Port privacy-filter-canary into trace-commons-operator-client

[zmanian]

Context

Stacks on #126. Removes the last stub from the operator-binaries migration: trace-commons-tenant privacy-filter-canary now runs the real local sidecar canary, with the adapter ported into trace-commons-operator-client.

What lands

trace-commons-operator-client::privacy_filter (new module, 625 LOC)

Ported from Ironclaw's ironclaw_reborn_traces::contribution:

• pub trait PrivacyFilterAdapter + NoopPrivacyFilterAdapter (tests) + CommandPrivacyFilterAdapter (subprocess runner with input/stdout/stderr size limits, timeout, cleared env except PATH/LANG/LC_ALL).
• SafePrivacyFilterRedaction, SafePrivacyFilterSummary, PrivacyFilterSidecarRequest — wire shapes byte-identical to Ironclaw's so existing sidecar binaries plug in unchanged.
• safe_privacy_filter_redaction_from_output parser.
• adapter_from_env() -> Option<Arc<dyn PrivacyFilterAdapter>>.
• canary_leaked_tokens(original, redacted) -> Vec<String> — hash-only output (never raw tokens), matches Ironclaw's hash-only logging discipline.

Env-var precedence (with backwards compat)

Canonical	Legacy fallback
TRACE_COMMONS_PRIVACY_FILTER_COMMAND	IRONCLAW_TRACE_PRIVACY_FILTER_COMMAND
TRACE_COMMONS_PRIVACY_FILTER_ARGS	IRONCLAW_TRACE_PRIVACY_FILTER_ARGS
TRACE_COMMONS_PRIVACY_FILTER_TIMEOUT_MS	IRONCLAW_TRACE_PRIVACY_FILTER_TIMEOUT_MS
TRACE_COMMONS_PRIVACY_FILTER_MAX_INPUT_BYTES	IRONCLAW_TRACE_PRIVACY_FILTER_MAX_INPUT_BYTES
TRACE_COMMONS_PRIVACY_FILTER_MAX_STDOUT_BYTES	IRONCLAW_TRACE_PRIVACY_FILTER_MAX_STDOUT_BYTES
TRACE_COMMONS_PRIVACY_FILTER_MAX_STDERR_BYTES	IRONCLAW_TRACE_PRIVACY_FILTER_MAX_STDERR_BYTES

TRACE_COMMONS_* wins when both are set. Verified by tests adapter_from_env_prefers_canonical_over_legacy and adapter_from_env_falls_back_to_legacy.

trace-commons-tenant privacy-filter-canary handler

Stub replaced with the real implementation: build adapter from env, run redact_text with --timeout-seconds, compute leaked tokens, render JSON envelope (via format::emit_json with method: \"LOCAL\") or human-readable summary. Bails with non-zero exit code if any canary token leaks through.

Runbook

docs/operator/operator-binaries.md updated: removed the "currently stubbed" note, documented the env-var matrix with canonical + legacy names, added a worked example for invoking the canary against a Python sidecar.

Tests

trace-commons-operator-client::privacy_filter: 30 → 39 (+9 new) — parser ok-case, parser missing-redacted-text, canary leak detector, NoopAdapter, adapter_from_env unset / canonical / legacy / overrides, end-to-end command-adapter round-trip via /bin/sh, canonical hash format.

trace-commons-tenant: 26 → 27 (+1 — privacy_filter_canary_errors_when_unconfigured).

Verification

RUSTFLAGS=\"-D warnings\" cargo check --workspace --all-targets   # clean
RUSTFLAGS=\"-D warnings\" cargo test --workspace --no-run         # clean
cargo test -p trace-commons-operator-client                       # 39 passed
cargo test -p trace-commons-server --bins                         # all green
cargo clippy --workspace --all-targets -- -D warnings              # clean

Deviations from Ironclaw reference

1. Returns anyhow::Result rather than Ironclaw's TraceContributionError. The operator-client has no need to depend on the trace-contribution error taxonomy. Wire shapes unchanged.
2. canary_leaked_tokens is whitespace-token comparison (≥4 chars) returning sha256:<hex> hashes only. Matches Ironclaw's hash-only logging discipline and the operator-CLI's user-supplied-text shape.
3. Human-readable + JSON rendering synthesized to match operator-binary conventions (format::emit_json envelope with method: \"LOCAL\" since this isn't an HTTP request).

Net diff

6 files, +837 / -54.

Out of scope

• Removing the legacy IRONCLAW_TRACE_PRIVACY_FILTER_* env-var compat reads — defer until operators are migrated. The tracing::warn! on legacy-fallback usage will signal when adoption is complete.

🤖 Generated with Claude Code