertion compares redacted formatted output.
Explanation (the auditor's whole response):

The regression test does not compare secret values using `assert_eq!` or `assert_ne!`. Assertions beginning at `src/bootroot_cmd.rs:118` use `assert!` to check that formatted output contains neither sentinel. The `assert_eq!` at `src/bootroot_cmd.rs:130` compares formatted output with an expected string containing only redaction markers; neither operand is a credential value.

This satisfies the constraint against printing secret values through equality assertions. The presence of `assert_eq!` alone is not a violation: its operands are formatted strings. No defect or missing requirement warrants a follow-up issue.

Interpretation (the auditor's accepted statement):
The constraint prohibits comparing secret values with assert_eq! or assert_ne!; the test instead uses assert! for sentinel checks and compares formatted output with a redacted expected string.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. The presence of assert_eq! does not violate the constraint because its operands are not credential values; my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
The change introduces no wrapper, newtype, helper, macro-based formatter, dependency, compatibility shim, or feature flag.
Explanation (the auditor's whole response):

The change introduces no wrapper, newtype, helper, macro-based formatter, dependency, compatibility shim, or feature flag. Inspection of the complete evidence diff shows a direct `Debug` implementation at `src/bootroot_cmd.rs:95`, the required test module at line 104, and the changelog additions. Dependencies and features at `Cargo.toml:7` and `Cargo.toml:41` are unchanged.

This satisfies the issue’s explicit implementation constraints. The search covered the complete diff, so no added mechanism was overlooked in an unexamined changed path. This is confirmed compliance, with no prohibited addition or corrective work to file.

Interpretation (the auditor's accepted statement):
The issue explicitly prohibits the listed mechanisms and additions; inspection of the complete evidence diff confirms that none was introduced.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. This is confirmed compliance with prohibitions, not a missing-mechanism finding or potential shortfall, so my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
CHANGELOG.md contains the requested Unreleased Changed entry describing redaction of both ids, without issue or PR references.
Explanation (the auditor's whole response):

`CHANGELOG.md` contains the requested release-note entry. `[Unreleased]` at `CHANGELOG.md:7` precedes `[0.1.0]` at line 14, with `### Changed` at line 9. The entry beginning at line 11 says that `AppRole`’s `Debug` output no longer shows its role id or secret id and that both print as `<redacted>`. It contains no issue or PR reference.

This matches the explicit Scope requirement and accurately describes the merged formatter. The finding records fulfilled work, with no missing entry, misleading statement, or prohibited reference to correct, so no follow-up issue is warranted.

Interpretation (the auditor's accepted statement):
The issue explicitly requires an Unreleased Changed entry describing redaction of both ids without tracker references; CHANGELOG.md contains that entry in the requested location.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. This is confirmed delivery of the changelog requirement, not a potential shortfall, so my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
CHANGELOG.md contains the exact Unreleased comparison link above the 0.1.0 release reference.
Explanation (the auditor's whole response):

`CHANGELOG.md:55` contains the exact requested link reference: `[Unreleased]: https://github.com/aicers/deploy-core/compare/0.1.0...main`. It appears immediately above the `[0.1.0]` release reference at `CHANGELOG.md:56`.

This fulfills the Scope requirement for both the link target and its placement. The finding records confirmed compliance; there is no missing or incorrect link requiring a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue requires the exact Unreleased comparison link above the 0.1.0 reference; CHANGELOG.md:55 and CHANGELOG.md:56 confirm the link and placement.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. This is confirmed delivery, not a potential shortfall, so my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
Existing tests are unchanged, and the adjusted merge-commit evidence confirms that tests pass with and without test-support.
Explanation (the auditor's whole response):

Existing tests were left unchanged, and tests passed with and without `test-support`. The complete evidence diff adds `app_role_debug_redacts_both_ids` in the new module at `src/bootroot_cmd.rs:104` without modifying existing tests. The two suite commands are at `.github/workflows/ci.yml:125` and `.github/workflows/ci.yml:129`; the adjusted evidence reports the merge-commit `test` job completed successfully.

This satisfies the acceptance criterion that every existing test passes unchanged. The initial pending result was an evidence gap, subsequently resolved by the CI reread. There is no remaining test failure or missing delivery to file.

