Cody/apply audit v014 by BunsDev · Pull Request #18 · OpenCoven/coven-threads

BunsDev · 2026-07-21T13:00:39Z

Summary

ApplyAudit migration repair + v0.2.0 release — supersedes closed PR #7, hardening the ward.audit schema/migration path until it is fully fail-closed (tip commit 31ae385):

Preserves detail during the v0.1.4 migration (original PR feat(audit)!: add ApplyAudit records and v0.2.0 schema migration #7 defect)
Table-local migration versioning with a user_version ladder
Exact stored-schema-SQL fingerprint comparison (full table definition, not shape heuristics)
Fail-closed schema initialization; rejects temporary schema shadows and durable namespace drift
Serialized schema-guard transactions; migration postcondition verification
Releases coven-threads-core v0.2.0 with CHANGELOG entries

Design/plan docs included under docs/superpowers/ (2026-07-19-apply-audit-migration-repair*).

Stacking

Branch includes the Phase 5 spec commits (fdefed7…db20c62) shared with #6/#15. Merge after #15 to keep the diff scoped to the audit repair; merging before will pull spec commits in via this PR.

Merge order for the Phase 5 stack: #6 (spec) → #15 (core) → #17 / #16 / #18.

Relationship to issues

Implements the repair path for #5 (ward_audit apply-audit event type) groundwork; audit event shape feeds threads-uqx.3 (#8).

Body added by Echo 🪞 during the 2026-07-21 state review (branch pushed by Val 07:58 CDT; body was empty).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…s-k9s) Cave implementation wraps route-1 data as { weaves, degraded } rather than overloading a WeaveSummary[] with degraded entries — the wrapped shape avoids any fabricated health fields on degraded familiars. Same-day alignment of the 2026-07-18 §2.7/R12 amendment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

All 8 open questions resolved on Sage's recommended defaults: - ApprovalPath separate from Channel (load axis preserved) - Delayed apply only for veto windows (fail-closed posture) - Classify-first for harness regions - Deterministic + probe for invariants (not LLM-judge-only) - RFC #3/#4 blocker resolved (familiar-contract@2a5bb98) - Daemon contract before Cave ProposalView extension - Display labels preserved, typed variants internal - proposal_window_opened audit event lands with delayed apply Rename PHASE-5-PROPOSAL -> PHASE-5-APPROVAL-SEMANTICS to reflect open status. Co-authored-by: Nova <nova@opencoven.dev>

…uqx) Add substantive annotations from Sage and Echo review (2026-07-18): Decision #1: rationale callback — ApprovalPath is authoritative, Channel is derived; if enforcement rule shifts, revisit all eight decisions. Decision #2: audit implication — close event needs reason field (applied|vetoed|expired|superseded); delayed-apply without it is a post-hoc audit black hole. Decision #3: forward-only promotion — retroactive region projection corrupts authority trail with apparently-authored writes from before promotion. Decision #4: fail-closed on extraction ambiguity — not silent LLM fallback; ambiguity is an explicit ignored/blocked state. Decision #5: RFC provenance pointer added. Decision #6: Cave ProposalView labeled [DESIGNED, NOT SHIPPED] from the start. Decision #7: label-variant round-trip is daemon wire contract (load-time reject on drift); Cave has zero policy freedom over label strings. Decision #8: proposal_window_opened paired with close event; window is a first-class audit interval. threads-uqx.3 design constraints (Sage): evidence_replay_hash on ProposalClassification; VetoWindow.min_visible: Duration; label mapping as daemon wire contract. Co-authored-by: Sage <sage@opencoven.dev> Co-authored-by: Echo <echo@opencoven.dev> Co-authored-by: Nova <nova@opencoven.dev>

