@blamejs/core 0.15.12 → 0.15.14

package/lib/audit-sign.js

@@ -59,6 +59,7 @@
  *   SLH-DSA-SHAKE-256f post-quantum signature for audit-chain checkpoints.
  */
 var nodeFs = require("node:fs");
+var numericBounds = require("./numeric-bounds");
 var nodePath = require("node:path");
 var nodeCrypto = require("node:crypto");
 var atomicFile = require("./atomic-file");
@@ -190,6 +191,33 @@ function _computeFingerprint(publicKeyPem) {
   return sha3Hash(publicKeyPem);
 }
 
+// ---- Store-independent chain anchor (the checkpoint protocol lifted off the
+// framework audit_log / audit_checkpoints store so a consumer can anchor THEIR
+// OWN hash chain) ----
+
+// Domain-separation magic for a consumer anchor's signed bytes. DISTINCT from
+// the framework audit-checkpoint format on purpose: a checkpoint signature can
+// never be replayed as an anchor (or vice versa), and the framework
+// audit_checkpoints wire format stays byte-stable (b.audit.checkpoint is
+// untouched). Changing this invalidates every prior anchor.
+var ANCHOR_FORMAT = "blamejs-chain-anchor-v1";
+
+// Build the canonical signed bytes for one anchor. Fixed multi-line layout (no
+// JSON serializer quirks). prevTipHash IS part of the signed payload, so the
+// link between consecutive anchors is tamper-evident — an attacker cannot
+// rewrite the linkage without breaking the signature. `format` lets a consumer
+// domain-separate their own anchors from any other anchored chain.
+function anchorPayload(counter, tipHash, prevTipHash, createdAt, format) {
+  return Buffer.from(
+    (format || ANCHOR_FORMAT) + "\n" +
+    String(counter) + "\n" +
+    tipHash + "\n" +
+    (prevTipHash || "") + "\n" +
+    String(createdAt),
+    "utf8"
+  );
+}
+
 // ---- Passphrase sourcing (delegates to lib/passphrase-source.js with
 // audit-signing-specific env var names) ----
 
