fix(integrity): re-baseline anchor on legitimate release upgrade

[FabioLeitao]

Summary

Fixes false integrity_state=tampered / -alpha after a legitimate package upgrade that reuses the same SQLite DB (reproduced: pipx upgrade post4→post5 + shared audit_demo.db).

Cause: E.3 re-verify compared module hashes without checking whether release_label changed.

Fix: when stored release_label ≠ current _release_label(), UPDATE the single anchor row to the new baseline and append a re-baseline event. Same label + hash drift still tampers (not softened). Aligns with E.6 (tamper-evident, not proof).

Related: #1262 (issue exists; no auto-close — link only).

Test plan

• ./scripts/check-all.sh --enforced
• Upgrade path → validated + re-baseline event + one row
• Same label + drift → still tampered
• Bugbot on concurrency / soften risk

Security note

Re-baseline only on release_label change. GATE_FILE untouched.

Made with Cursor

[cursor]

Stale comment

Automated security review identified one net-new finding after deduplication and live-head revalidation.

  

_{Sent by Cursor Security Agent: Security Reviewer}