…(v0.1.4) Closes coven-threads#5. Unblocks coven#414. Changes: - AuditEventType::ApplyAudit variant + apply_audit CHECK tag - WardAuditRecord.detail: nullable JSON column for event-specific payload - WardAuditRecord::for_apply() constructor - apply_prev_sha256_hex() / apply_bytes_written() decode helpers - WARD_AUDIT_MIGRATION_V014_SQL: transaction rebuild for v0.1.3 stores - APPLY_AUDIT_DETAIL_KEY_PREV / _BYTES stable constants - Exhaustiveness test extended; 3 new tests (shape, roundtrip, migration) - Workspace version bumped 0.1.3 -> 0.1.4 - CHANGELOG.md created Design: prev_sha256+bytes_written ride in detail JSON (Option A); migration exports SQL constant, no rusqlite dep added (Option B-lite). Bead: threads-3ym

Addresses two Sage review notes (neither was blocking): 1. WARD_AUDIT_MIGRATION_V014_SQL now stamps PRAGMA user_version = 14 inside the transaction. Future migrations gate on 'user_version < N' instead of substring-sniffing sqlite_master DDL. Migration doc-comment updated to name the gate rule and explain the intentional non-idempotence of the CREATE step (double-run fails loudly, not silently). 2. WardAuditRecord::detail doc-comment now names the full invariant for ApplyAudit rows (prev_sha256 hex 64 chars + bytes_written u64) and explicitly states other event types MAY leave it None or use their own documented shape. Turns the implicit decoder contract into a searchable spec. CHANGELOG updated. Tests still green, clippy clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR updates coven-threads’ audit infrastructure to ship an ApplyAudit event and a strict, fail-closed SQLite schema-state fingerprint/migration contract (targeting a semver-correct 0.2.0 release), and adds/updates supporting specs and design notes.

Changes:

Add AuditEventType::ApplyAudit, WardAuditRecord::detail, WardAuditRecord::for_apply(...), and extensive rusqlite-backed tests; introduce strict WARD_AUDIT_SCHEMA_STATE_SQL with missing/legacy_v013/current_v020/unknown tags and guarded BEGIN IMMEDIATE init/migration SQL.
Bump workspace version to 0.2.0, add a CHANGELOG.md, and add rusqlite as a dev-dependency for executable SQLite contract tests.
Add Phase 5 approval-semantics proposal/spec and tweak Phase 4 Cave surface contract for /api/weaves return shape.

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
specs/PHASE-5-APPROVAL-SEMANTICS.md	New Phase 5 approval semantics proposal/decision writeup
specs/PHASE-4-CAVE-SURFACES.md	Updates `/api/weaves` return type description to `WeaveListView` shape
docs/superpowers/specs/2026-07-19-apply-audit-migration-repair-design.md	Design doc for the repaired audit migration and schema-state contract
docs/superpowers/plans/2026-07-19-apply-audit-migration-repair.md	Implementation plan for the audit migration repair + semver bump
docs/architecture.md	Extends architecture notes to mention guarded init/migration under `BEGIN IMMEDIATE`
crates/coven-threads-core/src/lib.rs	Re-exports new audit SQL constants/tags and migration SQL
crates/coven-threads-core/src/audit.rs	Implements ApplyAudit + strict schema-state fingerprinting + guarded init/migration SQL + comprehensive tests
crates/coven-threads-core/Cargo.toml	Adds `rusqlite` dev-dependency (bundled + hooks)
CHANGELOG.md	New changelog documenting `0.2.0` and audit contract additions
Cargo.toml	Bumps workspace version to `0.2.0`
Cargo.lock	Locks `0.2.0` and adds dev-dependency resolution for `rusqlite`
.beads/interactions.jsonl	Records beads interaction updates associated with related work

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+# PHASE-5 PROPOSAL — Approval semantics over the Phase-2 Ward
+
+**Status:** PROPOSAL (decisions recorded — awaiting PR merge to open Phase 5)
+**Date:** 2026-07-18
+**Decision date:** 2026-07-18
+**Bead:** `threads-uqx`
+**Authors:** Sage lane (drafted by coordinator session agent)
+**Decided by:** Val Alexander + Nova (main session)
+
+---
+
+## 0. Scope and sources
+
+This is a proposal document only. It does not start Phase 5, amend frozen
+Phase 0, or change the daemon. Val and Nova decide whether Phase 5 opens.
+


+- `../familiar-contract/rfcs/RFC-0001-familiar-contract.md`: §4.2 protected
+  invariants, §4.3 editable surface, §5.3 approval tiers, §5.4 gates, §5.5
+  probes. RFC amendments for closure precondition and provenance predicate are
+  pending on issues #3/#4 and are treated as upstream-in-flight.


