Add configuration validation and resolution contracts

internal/core/config/redaction_test.go

@@ -117,6 +117,63 @@ func TestRedactedEffectiveConfigPayloadDoesNotAliasSource(t *testing.T) {
 	assertRedactionTestBindingUnchanged(t, effective.ResolvedPipeline.Input, "effective")
 }
 
+func TestRedactedSummaryPayloadsCoverEveryEffectiveConfigBinding(t *testing.T) {
+	bindings := map[string]pipeline.ModuleBinding{}
+	for _, name := range []string{"input", "chunk", "output", "extract", "merge", "normalize", "lane-validator"} {
+		bindings[name] = redactionTestBinding("summary-" + name)
+	}
+	effective := EffectiveConfig{
+		Config: Config{Pipelines: map[string]pipeline.PipelineProfile{
+			"redaction-test": {
+				Input:  bindings["input"],
+				Chunk:  bindings["chunk"],
+				Output: bindings["output"],
+				Artifacts: map[string]pipeline.ArtifactLaneProfile{
+					"safe-lane": {
+						Extract:    bindings["extract"],
+						Merge:      bindings["merge"],
+						Normalize:  bindings["normalize"],
+						Validators: []pipeline.ModuleBinding{bindings["lane-validator"]},
+					},
+				},
+			},
+		}},
+		ResolvedPipeline: pipeline.ResolvedPipeline{
+			Input:  bindings["input"],
+			Chunk:  bindings["chunk"],
+			Output: bindings["output"],
+			ArtifactLanes: []pipeline.ResolvedArtifactLane{{
+				ID:         "safe-lane",
+				Extract:    bindings["extract"],
+				Merge:      bindings["merge"],
+				Normalize:  bindings["normalize"],
+				Validators: []pipeline.ModuleBinding{bindings["lane-validator"]},
+			}},
+		},
+	}
+
+	payload, ok := effective.RedactedSummaryPayload().(EffectiveConfig)
+	if !ok {
+		t.Fatal("RedactedSummaryPayload() returned an unexpected type")
+	}
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	text := string(encoded)
+	for name := range bindings {
+		if strings.Contains(text, "summary-"+name+"-secret") || strings.Contains(text, "summary-"+name+"-nested-secret") {
+			t.Fatalf("summary payload contains sensitive option for %q: %s", name, text)
+		}
+		if !strings.Contains(text, "summary-"+name+"-safe") {
+			t.Fatalf("summary payload omitted safe option for %q: %s", name, text)
+		}
+	}
+	if !strings.Contains(text, "[REDACTED]") {
+		t.Fatalf("summary payload contains no redaction marker: %s", text)
+	}
+}
+
 func TestRedactedResolvedPipelinePayloadHandlesTypedOptionContainers(t *testing.T) {
 	type optionMap map[string]string
 	type optionList []optionMap