[Epic 8] Diagnostics, configuration, security & privacy

[aquitaine]

Epic: Diagnostics, configuration, security & privacy

Make state inspectable and safe: structured logs, redacted bundles, secrets in Keychain, no analytics by default.

Milestone: M2 → M3 · PRD: DIA-001…DIA-012, NFR-007, NFR-008

Scope

• Detailed display inspector + EDID viewer/export (DIA-001/002).
• Structured logs w/ transaction & topology-generation IDs; topology timeline (DIA-003/004).
• Redacted support bundle + export/import profiles; schema-validated imports w/ diff (DIA-005/009).
• Selective reset; provider health + circuit breaker surfacing (DIA-002/007).
• Capability reasons for ≥95% of disabled controls (DIA-006).
• Secrets only in Keychain; static/dynamic scans find no plaintext (DIA-011, NFR-007).
• Privacy defaults: no analytics/capture/network/listener on fresh install (NFR-008); threat model for lifecycle/rescue/update/API.

Acceptance

• Support-bundle redaction test finds no raw serials/tokens/usernames; fresh-install audit shows zero unexpected outbound traffic.