P3.9: Redaction extension — OAuth state, nonce, code_verifier, code_challenge

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3

Goal

Extend the redaction boundary to treat OAuth state, nonce, code_verifier, and code_challenge values as high-entropy and redact them from evidence excerpts even though they are not strictly secret.

Why

These values can leak session-linking signals between user-agent, authorization server, and the client application. Reports must not echo them back.

Acceptance criteria

• crates/sessionscope-core/src/redaction.rs recognises identifier-name patterns state, nonce, code_verifier, code_challenge, codeVerifier, codeChallenge and redacts high-entropy literal values assigned to those names or appearing in URLs alongside those parameter names.
• A dedicated redaction snapshot test confirms no literal high-entropy value reaches rendered Markdown or JSON reports for a fixture containing fake-but-high-entropy values.
• Existing fixtures' redaction-snapshot outputs remain unchanged.

Files touched

• crates/sessionscope-core/src/redaction.rs
• A new redaction-regression test under tests/integration/ (or near-by depending on existing pattern).

Audit-then-decide

• No new finding category.

Doc-update checklist

• docs/DATA_HANDLING.md updated to list the new redaction patterns.
• CHANGELOG.md unreleased entry.

[bjcorder]

Implemented in 311128d.

Summary:

• Extended sessionscope-core::redaction to redact OAuth/OIDC state, nonce, code_verifier, code_challenge, codeVerifier, and codeChallenge assignment/object values.
• Extended URL redaction to cover OAuth parameter values, including fragment parameters.
• Added focused core redaction coverage plus JSON/Markdown reporter coverage proving fake high-entropy OAuth values do not render.
• Updated docs/DATA_HANDLING.md and CHANGELOG.md for the new redaction patterns.

Validation:

• cargo test -q -p sessionscope-core redacts_oauth — passed
• cargo test -q -p sessionscope-reporters render_sanitizes_oauth_values_in_json_and_markdown — passed

Notes / follow-ups:

• Existing broader fixture validation will run with the final milestone suite.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• 311128d — P3.9 OAuth state nonce and PKCE redaction

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None.