security(homecore-migrate): redact secret value from malformed secrets.yaml error

[ruvnet]

homecore-migrate security review (ADR-165) — completes the HOMECORE / HA stack sweep

Final crate in the Home-Assistant compatibility stack review (core · api · automation · recorder · assist · migrate).

One real finding — secret-leak (Grade A)

A malformed secrets.yaml whose offending scalar fails a typed-tag coercion (e.g. port: !!int <value>) produced a serde_yaml error that embeds the scalar verbatim — invalid value: string "<the-secret-value>". Wrapped into MigrateError::YamlParse, it propagated out of read_secrets, was ?-returned by the InspectSecrets CLI path, and printed to stderr by anyhow — leaking a secret value despite the CLI's deliberate <redacted> design (which only ever prints keys).

Fix: secrets.yaml parse failures map to a dedicated redacting variant MigrateError::SecretsParse { path, line, column } — file path + coarse serde_yaml::Error::location() only, never the scalar. Other (non-secret) YAML keeps YamlParse.

Pinned by secrets::tests::malformed_secrets_error_never_contains_secret_value — asserts the rendered error and its full #[source] chain never contain the value and that it is still the structured SecretsParse (fail-closed). Observed leak on old code: ... invalid value: string "s3cr3t_TOKEN_VALUE" ...; passes on the fix. Plus malformed_secrets_error_reports_location (still locatable).

Dimensions confirmed clean (with evidence)

• Secret leakage elsewhere — only secret sink is the value map; main.rs prints keys as <key> = <redacted>; MissingField/Io paths surface the path, never content.
• Source mutation / data-loss — structurally impossible: no fs::write/fs::remove/fs::create/File::create/OpenOptions anywhere in the crate; P1 reads source and writes nothing. Re-runs idempotent; HA source never touched.
• Path traversal — fixed filenames joined onto a user dir; no user-controlled path component, no ../absolute escape.
• Panic-on-input — duplicate-key, bad-indent, control-char, multi-doc, non-mapping-root, unterminated-flow, !input blueprint tags, deep nesting, anchors: every malformed input errors, never panics. All unwrap/expect are #[cfg(test)].
• Fail-closed versioning — unknown storage minor_version hard-errors.
• Injection — no SQL/shell/path interpolation; diagnostics only, persists nothing in P1.

Validation

• cargo test -p homecore-migrate --no-default-features → 21 passed, 0 failed (+2 pins, 19→21)
• cargo test --workspace --no-default-features → GREEN (exit 0, no failures)
• python archive/v1/data/proof/verify.py → VERDICT: PASS, hash f8e76f21…46f7a unchanged (off the signal proof path)

🤖 Generated with claude-flow