standard_audit 0.15.1 → 0.15.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3d166172ff4fb5afad44ee41bdc696458000759d778d26978feba930a1f0f15d
-  data.tar.gz: 04f546a81c899d026a38d5db3ae9ec18d0e8be7968bd6dc00fbb8bd521b01704
+  metadata.gz: 0f28d1e0742cc3754f99b25e1242c69c70f72cbf781d2fc696b3be326fccd74c
+  data.tar.gz: 06f1dfe7a30578b6f8df0d3a672996802963dcdf9c316af967042b5b8f02648b
 SHA512:
-  metadata.gz: 0ff1c20d8dcb9b23d6b6aac9e5c25c9c64ab2a31a3117f5a646ae6018d99bca5bdc09fe8c11010ccfeab83231d63bbd7354872c9dafac249719d54e18da97dbd
-  data.tar.gz: d546320a519c833a3015a01887fea2459d9fe83c936e417eaae240059c94ed1fab08666d71da0773229a475424edd04834c19396287a6454ba317d1f868301fc
+  metadata.gz: 32f665b055842c67a00bb099f4919ae230b0f304f7c493a2ad4b783fa83540099fc7cf2b2259e0c7d08d71024a87af6707548110813062ee795e137b123fa73f
+  data.tar.gz: 3a8a1dc2fc568ee1668eb1dcd06fdc00620cb33f202c6b535d955e2b826ca2df0cd08e5ce3f9a214dfdbe741dc1f0bbf6def9add32531d96dabf92b6db2212fe

data/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.15.2] - 2026-10-30
+
+### Fixed
+- `verify_chain` and `relink_checksums!` now find a parent that sorts **after**
+  its child: two concurrent writers, the parent committed first (so the child
+  read its checksum as the tip) but stamped `created_at` a few milliseconds
+  later. The backward recovery window never held it, so a sound row was
+  reported as `:digest_mismatch` and never relinked (3 rows on one production
+  host, 2026-10-30). A row that reproduces no earlier digest is now held for
+  the next `lookahead` rows (default 64, `lookahead: 0` disables) and counted
+  as `:recovered` / relinked when one of them is its parent.
+
 ## [0.15.1] - 2026-10-28
 
 ### Fixed

data/README.md

@@ -1128,6 +1128,10 @@ They have no `previous_checksum`. Verification falls back to the preceding row
 in the walk and, failing that, searches back through the last `recovery_window`
 (default 256) digests for the one that reproduces the row's checksum — which
 recovers the true parent of a row that forked, **without re-signing anything**.
+A parent can also sort *after* its child (two concurrent writers: the parent
+committed first, so the child read its checksum as the tip, but was stamped a
+few milliseconds later), so a row that reproduces no earlier digest is held for
+the next `lookahead` rows (default 64) before it is reported.
 This does not weaken tamper detection: a row whose fields were altered
 reproduces no candidate's digest. Pass `strict: true` to skip the search and see
 every fork as a failure.

data/app/models/standard_audit/audit_log.rb

@@ -360,6 +360,13 @@ module StandardAudit
     #     this window search, so a legacy row that was both forked and
     #     reordered stays unverifiable.)
     #
+    # A parent can also sort AFTER its child: two concurrent writers, the
+    # parent committed first (so the child read its checksum as the tip) but
+    # stamped `created_at` a few milliseconds later. The backward window never
+    # holds it, so a row that reproduces no earlier digest is held for the next
+    # `lookahead` rows and counted as :recovered when one of them is its
+    # parent; only then is it a :digest_mismatch. (`lookahead: 0` disables it.)
+    #
     # The chain links across the cutover like anywhere else: the first
     # canonical row's parent is the last legacy row's stored checksum.
     #
@@ -379,7 +386,7 @@ module StandardAudit
     # `created_at`. Rows whose two timestamps disagree (a backdated
     # `occurred_at`) can leave a hole rather than a prefix, and a hole is
     # reported — truthfully, since rows really are missing.
-    def self.verify_chain(scope: nil, batch_size: 1000, recovery_window: 256, strict: false,
+    def self.verify_chain(scope: nil, batch_size: 1000, recovery_window: 256, lookahead: 64, strict: false,
       key_order_search_limit: StandardAudit::Checksum::KeyOrderSearch::DEFAULT_LIMIT,
       fail_on_legacy_unverifiable: false)
       relation = scope ? where(scope_gid: scope.to_global_id.to_s) : all
@@ -395,6 +402,10 @@ module StandardAudit
       unverifiable = []
       failures = []
       window = []
+      # Rows whose parent may still be AHEAD in the walk (see `lookahead`):
+      # [{ record:, algorithm:, expected:, seen: }], resolved against each
+      # later row's checksum, given up after `lookahead` rows.
+      pending = []
       first_row = true
       pruned_parents = []
 