@@ -798,6 +826,233 @@ async function rotateSigningKey(rotOpts) {
   };
 }
 
+// Defensive coercion of an operator-supplied tip into the canonical fields.
+// Config-time tier: throws a typed AuditSignError on a malformed tip so the
+// consumer catches the bug at the call site, not as an opaque "signature
+// failed" later. prevTipHash is OPTIONAL (absent for the genesis anchor).
+function _normalizeTip(tip, fnLabel) {
+  if (!tip || typeof tip !== "object") {
+    throw _err("ANCHOR_BAD_TIP",
+      "auditSign." + fnLabel + ": tip must be an object { counter, tipHash }");
+  }
+  var counter = tip.counter;
+  if (!numericBounds.isNonNegativeFiniteInt(counter)) {
+    throw _err("ANCHOR_BAD_COUNTER",
+      "auditSign." + fnLabel + ": tip.counter must be a non-negative integer (got: " + counter + ")");
+  }
+  if (typeof tip.tipHash !== "string" || tip.tipHash.length === 0) {
+    throw _err("ANCHOR_BAD_TIPHASH",
+      "auditSign." + fnLabel + ": tip.tipHash must be a non-empty string");
+  }
+  if (tip.prevTipHash != null && typeof tip.prevTipHash !== "string") {
+    throw _err("ANCHOR_BAD_PREV",
+      "auditSign." + fnLabel + ": tip.prevTipHash, when present, must be a string");
+  }
+  return {
+    counter:     counter,
+    tipHash:     tip.tipHash,
+    prevTipHash: tip.prevTipHash != null ? tip.prevTipHash : null,
+  };
+}
+
+/**
+ * @primitive  b.auditSign.anchor
+ * @signature  b.auditSign.anchor(tip, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @compliance hipaa, pci-dss, gdpr, soc2, sox-404
+ * @related    b.auditSign.verifyAnchor, b.auditSign.verifyAnchorChain, b.audit.checkpoint
+ *
+ * Sign a hash-chain tip with the in-memory PQC key, returning a
+ * self-describing anchor object the consumer persists in THEIR OWN store. This
+ * is the `b.audit.checkpoint()` protocol lifted off the framework `audit_log` /
+ * `audit_checkpoints` tables: a consumer running their own append-only chain
+ * anchors its tip the same tamper-evident way, with no framework table, no
+ * `clusterStorage`, and no leader requirement. A full-chain rewrite that
+ * recomputes every row hash still cannot forge the signature without the
+ * audit-signing private key, so a later `verifyAnchorChain` detects it.
+ *
+ * `tip.prevTipHash` (optional) is bound into the signed bytes, so truncation /
+ * reorder of a stored anchor sequence is caught by the signature, not just a
+ * plaintext compare. `opts.format` domain-separates a consumer's anchors
+ * (default `"blamejs-chain-anchor-v1"`).
+ *
+ * Verification resolves the public key from the recorded fingerprint via the
+ * key-history file under the `init({ dataDir })` directory, so it is bound to
+ * that key store (not fully store-free) — keep the history with the anchors.
+ *
+ * Throws `AuditSignError` (`ANCHOR_BAD_TIP` / `ANCHOR_BAD_COUNTER` /
+ * `ANCHOR_BAD_TIPHASH` / `ANCHOR_BAD_PREV`) on a malformed tip;
+ * `audit-sign/not-initialized` when `init()` has not been awaited.
+ *
+ * @opts
+ *   format:    string,   // default "blamejs-chain-anchor-v1" — domain-separation magic in the signed payload
+ *   createdAt: number,   // default Date.now() — the anchor timestamp (also signed)
+ *
+ * @example
+ *   await b.auditSign.init({ dataDir: "/var/lib/blamejs/data" });
+ *   var a = b.auditSign.anchor({ counter: 42, tipHash: "9f4e", prevTipHash: "1b7d" },
+ *                              { format: "my-app-ledger-v1" });
+ *   // → { format, counter, tipHash, prevTipHash, createdAt, algorithm,
+ *   //     publicKeyFingerprint, signature }
+ */
+function anchor(tip, opts) {
+  _requireInit();
+  opts = opts || {};
+  var t = _normalizeTip(tip, "anchor");
+  var format = (typeof opts.format === "string" && opts.format.length > 0) ? opts.format : ANCHOR_FORMAT;
+  var createdAt = (typeof opts.createdAt === "number" && isFinite(opts.createdAt)) ? opts.createdAt : Date.now();
+  var payload = anchorPayload(t.counter, t.tipHash, t.prevTipHash, createdAt, format);
+  var sigBuf = sign(payload);
+  return {
+    format:               format,
+    counter:              t.counter,
+    tipHash:              t.tipHash,
+    prevTipHash:          t.prevTipHash,
+    createdAt:            createdAt,
+    algorithm:            keys.algorithm,
+    publicKeyFingerprint: keys.fingerprint,
+    signature:            sigBuf.toString("hex"),
+  };
+}
+
+// Resolve + verify ONE anchor's signature. Returns { ok, reason? }. Never
+// throws on a forgery / unknown key (defensive-reader tier) — the caller
+// branches on ok.
+function _verifyOneAnchor(a) {
+  if (!a || typeof a !== "object") return { ok: false, reason: "anchor is not an object" };
+  if (typeof a.tipHash !== "string" || typeof a.signature !== "string" ||
+      typeof a.publicKeyFingerprint !== "string") {
+    return { ok: false, reason: "anchor missing tipHash / signature / publicKeyFingerprint" };
+  }
+  if (typeof a.counter !== "number" || !isFinite(a.counter)) {
+    return { ok: false, reason: "anchor counter is not a finite number" };
+  }
+  var pub = getPublicKeyByFingerprint(a.publicKeyFingerprint);
+  if (!pub) {
+    return { ok: false, reason: "no audit-signing key on record for this anchor's fingerprint" };
+  }
+  var format = (typeof a.format === "string" && a.format.length > 0) ? a.format : ANCHOR_FORMAT;
+  // prevTipHash is part of the signed payload — rebuild it the same way anchor()
