feat: add stable cursors and effective config rendering

internal/config/effective.go

@@ -0,0 +1,23 @@
+package config
+
+import "encoding/json"
+
+// RenderEffectiveServer returns deterministic, payload-free JSON suitable for
+// the one-time startup configuration log.
+func RenderEffectiveServer(config *Server) ([]byte, error) {
+	return renderEffective(config)
+}
+
+// RenderEffectiveClient returns deterministic, payload-free JSON. TLS file
+// paths are included, but file contents are never read or rendered.
+func RenderEffectiveClient(config *Client) ([]byte, error) {
+	return renderEffective(config)
+}
+
+func renderEffective(value any) ([]byte, error) {
+	encoded, err := json.MarshalIndent(value, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	return append(encoded, '\n'), nil
+}

internal/config/effective_test.go

@@ -0,0 +1,44 @@
+package config
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+)
+
+func TestEffectiveConfigurationGolden_HP_CFG_09(t *testing.T) {
+	t.Parallel()
+
+	server, err := DecodeServer(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	first, err := RenderEffectiveServer(server)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, _ := RenderEffectiveServer(server)
+	if !bytes.Equal(first, second) {
+		t.Fatal("effective server configuration is nondeterministic")
+	}
+	digest := sha256.Sum256(first)
+	const goldenSHA256 = "55c5fec2c10bc27372353a60f317c5a2959f8087685cf7c11202bb12dc59aa28"
+	if got := hex.EncodeToString(digest[:]); got != goldenSHA256 {
+		t.Fatalf("effective server configuration golden changed: got %s", got)
+	}
+
+	client, err := DecodeClient(nil, ClientOptions{Platform: PlatformUnix})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rendered, err := RenderEffectiveClient(client)
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest = sha256.Sum256(rendered)
+	const clientGoldenSHA256 = "4c54c212f18f65cad0a2ea65ecbf1d1a6a0f45da5192857ff61f0cdf85ebb68b"
+	if got := hex.EncodeToString(digest[:]); got != clientGoldenSHA256 {
+		t.Fatalf("effective client configuration golden changed: got %s", got)
+	}
+}