Propagate source evidence sensitivity through history

internal/engine/source_version_test.go

@@ -974,6 +974,74 @@ func TestSourceVersionUnderlaysProtectRemainingMountedPayload(t *testing.T) {
 	}
 }
 
+func TestSourceVersionEvidencePropagatesThroughRecordedResolutionDependency(t *testing.T) {
+	t.Parallel()
+
+	type credentials struct {
+		Password string `yaml:"password"`
+		Public   string `yaml:"public"`
+	}
+	type configuration struct {
+		Credentials credentials `yaml:"credentials"`
+		Derived     string      `yaml:"derived"`
+	}
+	load := func(header string) *Loaded[configuration] {
+		t.Helper()
+		loaded, err := LoadLayered(Input{
+			Source: Bytes("main", []byte("credentials: {password: main-value}\n")),
+		}, testSecretBinding(), LayeredOptions[configuration]{
+			SourceVersionMode: sourceVersionModeIfPresent,
+			Underlays: []Underlay{{Inputs: []Input{{Source: Bytes("underlay", []byte(
+				"credentials:\n  version: "+header+"\n  public: visible-neighbor\n",
+			))}}}},
+			Definition: Definition[configuration]{
+				Version: &VersionRule{
+					Path:  Keys("credentials", "version"),
+					Check: func(Version, *Validation) error { return nil },
+				},
+				Secret: func(path Path) bool {
+					return path.String() == "/credentials/version"
+				},
+				Resolve: func(value *configuration, resolution *Resolution) error {
+					value.Derived = value.Credentials.Password
+					resolution.Record(Keys("derived"), ChangeNormalization, "derive from credentials", Keys("credentials"))
+					return nil
+				},
+			},
+		})
+		if err != nil || loaded == nil {
+			t.Fatalf("LoadLayered with header %q = %#v, %v", header, loaded, err)
+		}
+		return loaded
+	}
+
+	left, right := load("202"), load("303")
+	if left.Config.Derived != "main-value" || right.Config.Derived != "main-value" {
+		t.Fatalf("derived values = %q, %q", left.Config.Derived, right.Config.Derived)
+	}
+	if !left.Inspection.secrets["/derived"] || !right.Inspection.secrets["/derived"] {
+		t.Fatalf("evidence did not activate recorded dependency closure: left=%#v right=%#v", left.Inspection.secrets, right.Inspection.secrets)
+	}
+	derived, found := left.Inspection.Explain(Keys("derived"))
+	if !found || !derived.Effective.Redacted {
+		t.Fatalf("derived explanation was not redacted: %#v, found=%v", derived, found)
+	}
+	public, found := left.Inspection.Explain(Keys("credentials", "public"))
+	if !found || public.Effective.Redacted || public.Effective.YAML != "visible-neighbor\n" {
+		t.Fatalf("neighboring payload = %#v, found=%v", public, found)
+	}
+	headerPath := Keys("credentials", "version")
+	if _, found := left.Inspection.Explain(headerPath); found {
+		t.Fatal("consumed declaration created an effective or historical explanation path")
+	}
+	if _, found := left.Inspection.Metadata().Lookup(headerPath); found {
+		t.Fatal("consumed declaration created a metadata path")
+	}
+	if differences, err := Diff(left.Inspection, right.Inspection); err != nil || len(differences) != 0 {
+		t.Fatalf("different consumed headers changed effective diff: %#v, %v", differences, err)
+	}
+}
+
 func TestSourceVersionSelectedOverlayConsumesHeaderAndRetainsWarning(t *testing.T) {
 	t.Parallel()