+  // did (absent / null → "") so the bytes are byte-identical on a clean anchor.
+  var prevTipHash = (a.prevTipHash != null && typeof a.prevTipHash === "string") ? a.prevTipHash : "";
+  var payload = anchorPayload(Number(a.counter), a.tipHash, prevTipHash, Number(a.createdAt), format);
+  // Buffer.from(hex) silently truncates on non-hex / odd-length; reject when
+  // the parsed bytes don't round-trip to the original lowercased hex.
+  var sigBuf = Buffer.from(a.signature, "hex");
+  if (sigBuf.toString("hex") !== String(a.signature).toLowerCase()) {
+    return { ok: false, reason: "anchor signature is not valid hex" };
+  }
+  if (!verify(payload, sigBuf, pub)) {
+    return { ok: false, reason: "post-quantum signature failed" };
+  }
+  return { ok: true };
+}
+
+/**
+ * @primitive  b.auditSign.verifyAnchor
+ * @signature  b.auditSign.verifyAnchor(anchor)
+ * @since      0.15.13
+ * @status     stable
+ * @compliance hipaa, pci-dss, gdpr, soc2, sox-404
+ * @related    b.auditSign.anchor, b.auditSign.verifyAnchorChain
+ *
+ * Verify a single anchor produced by `b.auditSign.anchor`. Resolves the public
+ * key by the anchor's recorded fingerprint (live key or a rotated-out key from
+ * the unsealed history), rebuilds the canonical payload, and checks the
+ * post-quantum signature. Returns `{ ok: true }` when valid, or
+ * `{ ok: false, reason }` for a forgery, an unknown signing key, malformed hex,
+ * or a missing field. Never throws on adversarial content.
+ *
+ * @example
+ *   var a = b.auditSign.anchor({ counter: 1, tipHash: "ab12" });
+ *   b.auditSign.verifyAnchor(a);   // → { ok: true }
+ */
+function verifyAnchor(a) {
+  _requireInit();
+  return _verifyOneAnchor(a);
+}
+
+/**
+ * @primitive  b.auditSign.verifyAnchorChain
+ * @signature  b.auditSign.verifyAnchorChain(anchors, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @compliance hipaa, pci-dss, gdpr, soc2, sox-404
+ * @related    b.auditSign.anchor, b.auditSign.verifyAnchor, b.audit.verifyCheckpoints
+ *
+ * Walk an ordered array of anchors (oldest first) and verify each one's
+ * signature AND that the sequence is internally consistent: counters strictly
+ * increase, and each anchor's `prevTipHash` equals the previous anchor's
+ * `tipHash`. This catches the two attacks a single-anchor check cannot — a
+ * stored-anchor truncation / reorder (link break) and a full-chain rewrite
+ * (signature break). Returns `{ ok: true, anchorsVerified }`, or
+ * `{ ok: false, anchorsVerified, breakAt, reason }` at the first break.
+ *
+ * `requireLinkage` (default true) makes a non-genesis anchor that omits
+ * `prevTipHash` a break, so an attacker can't drop the link to bypass the
+ * check. Pass `requireLinkage: false` for unlinked anchors.
+ *
+ * @opts
+ *   requireLinkage: boolean,   // default true — every non-genesis anchor must carry a matching prevTipHash
+ *
+ * @example
+ *   var a1 = b.auditSign.anchor({ counter: 1, tipHash: "h1" });
+ *   var a2 = b.auditSign.anchor({ counter: 2, tipHash: "h2", prevTipHash: "h1" });
+ *   b.auditSign.verifyAnchorChain([a1, a2]);   // → { ok: true, anchorsVerified: 2 }
+ */
+function verifyAnchorChain(anchors, opts) {
+  _requireInit();
+  opts = opts || {};
+  var requireLinkage = opts.requireLinkage !== false;
+  if (!Array.isArray(anchors)) {
+    return { ok: false, anchorsVerified: 0, breakAt: 0, reason: "anchors must be an array" };
+  }
+  if (anchors.length === 0) return { ok: true, anchorsVerified: 0 };
+
+  var prev = null;
+  for (var i = 0; i < anchors.length; i += 1) {
+    var a = anchors[i];
+    var sigResult = _verifyOneAnchor(a);
+    if (!sigResult.ok) {
+      return { ok: false, anchorsVerified: i, breakAt: i, reason: sigResult.reason };
+    }
+    if (prev === null) {
+      // Genesis: a prevTipHash on the FIRST anchor means a predecessor was
+      // dropped — fail closed.
+      if (a.prevTipHash != null) {
+        return {
+          ok: false, anchorsVerified: i, breakAt: i,
+          reason: "non-genesis anchor missing predecessor (prevTipHash set on first anchor)",
+        };
+      }
+    } else {
+      if (!(Number(a.counter) > Number(prev.counter))) {
+        return {
+          ok: false, anchorsVerified: i, breakAt: i,
+          reason: "anchor counter not strictly increasing",
+        };
+      }
+      if (requireLinkage) {
+        if (a.prevTipHash == null) {
+          return {
+            ok: false, anchorsVerified: i, breakAt: i,
+            reason: "non-genesis anchor missing prevTipHash linkage",
+          };
+        }
+        if (a.prevTipHash !== prev.tipHash) {
+          return {
+            ok: false, anchorsVerified: i, breakAt: i,
+            reason: "anchor prevTipHash does not match the previous tipHash (truncation / reorder)",
+          };
+        }
+      }
+    }
+    prev = a;
+  }
+  return { ok: true, anchorsVerified: anchors.length };
+}
+
 function _resetForTest() {
   keys = null;
   initialized = false;
@@ -810,6 +1065,9 @@ module.exports = {
   init:                     init,
   sign:                     sign,
   verify:                   verify,
+  anchor:                   anchor,
+  verifyAnchor:             verifyAnchor,
+  verifyAnchorChain:        verifyAnchorChain,
   rotateSigningKey:         rotateSigningKey,
   reSignAll:                reSignAll,
   getPublicKey:             getPublicKey,

