feat(audit): merge #18 fingerprint-model audit onto Phase-5 authority triggers#23
Open
BunsDev wants to merge 2 commits into
Open
feat(audit): merge #18 fingerprint-model audit onto Phase-5 authority triggers#23BunsDev wants to merge 2 commits into
BunsDev wants to merge 2 commits into
Conversation
… triggers Replaces the stamp-model schema versioning (`WARD_AUDIT_STAMP_V020_SQL` + `ward_audit_migration_sql` builder + `WardAuditSchemaAction`) with the fingerprint-model four-state classifier (`missing`, `legacy_v013`, `current_v020`, `unknown`) driven by byte-exact stored-SQL comparison against `main.sqlite_master`. Preserves all Phase-5 (#15) authority work: - All 11 `AuditEventType` variants - `WardAuditRecord` + constructors + validators - SQL-level authority triggers (`require_single_terminal_insert`, `require_authorization_insert`, `require_proposal_approval_detail_insert`, `require_window_close_detail_insert`) — now installed by both fresh `WARD_AUDIT_SCHEMA_SQL` and `WARD_AUDIT_MIGRATION_V020_SQL` - Corpus verifier, RFC-0001 §5.6 conformance suite Fingerprint machinery: - `ward_audit_expected_durable_object_predicate_sql!` enumerates exactly the 9 durable objects (1 table + 2 indexes + 6 triggers); any other reserved object fails closed as `unknown`. - `ward_audit_exact_trigger_fp_sql!` (6-trigger current) and `ward_audit_exact_legacy_trigger_fp_sql!` (2-trigger legacy) provide separate byte-exact fingerprints so `legacy_v013` stores do not misclassify as `unknown`. - `WARD_AUDIT_MIGRATION_V020_SQL` migrates `legacy_v013` to `current_v020` by adding `detail`, rebuilding the table with the 11-variant CHECK, and installing all 6 triggers, guarded by `BEGIN IMMEDIATE` and independent pre/post fingerprint checks. Attestation summary: - 210 lib tests pass (was 180 pre-Phase-5-trigger integration), 17 + 4 + 14 integration tests all green; workspace build clean. - Trigger fingerprints verified byte-identical to live SQLite output via independent rusqlite probe. - Authority triggers in `ward_audit_authority_triggers_sql!` and `ward_audit_current_objects_sql!` verified byte-identical to main's authoritative form (after `IF NOT EXISTS main.` normalization). - `legacy_v013` predicate references `ward_audit_exact_legacy_trigger_fp_sql!`, `current_v020` predicate references `ward_audit_exact_trigger_fp_sql!` — separation verified, no cross-contamination. Follow-ups (not blocking freeze): - Refresh doc comment on `WARD_AUDIT_MIGRATION_V020_SQL` (pr18's original doc predates 6-trigger migration; missing-doc warning was pre-existing). - Doc-only PR to point RFC-0001 §5.2 at `IdentityInvariantSet::compile`. Co-authored-by: Cody <cody@opencoven.ai>
Closed
There was a problem hiding this comment.
Pull request overview
This PR supersedes #18 by porting the four-state, exact-fingerprint ward_audit schema gating model onto the Phase-5 authority-trigger audit core (from #15), making audit initialization/migration fail-closed based on durable main.sqlite_master.sql + PRAGMA fingerprints and TEMP-shadow rejection.
Changes:
- Adds
WARD_AUDIT_SCHEMA_STATE_SQL(+ stable tags) and rewritesWARD_AUDIT_SCHEMA_SQL/WARD_AUDIT_MIGRATION_V020_SQLto beBEGIN IMMEDIATE-guarded and fingerprint-based. - Expands
audit.rswith extensive rusqlite-backed executable tests (including concurrency/rollback semantics) and addsrusqliteas a dev-dependency. - Updates public exports and changelog/docs to reflect the v0.2.0 audit contract and the new schema-state model.
Reviewed changes
Copilot reviewed 5 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/superpowers/specs/2026-07-19-apply-audit-migration-repair-design.md | Adds the written design for the fingerprint-based audit schema-state contract and guarded init/migration. |
| docs/superpowers/plans/2026-07-19-apply-audit-migration-repair.md | Adds the implementation plan and validation checklist for the migration repair. |
| crates/coven-threads-core/src/lib.rs | Updates the crate’s public exports to expose the new schema-state query/tags and guarded SQL constants. |
| crates/coven-threads-core/src/audit.rs | Implements the four-state fingerprint classifier, guarded init/migration SQL, and adds extensive executable rusqlite tests. |
| crates/coven-threads-core/Cargo.toml | Introduces rusqlite as a dev-dependency to support the new audit schema/migration tests. |
| CHANGELOG.md | Documents the new schema-state contract and the guarded init/migration approach in the 0.2.0 notes. |
| Cargo.lock | Locks new transitive dependencies introduced by adding rusqlite (dev). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
86
to
90
| //! `WardAuditRecord::diff_hash` carries `next_sha256` (the post-write content | ||
| //! hash, matching the RFC-0001 §5.6 `diff_hash` semantic for verdict rows). | ||
| //! The complementary `prev_sha256` and `bytes_written` ride in `detail` as a | ||
| //! compact JSON object `{"prev_sha256":"<hex-or-null>","bytes_written":N}`. This | ||
| //! compact JSON object `{"prev_sha256":"<hex>","bytes_written":N}`. This | ||
| //! choice: |
Comment on lines
+22
to
+24
|
|
||
| [dev-dependencies] | ||
| rusqlite = { version = "0.31", features = ["bundled", "hooks"] } |
Step 6 of WARD_AUDIT_MIGRATION_V020_SQL doc now lists all 6 durable triggers installed by the migration (2 append-only + 4 authority), not just the 2 append-only triggers mentioned before Part 3 expanded the set. Add RFC-0001 §5.2/§4.2 doc pointer to IdentityInvariantSet::compile — the concrete implementation of the compilation-story requirement. Closes spec-drift flagged during attestation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #18. Surgically merges #18's fingerprint four-state audit model onto #15's Phase-5 authority core (main @ 6fa360b) — NOT a destructive tree-merge.
Attestation: ✅ PASS (Echo, verdict of record; Cody corroborating)
Independence held: Cody authored, Echo verified via independent rusqlite probes. Roles never crossed.
What landed
Regression prevented
The spot-check flow caught 4 real defects before commit — most critically, the 4 Phase-5 authority triggers (require_authorization, require_proposal_approval_detail, require_single_terminal, require_window_close_detail) that a naive #18 tree-merge would have silently dropped.
Non-blocking follow-ups
Freeze status