REQ 059

REQ-059: Protect and redact bootstrap evidence

Requirement

Windows bootstrap evidence handling shall keep raw serial data, guest logs, credentials, and VM media out of published artifacts.

Rationale

Diagnostic evidence and secrets require protected custody even when bootstrap fails before WinRM works.

Fit Criterion

Raw data stays in a verified mode-0700 directory with mode-0600 files on Linux; public artifacts contain only schema-validated redacted receipts and hashes. Credentials, activation values, recovery material, raw logs, disk images, and saved states are never emitted in logs, serial status, or artifacts.

Verification

Planned, TEST-059; applies to this Linux-host-first contract.

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-059

TestArtifact

Planned permission, redaction, and forbidden-field tests

CodeRef

Windows host evidence and receipt handling

Status

Planned