package/lib/audit-tools.js

@@ -58,6 +58,7 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var pkg = require("../package.json");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
 var auditChain = require("./audit-chain");
 var canonicalJson = require("./canonical-json");
 var auditSign = require("./audit-sign");
@@ -349,6 +350,12 @@ async function _defaultReadPredecessorRowHash(firstCounter) {
 async function _buildBundle(args) {
   var kind         = args.kind;
   var rows         = args.rows;
+  // Verification witnesses: the rows between the purgeable slice's tip and
+  // the covering checkpoint's anchored counter. They ride the bundle so the
+  // chain can be walked up to the SIGNED atRowHash, but they are NOT part of
+  // the purgeable range (the manifest range below is computed from `rows`,
+  // and purge() only deletes [first..lastCounter]).
+  var witnessRows  = args.witnessRows || [];
   var checkpoint   = args.checkpoint || null;
   var passphrase   = args.passphrase;
   var predecessorRowHash = args.predecessorRowHash;
@@ -357,8 +364,9 @@ async function _buildBundle(args) {
   var lastRow  = rows[rows.length - 1];
   var files = {};
 
-  // 1. Encrypt the rows JSONL
-  var jsonl = rows.map(function (r) {
+  // 1. Encrypt the rows JSONL — purgeable slice followed by any witnesses
+  // (contiguous, ascending) so the verifier walks one unbroken chain.
+  var jsonl = rows.concat(witnessRows).map(function (r) {
     return JSON.stringify(_rowToWireForm(r));
   }).join("\n") + "\n";
   var rowsEnc = await backupCrypto.encryptWithFreshSalt(jsonl, passphrase);
@@ -437,26 +445,39 @@ async function _readBundle(inDir, passphrase) {
       "bundle directory does not exist: " + inDir);
   }
   var manifestPath = nodePath.join(inDir, "manifest.json");
-  if (!nodeFs.existsSync(manifestPath)) {
-    throw new AuditToolsError("audit-tools/no-manifest",
-      "manifest.json missing in " + inDir);
-  }
-  var manifest = safeJson.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+  // Capped fd-bound read (no existsSync check-then-read window): an externally-
+  // supplied bundle manifest is parsed before verification, so an oversized
+  // manifest.json would OOM the verifier before safeJson sees it. 4 MiB is far
+  // above any real manifest.
+  var manifest = safeJson.parse(atomicFile.fdSafeReadSync(manifestPath, {
+    maxBytes: C.BYTES.mib(4), encoding: "utf8",
+    errorFor: function (kind, detail) {
+      if (kind === "enoent") return new AuditToolsError("audit-tools/no-manifest", "manifest.json missing in " + inDir);
+      if (kind === "too-large") return new AuditToolsError("audit-tools/bad-format", "manifest.json too large (" + detail.size + " > " + detail.max + ")");
+      return new AuditToolsError("audit-tools/bad-format", "manifest.json unreadable: " + kind);
+    },
+  }), { maxBytes: C.BYTES.mib(4) });
   if (!manifest || manifest.format !== BUNDLE_FORMAT) {
     throw new AuditToolsError("audit-tools/bad-format",
       "manifest.format is not " + BUNDLE_FORMAT);
   }
-  if (!VALID_KINDS[manifest.kind]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_KINDS, manifest.kind)) {
     throw new AuditToolsError("audit-tools/bad-kind",
       "manifest.kind must be one of " + Object.keys(VALID_KINDS).join(", "));
   }
 
