M2: durable audit events

[kgarg2468]

M2 slice 13: the audit store (spec §14 audit log; S14-005; roadmap M2 exit criterion "audit events survive restart").

• Migration 12 audit_events: one recorded fact per row in a run's §14 accountability trail — closed case-sensitive ten-kind taxonomy (authorizer, source, packet_version, permission_granted, file_accessed, service_accessed, permission_requested, user_response, artifact, final_status), backend-stamped dense per-record seq that clients cannot forge (forged seq/at_ms ignored, pinned by test + demo), bounded detail.
• record_audit_event: double-Option record_id, unknown_run split, single-item list-envelope admission probe at i64::MAX stamp ceilings before insert (mutant-proven binding); list_audit_events: seq-ordered, limit-51 truncation probe, end-popping byte budget keeping the trail's start.
• Swift AuditEvent/AuditEventPage + request builders/decoders/tests.
• Security fix found via worker flag: four persistence tests were opening the user's REAL default store (flock race under parallel test runs + test residue written into user data). All four now use fixture stores; residue inventory recorded in the verification summary, not deleted.

TDD: red-first vs merged main 5c82fab (unknown_request_type ×3). Gates: 172 Rust + 62 Swift tests, fmt, clippy -D warnings, verify-m0.sh exit 0. Real-binary demo: self-contained hand-built v11 fixture migrated 11→12, legacy run gains a trail, all ten kinds recorded, restart survival, 0600. Evidence: .loop/verification/m2-audit-events/.

Traceability: S14-005 → in_progress with this PR (durable store + protocol; fact producers land M6/M9).

🤖 Generated with Claude Code

Greptile Summary

This PR adds durable, backend-sequenced audit events for runs, including migration, Rust protocol/store support, and Swift client models.

• Adds migration 12 and persistent per-run audit-event sequencing.
• Adds record and list protocol operations with validation and response-size bounds.
• Adds Swift request builders, decoders, persistence tests, and restart-verification artifacts.

Confidence Score: 4/5

The PR should not merge until truncated audit trails provide a way to retrieve later events.

Runs exceeding the count or byte limit expose only their earliest audit events; the backend and Swift client still provide no cursor or offset for retrieving the omitted tail.

Files Needing Attention: backend/src/lib.rs, backend/src/store.rs, Sources/CaptureDelegateIPC/IPCClient.swift

Important Files Changed

Filename	Overview
backend/src/lib.rs	Adds audit-event protocol handling and bounded listing, but the existing inability to continue a truncated trail remains.
backend/src/store.rs	Adds migration 12 and transactional, per-run audit-event persistence ordered by backend-assigned sequence.
Sources/CaptureDelegateIPC/IPCClient.swift	Adds AuditEvent models plus record/list request and decoding support.
backend/tests/persistence.rs	Adds persistence, validation, listability, scoping, and restart-survival coverage.

_{Reviews (2): Last reviewed commit: "Record Sol PASS review and user-stop pau..." | Re-trigger Greptile}

[greptile-apps]

Truncated trails cannot continue

When a run has more than 50 audit events, or the response exceeds the byte budget, list_audit_events returns only the earliest bounded prefix with truncated set but accepts no cursor or offset. Clients therefore cannot retrieve later durable facts, including a final status, leaving the accountability trail incomplete through the protocol.

Prompt To Fix With AI

This is a comment left during a code review.
Path: backend/src/lib.rs
Line: 2322-2331

Comment:
**Truncated trails cannot continue**

When a run has more than 50 audit events, or the response exceeds the byte budget, `list_audit_events` returns only the earliest bounded prefix with `truncated` set but accepts no cursor or offset. Clients therefore cannot retrieve later durable facts, including a final status, leaving the accountability trail incomplete through the protocol.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[kgarg2468]

Status: paused by user, ready to merge on resume.

Independent review (gpt-5.6-sol, xhigh): PASS, zero blockers — report at .loop/verification/m2-audit-events/sol-round1-report.md. Two MINOR test-coverage follow-ups (concurrent-append tripwire; audit-list truncation/byte-budget persistence coverage) recorded in verification.txt for the next touch of this area.

All ADR-007 merge conditions are green: fresh verify-m0.sh exit 0 (verify-m0-merge-gate.log, 172 Rust + 62 Swift), runtime v11→v12 demo, mutant evidence. Merge was intentionally withheld because the user sent "stop" during this window; the recurring loop job was cancelled. Resume = squash-merge this PR, then the cycle-31 closeout.