[JetSquirrel]

Finishes the AWS work without adding to it. No rule, field or resource type changes, and no change to what the plugin returns.

What changes

• AWS docs move to the plugin. docs/exposure-rules.md is now plugins/aws/README.md, and opens by saying the plugin is an example, maintained, with no new rules or resource types planned. Links are updated.
• The inspector no longer shows what it says it masked. It said Masked as possible secrets: api_token, then listed the value just below. The property list now uses the same masking as evidence. Query result tables still show raw values, since they're what the query returned.
• Open investigation is reachable on Windows. It was only in the native File menu, which Windows doesn't show. It's now in the title bar's Graph menu, and docs/investigations.md says so.
• Release baselines added to docs/investigation-gates.md, from the manual validation of 2026-11-03. I checked the figures against that run's raw JSON, but didn't re-measure them.

Boundary check

Outside plugins/aws, AWS appears in host code only in test data, comments, the secret-shape check for access key IDs, and BUILTIN_PLUGINS, which ships the plugin in the app. An existing test stops the canvas and explorer naming AWS rules or labels.

Testing

• cargo clippy --locked --workspace --all-targets -- -D warnings is clean, and cargo test --locked --workspace gives 356 passed, 0 failed, 1 ignored on Windows. CI will cover macOS.
• A new unit test covers masking, including that bookkeeping properties stay.
• In the real window on Windows: a node with a synthetic api_token shows [redacted] in the list with other properties intact, and Graph > Open investigation… opens the file picker. I cancelled the picker, so opening a file from it wasn't checked; khonsu open uses the same code after the picker.
• The menu change has no automated test, and the window wasn't run on macOS.

Issue status

• [v0.3] Evidence Inspector: source, relation and rule provenance #33 and [v0.3] Save and reopen investigation state #34: this fixes what the validation said should come first. Closing them is still your call.
• [v0.3] Explainable AWS exposure investigation rules #35: still needs the walkthrough with a new engineer.
• [v0.3] Deterministic investigation fixtures, correctness and performance gates #36: still needs macOS and UI responsiveness numbers.

Refs #33, #34, #35, #36

🤖 Generated with Claude Code