control.group ships unredacted in a default bundle, in two entries:
// config.json
"control": { "enabled": true, "group": "vpnadmins" }// doctor.json
"summary": "reachable (…, group \"vpnadmins\") — routine ops need no password."
This is filed as a question rather than a bug because both answers are defensible and the wrong move is to fix one place and not the other.
The case for leaving it
A unix group is a host or organisation attribute, not a VPN provider and not a person. On macOS the default is admin, which names nobody. Redacting it makes the control check's diagnosis worse — "you are not in the profile-1 group" is not an instruction anyone can act on, and the check's whole purpose is to tell you which group to join.
The case for redacting it
A site-chosen group name can carry an organisation (acme-vpn-ops), and an --include-network bundle is the one that already warns about identity. The bundle's README lists what is replaced; a group name is the kind of thing a reader would assume was covered.
What must not happen
Redacting it in doctor's prose but not in config.json, or the reverse. The two entries carry the same value, and a reader comparing them would see one token and one name for the same thing — which is exactly the "one identifier, two tokens" confusion internal/redact/json.go's free comment exists to prevent.
If the answer is "redact it"
It needs a key-aware case, not the literal replay — the same shape ADR-0016 settled for everything else. config.json's control.group already has a key (group); doctor's control check would need to carry it as a field the way doctorDetail now carries iface/profile/endpoint, rather than interpolating it into Summary.
Raised repeatedly during the review loop on #67 and deliberately left out of that PR: a one-sided fix would have been incoherent, and it is a product decision rather than a defect.
control.groupships unredacted in a default bundle, in two entries:This is filed as a question rather than a bug because both answers are defensible and the wrong move is to fix one place and not the other.
The case for leaving it
A unix group is a host or organisation attribute, not a VPN provider and not a person. On macOS the default is
admin, which names nobody. Redacting it makes the control check's diagnosis worse — "you are not in theprofile-1group" is not an instruction anyone can act on, and the check's whole purpose is to tell you which group to join.The case for redacting it
A site-chosen group name can carry an organisation (
acme-vpn-ops), and an--include-networkbundle is the one that already warns about identity. The bundle's README lists what is replaced; a group name is the kind of thing a reader would assume was covered.What must not happen
Redacting it in doctor's prose but not in
config.json, or the reverse. The two entries carry the same value, and a reader comparing them would see one token and one name for the same thing — which is exactly the "one identifier, two tokens" confusioninternal/redact/json.go'sfreecomment exists to prevent.If the answer is "redact it"
It needs a key-aware case, not the literal replay — the same shape ADR-0016 settled for everything else.
config.json'scontrol.groupalready has a key (group); doctor's control check would need to carry it as a field the waydoctorDetailnow carriesiface/profile/endpoint, rather than interpolating it intoSummary.Raised repeatedly during the review loop on #67 and deliberately left out of that PR: a one-sided fix would have been incoherent, and it is a product decision rather than a defect.