@@ -426,6 +437,17 @@ module StandardAudit
           next
         end
 
+        pending.delete_if do |p|
+          if walk_digester(p[:record], p[:algorithm]).call(record.checksum) == p[:record].checksum
+            recovered += 1
+          elsif (p[:seen] += 1) >= lookahead
+            failures << chain_failure(p[:record], expected: p[:expected], reason: :digest_mismatch)
+          else
+            next false
+          end
+          true
+        end
+
         declared = declared_parents ? record.previous_checksum : nil
 
         if record.anonymized?
@@ -465,6 +487,10 @@ module StandardAudit
               unverifiable << entry
               failures << entry if fail_on_legacy_unverifiable
             end
+          elsif declared.blank? && !strict && lookahead.positive?
+            # Its parent may sort AFTER it (committed first, stamped later by a
+            # concurrent writer); decided when the next `lookahead` rows pass.
+            pending << { record: record, algorithm: algorithm, expected: expected, seen: 0 }
           else
             failures << chain_failure(record, expected: expected, reason: :digest_mismatch)
           end
@@ -476,6 +502,8 @@ module StandardAudit
         window.shift if window.size > recovery_window
       end
 
+      pending.each { |p| failures << chain_failure(p[:record], expected: p[:expected], reason: :digest_mismatch) }
+
       {
         valid: failures.empty?,
         verified: verified,
@@ -499,7 +527,7 @@ module StandardAudit
     # the row has held since it was written. Rows whose parent cannot be
     # reproduced are left untouched and counted in :unresolved — they are the
     # rows verification should keep reporting.
-    def self.relink_checksums!(batch_size: 1000, recovery_window: 256)
+    def self.relink_checksums!(batch_size: 1000, recovery_window: 256, lookahead: 64)
       return { relinked: 0, unresolved: 0, skipped: 0 } unless chain_parent_column?
 
       previous_checksum = nil
@@ -507,6 +535,7 @@ module StandardAudit
       unresolved = 0
       skipped = 0
       window = []
+      pending = [] # rows whose parent may still be ahead (see verify_chain's `lookahead`)
 
       each_in_chain_order(all, batch_size: batch_size) do |record|
         if record.checksum.blank?
@@ -515,12 +544,28 @@ module StandardAudit
           next
         end
 
+        pending.delete_if do |p|
+          if walk_digester(p[:record], p[:algorithm]).call(record.checksum) == p[:record].checksum
+            p[:record].update_columns(previous_checksum: record.checksum)
+            relinked += 1
+          elsif (p[:seen] += 1) >= lookahead
+            unresolved += 1
+          else
+            next false
+          end
+          true
+        end
+
         found = resolve_parent(record, previous_checksum, window) if record.previous_checksum.blank?
 
         if record.previous_checksum.present?
           skipped += 1
         elsif found.nil?
-          unresolved += 1
+          if lookahead.positive?
+            pending << { record: record, algorithm: StandardAudit::Checksum.algorithm_for(record.created_at), seen: 0 }
+          else
+            unresolved += 1
+          end
         elsif found.first.present?
           record.update_columns(previous_checksum: found.first)
           relinked += 1
@@ -534,6 +579,7 @@ module StandardAudit
         window.shift if window.size > recovery_window
       end
 
+      unresolved += pending.size
       { relinked: relinked, unresolved: unresolved, skipped: skipped }
     end
 

data/lib/standard_audit/version.rb

@@ -1,3 +1,3 @@
 module StandardAudit
-  VERSION = "0.15.1"
+  VERSION = "0.15.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_audit
 version: !ruby/object:Gem::Version
-  version: 0.15.1
+  version: 0.15.2
 platform: ruby
 authors:
 - Jaryl Sim