   var rowsEncPath = nodePath.join(inDir, frameworkFiles.fileName("rowsEnc"));
-  if (!nodeFs.existsSync(rowsEncPath)) {
-    throw new AuditToolsError("audit-tools/no-rows-blob",
-      "rows.enc missing in " + inDir);
-  }
-  var rowsEnc = nodeFs.readFileSync(rowsEncPath);
+  // Capped fd-bound read: rows.enc is the PQC-encrypted archived audit slice
+  // (can be large); a hostile multi-GB blob would be read + decrypted in memory
+  // before the checksum check. 512 MiB ceiling bounds it (opt-tunable).
+  var rowsEnc = atomicFile.fdSafeReadSync(rowsEncPath, {
+    maxBytes: C.BYTES.mib(512),
+    errorFor: function (kind) {
+      if (kind === "enoent") return new AuditToolsError("audit-tools/no-rows-blob", "rows.enc missing in " + inDir);
+      if (kind === "too-large") return new AuditToolsError("audit-tools/rows-too-large", "rows.enc exceeds the bundle size cap");
+      return new AuditToolsError("audit-tools/no-rows-blob", "rows.enc unreadable: " + kind);
+    },
+  });
   if (manifest.checksum && manifest.checksum.rowsSha3_512 &&
       backupCrypto.checksum(rowsEnc) !== manifest.checksum.rowsSha3_512) {
     throw new AuditToolsError("audit-tools/rows-checksum-mismatch",
@@ -470,11 +491,16 @@ async function _readBundle(inDir, passphrase) {
   var checkpoint = null;
   if (manifest.kind === KIND_ARCHIVE) {
     var ckptPath = nodePath.join(inDir, frameworkFiles.fileName("checkpointEnc"));
-    if (!nodeFs.existsSync(ckptPath)) {
-      throw new AuditToolsError("audit-tools/no-checkpoint-blob",
-        "checkpoint.enc missing in " + inDir + " (archive bundles must include the covering checkpoint)");
-    }
-    var ckptEnc = nodeFs.readFileSync(ckptPath);
+    // Capped fd-bound read: checkpoint.enc is a single PQC-encrypted
+    // audit_checkpoints row (a few KiB); 4 MiB bounds a hostile blob.
+    var ckptEnc = atomicFile.fdSafeReadSync(ckptPath, {
+      maxBytes: C.BYTES.mib(4),
+      errorFor: function (kind) {
+        if (kind === "enoent") return new AuditToolsError("audit-tools/no-checkpoint-blob", "checkpoint.enc missing in " + inDir + " (archive bundles must include the covering checkpoint)");
+        if (kind === "too-large") return new AuditToolsError("audit-tools/checkpoint-too-large", "checkpoint.enc exceeds the cap");
+        return new AuditToolsError("audit-tools/no-checkpoint-blob", "checkpoint.enc unreadable: " + kind);
+      },
+    });
     if (manifest.checksum && manifest.checksum.checkpointSha3_512 &&
         backupCrypto.checksum(ckptEnc) !== manifest.checksum.checkpointSha3_512) {
       throw new AuditToolsError("audit-tools/checkpoint-checksum-mismatch",
@@ -562,10 +588,31 @@ async function archive(opts) {
 
   var predecessorRowHash = await readPredecessorHash(firstCounter);
 
