glm-5.3-flash
a5fb03e7c6
The fuzz campaign (w5-fuzz-harness) found russh's ssh-key PPK parse path interpolating the raw header line — the caller's plaintext bytes — into its Display; passing that message through KeySourceError::Decode's payload could echo decrypted-record material into a stored/logged error string (ADR-005 decision 7's textual leak). decode_key_arm (the production decrypt-and-decode decode arm, exposed #[doc(hidden)] for the sidecar) now maps every decode failure to a crate-owned fixed message naming the refusal — the machinery's text never rides the typed payload. The upstream no-echo ask is recorded for russh/ssh-key. Verification: scripts/matrix.sh green; the fuzz sidecar's key_decode campaign re-ran clean (606 s, fork mode, zero crashes).