[smart-ssh-coder]

Closes #893

Summary

• Wiring::outgoing_transforms (Community: empty). The old outgoing_transform stays, is documented as superseded, and runs first.
• New CompositeOutgoingTransform in core::outgoing: registration order, chained text, secret union, first rejection stops, redacting Debug, requires_confirmation = any.
• app-shell builds the composite only for 2+ transforms; 0 → None, 1 → passed through. prepare_for_send unchanged.
• Spec 0038 updated.

Acceptance Criteria

• Wiring::outgoing_transforms empty / session None: erfüllt – wiring.rs:test_community_registers_no_outgoing_transforms
• Composite chain / secrets / rejections / Debug: erfüllt – core/outgoing.rs:test_composite_chains_output_and_unions_secrets, test_composite_first_rejection_stops_chain, test_composite_second_rejection_is_returned
• app-logic via prepare_for_send: erfüllt – tests_outgoing.rs:test_chain_secrets_of_both_transforms_are_masked_in_the_command_output, test_chain_whose_final_text_is_blacklisted_is_rejected (asserts the blacklist message PREPARED_BLOCKED_MESSAGE contains "hard blacklist")
• requires_confirmation: erfüllt – test_composite_requires_confirmation_if_any_does
• Old field alone unchanged: erfüllt – existing tests_outgoing.rs tests green
• Old field + list entry order: erfüllt – wiring.rs:test_combined_outgoing_transform_orders_old_field_first
• Spec 0038: erfüllt
• Tests: targeted cargo test (core, app-shell wiring, app-logic tests_outgoing) and clippy -D warnings green locally; full gate via CI.

Tests

New code, no bug fix; no counter-proof needed.

Assumptions

• requires_confirmation is the only trait method besides prepare_outgoing, so no further combination rules were needed.
• No changelog fragment: extension point only, no user-visible effect.

Threat model: no change – the composite only chains existing trusted transforms; all core checks still apply once to the final text.

Spec: updated 0038

Manual test steps

None.

Follow-ups

None.

🤖 Generated with Claude Code

[smart-ssh-reviewer]

Review

Verdict: approved
Review level: elevated

Blocking

None.

Non-blocking

• The lib.rs change (std::mem::take for extra_data_paths, removed blank line) is a small necessary side effect of calling combined_outgoing_transform(&self); harmless.

Verified

• counter-proof: test_composite_chains_output_and_unions_secrets red when the chain passes the original text instead of the previous output, green with the fix (executed: cargo test -p ssh-manager-core composite_chains)
• edge cases: 0 → None, 1 → passed through, 2+ → composite (read: wiring.rs, test executed); rejection mid-chain returns without partial result (executed); empty composite returns the input unchanged → ok
• callers checked: outgoing_transform (session/state plumbing, 5 sites; unchanged type Option<Arc<..>>), prepare_for_send unchanged → ok
• tests run locally: core outgoing (5 passed), app-logic outgoing (34 passed) incl. chain_ (27 filtered run), app-shell --lib outgoing (2 passed) (executed, toolchain stable since pinned 1.99.1 not installed); CI all green (executed: gh pr checks 993)
• files read: 4/4 logic files
• UI: not a UI change
• data: not touched

Timing analysis

• 3 test files analysed: no timing dependency found

Spec

• visible behaviour changed: none for users; extension-point semantics (list, order, secret union, first rejection, any-confirms)
• spec searched (terms: outgoing, Umwandlung, Wiring): 0038 section "Umwandlung ausgehender Texte"
• verdict: spec change present and matches the code

Security checks

• Filter/risk/confirmation untouched; prepare_for_send unchanged so the hard-blacklist re-check, redactor update and rejection redaction run once on the final text (test test_chain_whose_final_text_is_blacklisted_is_rejected, secrets masked in test_chain_secrets_of_both_transforms_are_masked_in_the_command_output).
• Loosening: none; requires_confirmation is fail-closed (any). It is the only trait method besides prepare_outgoing. Debug of composite/Prepared shows no text or secrets.
• Bypass attempts: chain producing blacklisted text only in the final step → rejected; intermediate text containing a blacklisted token that a later step removes is not checked, which matches the "final text" requirement.
• Threat model: no-change note given; composite only chains trusted registered transforms.

Manual checks pending

None.

Follow-ups

None.