TeaQL Rust 5.0.3

5.0.3: default log privacy

Tracking: #219
Cross-runtime contract: teaql/teaql-conformance#58

Behavior and migration

Runtime-controlled SQL and audit logging now redact sensitive payloads before
normal, custom, buffered and file destinations. Execution values are unchanged.
Selecting a diagnostic sink alone no longer authorizes plaintext output.

For intentional plaintext debugging only, set this exact acknowledgement:

export TEAQL_ALLOW_SENSITIVE_PLAINTEXT_LOGS=I_UNDERSTAND_SENSITIVE_DATA_MAY_BE_WRITTEN_TO_DISK

Invalid, empty or truthy shortcut values do not enable it. Enabling it emits a
value-free warning. Credential-classified fields remain hidden. The switch grants
permission; it does not force every sink to reveal values. Restart after changing
the environment. Previously written files are not erased.

Without reliable parameter/field provenance, SQL logs use conservative redaction;
SQL may be labeled non-replayable. Operations, timing and safe intent remain.
Do not put unrelated secrets in comments/purpose, or print raw business events.
Arbitrary application and third-party driver logs are outside this boundary.

Verification

Local runtime tests and bash scripts/verify-examples.sh passed before release
preparation. Retained real SQLite CRUD/failure canaries assert unchanged persisted
values and absence of sensitive markers in runtime log destinations. Exact/invalid
environment gates and credential behavior have separate regression fixtures.
Published-package verification is a separate gate, not implied by local results.