reeve 0.6.0 → 0.8.0

data/lib/reeve/testing/checks/ledger_chain.rb

@@ -20,13 +20,25 @@ module Reeve
       # * **nothing to write or read** (no compliance tools, ledger not loaded) — skipped,
       #   saying the chain was not verified. Never passed.
       #
+      # With `anchored: true` (specs/004 research R8) it also makes a checkpoint after writing,
+      # publishes it through config.ledger_anchor, reads the anchor back, and verifies against
+      # that checkpoint alone. It passes only when the chain is intact and anchored at it: what
+      # a host's CI can prove is that its anchor is configured and round-trips. Whether
+      # production's checkpoints match production is the scheduled verify_ledger's job. Without
+      # it, the anchor is never read.
+      #
       #   Reeve::Checks::LedgerChain.new.call
+      #   Reeve::Checks::LedgerChain.new(anchored: true).call
       class LedgerChain < Base
         NOT_VERIFIED = "the ledger chain was not verified"
+        NOT_ANCHORED = "expected the ledger to be anchored"
+        NOT_RETURNED = "the checkpoint it published did not come back from config.ledger_anchor"
 
-        def initialize(tools: nil, principals: nil, arguments: {}, invoke: nil, ledger: nil)
+        def initialize(tools: nil, principals: nil, arguments: {}, invoke: nil, ledger: nil,
+                       anchored: false)
           @tools = tools
           @principals = principals
+          @anchored = anchored
           super(tool: nil, arguments: arguments, invoke: invoke, ledger: ledger)
         end
 
@@ -37,12 +49,54 @@ module Reeve
 
           unwritten = write_entries
           return unwritten_entry(unwritten) if unwritten
+          return judge(ledger.verify_chain) unless @anchored
 
-          judge(ledger.verify_chain)
+          anchored
         end
 
         private
 
+        def anchored
+          return not_anchored("no anchor is configured: set config.ledger_anchor") if anchor.nil?
+          unless ledger.respond_to?(:checkpoint!)
+            return skipped("this ledger cannot make a checkpoint")
+          end
+
+          checkpoint, failure = round_trip
+          return not_anchored(failure) if failure
+
+          judge_anchored(ledger.verify_chain(checkpoints: [checkpoint]), checkpoint)
+        end
+
+        # The checkpoint it made and read back from the anchor, or why it could not.
+        def round_trip
+          made = ledger.checkpoint!
+          return [nil, made.to_s.lines.first.chomp] unless made&.made? && made.published?
+          unless Array(anchor.checkpoints).include?(made.checkpoint.to_line)
+            return [nil,
+                    NOT_RETURNED]
+          end
+
+          [made.checkpoint, nil]
+        end
+
+        def anchor
+          Reeve.config.ledger_anchor
+        end
+
+        def judge_anchored(verification, checkpoint)
+          return judge(verification) unless verification&.intact?
+          if verification.anchored_at&.head_sequence == checkpoint.head_sequence
+            return judge(verification)
+          end
+
+          not_anchored(verification.to_s.lines.first.chomp)
+        end
+
+        def not_anchored(reason)
+          failed("#{NOT_ANCHORED}, but #{reason}", coverage: :not_anchored)
+        end
+
         def subject
           @subject ||= Array(@tools || Testing.compliance_tools).first
         end

data/lib/reeve/testing/ledger.rb

@@ -71,14 +71,30 @@ module Reeve
       # The chain's verification of the whole ledger (specs/002), or nil when the ledger is
       # not loaded. The kit's only way to the chain: it names Reeve::Audit::Chain here, at
       # call time, so `require "reeve/testing"` still loads with no ActiveRecord at all.
-      def verify_chain
-        return nil unless available? && Reeve::Audit.const_defined?(:Chain, false)
+      #
+      # Against `checkpoints` only, never the configured anchor's (specs/004 research R8): a
+      # test database is emptied between runs, and every checkpoint an earlier run left names
+      # a chain that is gone.
+      def verify_chain(checkpoints: [])
+        return nil unless chain?
+
+        Reeve::Audit::Chain.verify(entry_class: entry_class, checkpoints: checkpoints)
+      end
+
+      # A checkpoint of the ledger, published to config.ledger_anchor (specs/004), or nil when
+      # the ledger is not loaded.
+      def checkpoint!
+        return nil unless chain?
 