+  // The signed checkpoint is the bundle's only unforgeable anchor; it commits
+  // the row at checkpoint.atMonotonicCounter. When that counter sits BEYOND
+  // the purgeable slice's tip (the operator archived a subset older than the
+  // last checkpoint), carry the in-between rows as verification witnesses so
+  // verifyBundle can chain-walk up to the anchored row and bind atRowHash to
+  // it. Without them an attacker could pair any genuine high-counter
+  // checkpoint with a wholly fabricated slice. The witnesses are NOT purged.
+  var anchorCounter = Number(checkpoint.atMonotonicCounter);
+  var witnessRows = [];
+  if (anchorCounter > lastCounter) {
+    witnessRows = await readRows({ firstCounter: lastCounter + 1, lastCounter: anchorCounter });
+    var witnessTip = witnessRows.length ? Number(witnessRows[witnessRows.length - 1].monotonicCounter) : null;
+    if (witnessTip !== anchorCounter) {
+      throw new AuditToolsError("audit-tools/anchor-rows-missing",
+        "archive: covering checkpoint anchors counter=" + anchorCounter +
+        " but the rows up to it are not all available (read up to " + witnessTip +
+        ") — cannot prove the slice chains to the signed anchor");
+    }
+  }
+
   if (returnBytes) {
     var built = await _buildBundle({
       kind:       KIND_ARCHIVE,
       rows:       rows,
+      witnessRows: witnessRows,
       checkpoint: checkpoint,
       passphrase: opts.passphrase,
       predecessorRowHash: predecessorRowHash,
@@ -582,6 +629,7 @@ async function archive(opts) {
     outDir:     opts.out,
     kind:       KIND_ARCHIVE,
     rows:       rows,
+    witnessRows: witnessRows,
     checkpoint: checkpoint,
     passphrase: opts.passphrase,
     predecessorRowHash: predecessorRowHash,
@@ -769,26 +817,41 @@ async function verifyBundle(opts) {
     };
   }
 
-  // 2. Confirm the stored firstRowHash + lastRowHash match the slice
+  // 2. Confirm the stored firstRowHash + lastRowHash match the PURGEABLE
+  // slice boundary. The slice tip is the row at range.lastCounter — not
+  // necessarily the physical last row, which may be a verification witness
+  // carried past the slice so the chain can reach the signed checkpoint.
+  var lastCounterN = Number(read.manifest.range.lastCounter);
+  var sliceLastRow = null;
+  for (var ri = 0; ri < read.rows.length; ri++) {
+    if (Number(read.rows[ri].monotonicCounter) === lastCounterN) { sliceLastRow = read.rows[ri]; break; }
+  }
   if (read.rows[0].rowHash !== read.manifest.range.firstRowHash) {
     return {
       ok: false, kind: read.manifest.kind, rowsVerified: read.rows.length,
       reason: "manifest.range.firstRowHash does not match first row's rowHash",
     };
   }
-  if (read.rows[read.rows.length - 1].rowHash !== read.manifest.range.lastRowHash) {
+  if (!sliceLastRow || sliceLastRow.rowHash !== read.manifest.range.lastRowHash) {
     return {
       ok: false, kind: read.manifest.kind, rowsVerified: read.rows.length,
-      reason: "manifest.range.lastRowHash does not match last row's rowHash",
+      reason: "manifest.range.lastRowHash does not match the slice row at lastCounter",
     };
   }
 
-  // 3. (archive only) verify the covering checkpoint signature
+  // 3. (archive only) verify the covering checkpoint signature AND bind its
+  // anchored rowHash to the slice. The signature alone proves only that a
+  // checkpoint exists for some (counter, rowHash); without binding atRowHash
+  // to the archived rows, any genuine high-counter checkpoint could be paired
+  // with a wholly fabricated slice. The row at checkpoint.atMonotonicCounter
+  // must be present in the bundle (slice or witness) and its rowHash must
+  // equal checkpoint.atRowHash — mirroring b.audit.verifyCheckpoints against
+  // the live table.
   if (read.manifest.kind === KIND_ARCHIVE) {
     if (!read.checkpoint) {
       return { ok: false, kind: KIND_ARCHIVE, reason: "checkpoint missing from archive bundle" };
     }
-    if (Number(read.checkpoint.atMonotonicCounter) < Number(read.manifest.range.lastCounter)) {
+    if (Number(read.checkpoint.atMonotonicCounter) < lastCounterN) {
       return {
         ok: false, kind: KIND_ARCHIVE,
         reason: "checkpoint atMonotonicCounter (" + read.checkpoint.atMonotonicCounter +
@@ -805,6 +868,28 @@ async function verifyBundle(opts) {
         };
       }
     }
+    // Bind: the row the signature anchors must be in the bundle and match.
+    var anchorCounterN = Number(read.checkpoint.atMonotonicCounter);
+    var anchoredRow = null;
+    for (var ai = 0; ai < read.rows.length; ai++) {
+      if (Number(read.rows[ai].monotonicCounter) === anchorCounterN) { anchoredRow = read.rows[ai]; break; }
+    }
+    if (!anchoredRow) {
+      return {
+        ok: false, kind: KIND_ARCHIVE,
+        reason: "checkpoint anchors counter=" + anchorCounterN +
+                " but no such row is present in the bundle — checkpoint not bound to the archived slice",
+      };
+    }
+    if (anchoredRow.rowHash !== read.checkpoint.atRowHash) {
+      return {
+        ok: false, kind: KIND_ARCHIVE,
+        reason: "checkpoint atRowHash does not match the bundle row at counter=" + anchorCounterN +
+                " — the signed anchor does not bind this slice",
+        expected: read.checkpoint.atRowHash,
+        actual:   anchoredRow.rowHash,
+      };
+    }
   }
 