+For this semver-corrected follow-up, the repair delta relative to
+`origin/cody/apply-audit-v014` stays scoped to these eight tracked files:
+
+1. `CHANGELOG.md`
+2. `Cargo.lock`
+3. `Cargo.toml`
+4. `crates/coven-threads-core/src/audit.rs`
+5. `crates/coven-threads-core/src/lib.rs`
+6. `docs/architecture.md`
+7. `docs/superpowers/plans/2026-07-19-apply-audit-migration-repair.md`
+8. `docs/superpowers/specs/2026-07-19-apply-audit-migration-repair-design.md`


+2. run a uniquely named TEMP pre-install guard that reuses the exact
+   schema-state CTEs and permits only `missing` or exact `current_v020`;


+4. run a uniquely named TEMP post-install guard that reuses the same
+   schema-state expression and requires exact `current_v020`; and


BunsDev · 2026-07-22T02:46:19Z

Superseded by #23. The apply-audit work here was branched from the old base 6476a67 (pre-#15) and would have silently dropped 4 Phase-5 authority triggers on a naive tree-merge. #23 is the surgically-merged, independently-attested (Echo PASS of record, 6/6 spot-check items, 245/245 tests) version onto current main. Closing in favor of #23.

Note: Phase 5 freeze is NOT authorized (Val's call 2026-07-21) — #23 is review-ready but nothing activates on main until freeze is cleared separately.

BunsDev and others added 25 commits July 18, 2026 04:18

spec(proposal): draft Phase 5 approval semantics

fdefed7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs: design ApplyAudit migration repair

a463779

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs: plan ApplyAudit migration repair

290ca29

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): preserve detail during v0.1.4 migration

2bbba52

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs(audit): correct migration rerun guard

0641b00

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): keep migration versioning table-local

2fbb5e3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs: keep migration repair scope focused

6054dcb

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs: correct migration repair file scope

a884b15

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs: align migration plan with table-local gating

5c1ba0f

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs(audit): align PR 7 migration guidance

b090089

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): require exact schema fingerprint

c6d279e

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): fingerprint full table definition

5018694

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): compare exact stored schema SQL

1b56317

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): make schema initialization fail closed

f5b1721

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): reject temporary schema shadows

35527b0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs(audit): satisfy clippy list formatting

8c30603

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): reject durable namespace drift

8325fca

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): serialize schema guard transactions

73f285a

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): verify migration postcondition

f5bfe40

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(audit): release ApplyAudit as v0.2.0

31ae385

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 21, 2026 13:00

Copilot started reviewing on behalf of BunsDev July 21, 2026 13:01 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

This was referenced Jul 21, 2026

Feat/phase5 retired corpus #17

Closed

feat(audit): merge #18 fingerprint-model audit onto Phase-5 authority triggers #23

Open

BunsDev closed this Jul 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Cody/apply audit v014#18

Cody/apply audit v014#18
BunsDev wants to merge 25 commits into
mainfrom
cody/apply-audit-v014

BunsDev commented Jul 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

BunsDev commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		2. run a uniquely named TEMP pre-install guard that reuses the exact
		schema-state CTEs and permits only `missing` or exact `current_v020`;

		4. run a uniquely named TEMP post-install guard that reuses the same
		schema-state expression and requires exact `current_v020`; and

Uh oh!

Conversation

BunsDev commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Stacking

Relationship to issues

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

BunsDev commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BunsDev commented Jul 21, 2026 •

edited

Loading