-        Reeve::Audit::Chain.verify(entry_class: entry_class)
+        Reeve::Audit::Chain.checkpoint!(entry_class: entry_class)
       end
 
       private
 
+      def chain?
+        available? && Reeve::Audit.const_defined?(:Chain, false)
+      end
+
       def entry_class
         return @entry_class if defined?(@entry_class)
 

data/lib/reeve/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Reeve
-  VERSION = "0.6.0"
+  VERSION = "0.8.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: reeve
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Victor Velazquez
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-10 00:00:00.000000000 Z
+date: 2026-10-25 00:00:00.000000000 Z
 dependencies: []
 description: |
   Reeve makes it safe for a Rails application to expose MCP (Model Context Protocol)
@@ -31,25 +31,49 @@ files:
 - lib/generators/reeve/install/templates/create_audit_entries.rb.tt
 - lib/generators/reeve/install/templates/initializer.rb.tt
 - lib/generators/reeve/upgrade/templates/add_contract_version_to_reeve_audit_entries.rb.tt
+- lib/generators/reeve/upgrade/templates/add_key_epochs_to_reeve_audit_entries.rb.tt
 - lib/generators/reeve/upgrade/templates/add_ledger_chain_to_reeve_audit_entries.rb.tt
+- lib/generators/reeve/upgrade/templates/add_ledger_retention_to_reeve_audit_entries.rb.tt
 - lib/generators/reeve/upgrade/upgrade_generator.rb
+- lib/generators/reeve/upgrade/upgrade_notes.rb
 - lib/reeve.rb
 - lib/reeve/audit.rb
 - lib/reeve/audit/chain.rb
+- lib/reeve/audit/chain/anchoring.rb
 - lib/reeve/audit/chain/canonical.rb
+- lib/reeve/audit/chain/checkpoint.rb
+- lib/reeve/audit/chain/checkpoint_check.rb
+- lib/reeve/audit/chain/entrypoints.rb
+- lib/reeve/audit/chain/epoch_rules.rb
+- lib/reeve/audit/chain/epochs.rb
 - lib/reeve/audit/chain/head.rb
 - lib/reeve/audit/chain/keyring.rb
 - lib/reeve/audit/chain/normalizer.rb
 - lib/reeve/audit/chain/report.rb
+- lib/reeve/audit/chain/retention/archive.rb
+- lib/reeve/audit/chain/retention/archive_check.rb
+- lib/reeve/audit/chain/retention/check.rb
+- lib/reeve/audit/chain/retention/connection.rb
+- lib/reeve/audit/chain/retention/digest.rb
+- lib/reeve/audit/chain/retention/plan.rb
+- lib/reeve/audit/chain/retention/preflight.rb
+- lib/reeve/audit/chain/retention/purge.rb
+- lib/reeve/audit/chain/retention/purge_result.rb
+- lib/reeve/audit/chain/retention/records.rb
+- lib/reeve/audit/chain/rotation.rb
+- lib/reeve/audit/chain/schema.rb
 - lib/reeve/audit/chain/verification.rb
 - lib/reeve/audit/chain/verifier.rb
 - lib/reeve/audit/chain/walk.rb
+- lib/reeve/audit/chain_epoch.rb
 - lib/reeve/audit/chain_record.rb
 - lib/reeve/audit/entry.rb
+- lib/reeve/audit/file_anchor.rb
 - lib/reeve/audit/isolated_recorder.rb
 - lib/reeve/audit/query.rb
 - lib/reeve/audit/recorder.rb
 - lib/reeve/audit/redactor.rb
+- lib/reeve/audit/retention_record.rb
 - lib/reeve/authorization.rb
 - lib/reeve/authorization/adapter.rb
 - lib/reeve/authorization/adapters/plain.rb
@@ -76,6 +100,8 @@ files:
 - lib/reeve/rspec.rb
 - lib/reeve/scope_result.rb
 - lib/reeve/tasks.rb
+- lib/reeve/tasks/descriptions.rb
+- lib/reeve/tasks/purge_options.rb
 - lib/reeve/testing.rb
 - lib/reeve/testing/assertions.rb
 - lib/reeve/testing/checks.rb