Add deterministic diagnostic redaction tests

[ringotokens-commits]

TentOfTrials Diagnostic Bounty PR Draft

Issue: #1

Patch: /Users/aiagent/Documents/Codex/2026-07-08/yo/outputs/tentoftrials_diagnostic_bounty.patch

Diagnostic artifacts:

• /Users/aiagent/Documents/Codex/2026-07-08/yo/outputs/tentoftrials_diagnostic_build-fc78a64d.json
• /Users/aiagent/Documents/Codex/2026-07-08/yo/outputs/tentoftrials_diagnostic_build-fc78a64d.logd

Summary

Adds deterministic regression coverage for diagnostic metadata redaction, repository-relative path reporting, and .logd/JSON artifact pairing. Also fixes macos-x64 encryptly detection so diagnostics can run on Intel macOS when the bundled binary is present.

Changes

• Added diagnostic metadata helpers to normalize repository paths with / separators.
• Redacted local repo, home, temp, username, and machine name values from JSON metadata output.
• Normalized module artifact paths to repository-relative paths where possible.
• Added validate_diagnostic_metadata() to produce clear errors for missing JSON, missing .logd, absolute paths, backslash paths, and mismatched artifact extensions.
• Added focused unittest coverage in tests/test_diagnostics.py.
• Added macos-x64 to the bundled encryptly platform map.

Testing

python3 -m unittest tests.test_diagnostics

Result:

Ran 6 tests in 0.012s
OK

python3 build.py

Result: diagnostics now run and produce a matched JSON/logd pair, but the full build exits 1 in this environment because several language toolchains are not installed and one C module fails to compile locally.

Generated diagnostic pair:

• diagnostic/build-fc78a64d.json
• diagnostic/build-fc78a64d.logd

Diagnostic password printed by the build:

4f9406258c55071a2684

Validation helper result:

diagnostic/build-00000000.json []
diagnostic/build-c2c53e9d.json []
diagnostic/build-fc78a64d.json []

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR
• Full multi-language build passes locally
• Documentation has been updated, if applicable
• Configuration or schema changes are documented, if applicable
• No generated build artifacts are committed, except the required diagnostic build log
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered

Note: full build failure is due to local environment/toolchain availability (cargo, go, cmake, luac, ghc, Java runtime) plus an existing C compile error, not the diagnostic tests.

/claim #1