Make log payloads opaque pass-through

platform/validator/log_ingest.go

@@ -72,7 +72,7 @@ func ValidateLogBatchIngest(batch domain.LogBatchIngest) error {
 		computed, err := LogEntriesChecksum(batch.Entries)
 		if err != nil {
 			violations = append(violations, "checksum cannot be computed")
-		} else if batch.Checksum != computed && !logLineChecksumMatches(batch) {
+		} else if batch.Checksum != computed {
 			violations = append(violations, "checksum does not match entries")
 		}
 	}
@@ -119,18 +119,6 @@ func LogEntriesChecksum(entries []domain.LogEntry) (string, error) {
 	return "sha256:" + hex.EncodeToString(sum[:]), nil
 }
 
-func logLineChecksumMatches(batch domain.LogBatchIngest) bool {
-	if len(batch.Entries) != 1 {
-		return false
-	}
-	return batch.Checksum == LogLineChecksum(batch.Entries[0].Line)
-}
-
-func LogLineChecksum(value string) string {
-	sum := sha256.Sum256([]byte(value))
-	return "sha256:" + hex.EncodeToString(sum[:])
-}
-
 type logEntryChecksumBody struct {
 	Seq       uint64            `json:"seq"`
 	Timestamp string            `json:"timestamp"`

platform/validator/log_ingest_test.go

@@ -1,6 +1,8 @@
 package validator
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"strings"
 	"testing"
 	"time"
@@ -22,3 +24,16 @@ func TestValidateLogBatchIngestAcceptsVerbatimBlankAndLongLines(t *testing.T) {
 		t.Fatalf("verbatim log batch was rejected: %v", err)
 	}
 }
+
+func TestValidateLogBatchIngestRejectsLineOnlyChecksumCompatibility(t *testing.T) {
+	entry := domain.LogEntry{Seq: 1, Timestamp: time.Date(2026, 9, 1, 0, 0, 0, 0, time.UTC), Line: "password=opaque /Users/operator/game.log"}
+	batch := domain.LogBatchIngest{RunEndpointID: "run-1", SessionToken: "session-1", LogStreamID: "run.run-1.server-1.stdout", ServerInstanceID: "server-1", StreamKey: "stdout", Source: domain.LogStreamSourceProcess, FirstSeq: 1, LastSeq: 1, Compression: "none", Checksum: lineOnlyChecksum(entry.Line), Entries: []domain.LogEntry{entry}}
+	if err := ValidateLogBatchIngest(batch); err == nil || !strings.Contains(err.Error(), "checksum") {
+		t.Fatalf("expected full-entry checksum rejection, got %v", err)
+	}
+}
+
+func lineOnlyChecksum(value string) string {
+	sum := sha256.Sum256([]byte(value))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}