{
  "part": 13,
  "title": "Report provenance line and confirming secrets don't leak into logs",
  "reset": "standard",
  "steps": [
    { "id": "13.1", "title": "Provenance line",
      "_comment": "The provenance line is embedded in the report message sendReport() builds, but only actually persisted (to the report drive or by email) when that role's report.targetDrive/email is configured - true for target (report.targetDrive.mountPoint: {REPORT}) but not source in this baseline config, where sendReport() computes the message and discards it. So the assertion reads the target's report FILE (as Part 3.3 does), not run_sneakernet's console capture, which never contains it for either role.",
      "actions": [
        { "do": "zfs_snapshot", "dataset": "{SRC}/ds1@P13_1" },
        { "do": "run_sneakernet", "servername": "test-source", "verbosity": 1, "log": "part13_1_source", "expect_exit": 0 },
        { "do": "run_sneakernet", "servername": "test-target", "verbosity": 1, "log": "part13_1_target", "expect_exit": 0 },
        { "do": "read_file_matching", "dir": "{REPORT}", "pattern": "_sneakernet_report_\\d+\\.txt$",
          "capture": { "name": "LOG131" } },
        { "do": "svnversion", "dir": "{CODE}", "store_as": "SVNVER_131" }
      ],
      "assertions": [
        { "type": "regex_present", "var": "LOG131", "pattern": "(?m)^Host: .* sneakernet v[0-9.]+ +svn revision:", "message": "the report opens with the provenance line" },
        { "type": "regex_present", "var": "LOG131", "pattern": "svn revision: $SVNVER_131", "message": "the revision shown matches what svnversion reports directly against the working-copy root" }
      ]
    },
    { "id": "13.2", "title": "Confirm the transport key is never written to the log in plaintext", "depends_on": ["13.1"],
      "actions": [
        { "do": "rm_matching", "dir": "{SN}", "pattern": "^sneakernet\\.log$" },
        { "do": "zfs_snapshot", "dataset": "{SRC}/ds1@P13_2" },
        { "do": "empty_dir", "path": "{TRANSPORT}" },
        { "do": "run_sneakernet", "servername": "test-source", "verbosity": 4, "expect_exit": 0 },
        { "do": "read_file", "path": "{SN}/sneakernet.log", "capture": { "name": "SNLOG_132" } }
      ],
      "assertions": [
        { "type": "raw_file_absent", "path": "{SN}/sneakernet.log", "pattern": "$TESTKEY", "message": "the key string does not appear anywhere in the log (checked without redaction, and without echoing the key itself on failure)" },
        { "type": "regex_present", "var": "SNLOG_132", "pattern": "-K \\[REDACTED\\]", "message": "at least one line shows -K [REDACTED] in place of the real key" }
      ]
    },
    { "id": "13.3", "title": "(Optional) target_state.txt reaches the operator by email, not just the report drive", "classification": "optional", "depends_on": ["13.2"],
      "_comment": "Requires a real mail relay reachable from dd-nas1 - per TESTING_automation.md decision, run with --include-optional against a real address, but the harness can only verify the log-side send attempt; checking the inbox for the attachment and provenance line remains a manual step for the operator, exactly as TESTING.md itself notes.",
      "config": { "mutations": [
        { "op": "set", "path": "target.report.email", "value": "rodo@dailydata.net" },
        { "op": "set", "path": "target.report.subject", "value": "TESTING Part 13.3" }
      ], "restore": "none" },
      "actions": [
        { "do": "zfs_destroy", "dataset": "{DST}/ds1", "recursive": 1, "missing_ok": 1 },
        { "do": "rm_matching", "dir": "{SN}", "pattern": "^sneakernet_target\\.status(\\.[0-9_.-]+)?$" },
        { "do": "empty_dir", "path": "{TRANSPORT}" },
        { "do": "empty_dir", "path": "{REPORT}" },
        { "do": "zfs_snapshot", "dataset": "{SRC}/ds1@P13_3" },
        { "do": "run_sneakernet", "servername": "test-source", "verbosity": 2, "expect_exit": 0 },
        { "do": "run_sneakernet", "servername": "test-target", "verbosity": 2, "log": "part13_3", "expect_exit": 0,
          "capture": { "name": "LOG133" } }
      ],
      "assertions": [
        { "type": "regex_present", "var": "LOG133", "pattern": "(?i)Sending report via e-mail", "message": "log confirms an email send attempt (separately check your inbox for the target_state.txt attachment and matching provenance line)" }
      ]
    },
    { "id": "13.3-cleanup", "title": "Restore target.report.email: ''", "depends_on": ["13.3"],
      "config": { "restore": "none", "mutations": [
        { "op": "set", "path": "target.report.email", "value": "", "style": "single" },
        { "op": "set", "path": "target.report.subject", "value": "", "style": "single" }
      ] }
    }
  ]
}