Interpretation (the auditor's accepted statement):
The issue requires existing tests to pass unchanged; the complete diff confirms they were unchanged, and the adjusted merge-commit evidence confirms both test configurations passed.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. The earlier evidence gap was resolved, so this is verified delivery rather than a potential shortfall; my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
The adjusted merge-commit evidence confirms successful Markdown, formatting, both Clippy configurations, Docs, both Platform jobs, and overall CI.
Explanation (the auditor's whole response):

The adjusted merge-commit evidence confirms successful Markdown, formatting, both Clippy configurations, Docs, both Platform jobs, and overall CI for `bb3f9593bf063d372bc9eac29a7142c061743eea`. Their configured commands are at `.github/workflows/ci.yml:23`, line 93, line 99, line 101, line 114, line 142, and line 144. The reread reports every corresponding check completed with conclusion `success`.

This fulfills the issue’s CI acceptance criterion. The earlier pending Platform and overall CI results were resolved by the supplied evidence; they were never demonstrated failures in the merged code. No remaining validation failure warrants a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue requires successful CI checks; the complete adjusted merge-commit evidence reports success for every required check.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves compliance unsettled. This is verified CI success, not a potential shortfall, so my AMBIGUOUS classification was inaccurate.

Finding not filed — The supplied evidence could not verify this finding.
Finding (the auditor's accepted statement):
The initial uncertainty about pending tests, Platform jobs, and overall CI was an evidence gap that the successful merge-commit CI reread resolved.
Explanation (the auditor's whole response):

The initial evidence left tests, both Platform jobs, and overall CI unverified because their merge-commit checks were still pending. The relevant commands were present at `.github/workflows/ci.yml:125`, line 129, line 142, and line 144; the uncertainty concerned their results, not missing implementation or demonstrated failure.

The subsequent complete CI reread reported those checks and overall CI completed successfully for `bb3f9593bf063d372bc9eac29a7142c061743eea`. That resolved the evidence gap. It does not warrant a follow-up issue because no CI failure was established and no uncertainty remains.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
Both changed paths serve issue #145, with no unrelated changes, release-cutting changes, or changes to explicitly excluded behavior.
Explanation (the auditor's whole response):

Both changed paths serve #145. The complete evidence diff changes only `src/bootroot_cmd.rs` and `CHANGELOG.md`: the derive change at `src/bootroot_cmd.rs:86`, formatter at line 95, and test module at line 104 implement the requested redaction; the section at `CHANGELOG.md:7`, entry at line 11, and link at line 55 provide the requested release notes.

Inspection of the complete diff found no unrelated change, release-cutting change, or change to explicitly excluded behavior. `Cargo.toml:3` remains `0.1.0`, and the entry remains under `[Unreleased]`. This confirms compliance with the scope and constraints, so there is no excess change or prohibited work to address through a follow-up issue.

Interpretation (the auditor's accepted statement):
The issue authorizes the AppRole formatter, its regression test, and the changelog additions; every change in the complete evidence diff serves those requirements and respects the exclusions.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves scope compliance unsettled. This is a positive audit finding, not a potential excess change or shortfall, so my AMBIGUOUS classification was inaccurate.

Finding not filed — This finding did not meet the certainty bar for filing.
Finding (the auditor's accepted statement):
The audit found complete delivery, no extra changes, and no defect introduced by the target's pull request.
Explanation (the auditor's whole response):

The audit concluded that #145 was delivered completely, with no extra changes or identified defect introduced by PR #146. This rests on the preserved derives and fields at `src/bootroot_cmd.rs:86`, the prescribed redacting formatter at line 95, `app_role_debug_redacts_both_ids` at line 109, the changelog entry at `CHANGELOG.md:11`, and the comparison link at line 55. Inspection of the complete diff accounted for both changed paths. The adjusted merge-commit evidence confirmed all required CI checks succeeded.

This is the overall conclusion of the requirement-by-requirement audit, not an additional suspected fault. Nothing was filed because no contracted requirement was missing, no change exceeded the issue’s scope, and no citable correctness error or misleading statement was identified in the target’s work. No finding was attributed to another issue.

Interpretation (the auditor's accepted statement):
The requirement-by-requirement audit and successful adjusted CI evidence support complete delivery, no extra changes, and no identified defect introduced by PR #146.
Interpretation (the auditor's accepted statement):
No competing interpretation leaves that conclusion unsettled. This is a positive audit conclusion rather than a suspected fault, so my AMBIGUOUS classification was inaccurate.