   return {

package/lib/audit.js

@@ -424,6 +424,13 @@ var FRAMEWORK_NAMESPACES = [
   "bootgates",        // b.bootGates (bootgates.passed / bootgates.failed / bootgates.onfail_threw — boot-invariant runner)
   "metrics",          // b.metrics.snapshot.shadowRegistry (metrics.shadow.cardinality_dropped — namespaced metrics export)
   "jose",             // b.jose.jwe.experimental (jose.jwe.experimental.encrypt / .decrypt — ML-KEM-JWE pre-IANA)
+  "ai",               // b.ai.adverseDecision (ai.adverse_decision.* — FCRA adverse-action decisioning)
+  "breach",           // b.breachDeadline (breach.report.* — breach-notification deadline clock)
+  "cra",              // b.craReport (cra.report.* — EU Cyber Resilience Act conformity)
+  "gdpr",             // b.gdprRopa (gdpr.ropa.* — GDPR Art. 30 Records of Processing Activities)
+  "incident",         // b.incidentReport (incident.report.* — incident lifecycle)
+  "middleware",       // b.middleware.ageGate / dailyByteQuota (middleware.age_gate.* / middleware.daily_byte_quota.*)
+  "nis2",             // b.nis2Report (nis2.report.* — NIS2 Directive incident reporting)
 ];
 var registeredNamespaces = new Set(FRAMEWORK_NAMESPACES);
 
@@ -790,7 +797,12 @@ async function query(criteria) {
   if (criteria.resourceKind)    q = q.where({ resourceKind: criteria.resourceKind });
   if (criteria.outcome)         q = q.where({ outcome: criteria.outcome });
 
-  q.orderBy("monotonicCounter", "asc");
+  // order: "asc" (default, chronological) | "desc" (newest-first). A capped
+  // query (limit set) returns the FIRST `limit` rows in this order — so a
+  // consumer that wants the most RECENT events under a cap (e.g. the daily
+  // review) must pass order:"desc", else `limit` keeps the OLDEST and drops the
+  // newest events in the window.
+  q.orderBy("monotonicCounter", criteria.order === "desc" ? "desc" : "asc");
   if (criteria.limit  != null)  q.limit(criteria.limit);
   if (criteria.offset != null)  q.offset(criteria.offset);
 
@@ -827,7 +839,7 @@ async function _queryCluster(criteria) {
   if (criteria.resourceKind) qb.where("resourceKind", criteria.resourceKind);
   if (criteria.outcome)      qb.where("outcome", criteria.outcome);
 
-  qb.orderBy("monotonicCounter", "asc");
+  qb.orderBy("monotonicCounter", criteria.order === "desc" ? "desc" : "asc");
   if (criteria.limit  != null) qb.limit(criteria.limit);
   if (criteria.offset != null) qb.offset(criteria.offset);
 
@@ -944,6 +956,13 @@ async function checkpoint(opts) {
   cluster.requireLeader();
   opts = opts || {};
 
+  // Bind this checkpoint to the database it reads the tip from. checkpoint()
+  // spans async boundaries (tip read → sign → insert); a fire-and-forget call
+  // launched by db.close() can have its insert resume AFTER the database it
+  // read closed and a fresh one opened, anchoring the old tip into the wrong
+  // database. Capture the live db generation now and re-check before the write.
+  var dbGenAtEntry = db()._dbGeneration();
+
   var tipReadBuilt = sql.select("audit_log", _sqlOpts())
     .columns(["_id", "monotonicCounter", "rowHash"])
     .orderBy("monotonicCounter", "desc")
@@ -972,6 +991,12 @@ async function checkpoint(opts) {
   var signature = auditSign.sign(payload);
   var pubFp = auditSign.getPublicKeyFingerprint();
 
+  // Fail closed if the database changed under us between the tip read and here
+  // (e.g. a close()-launched checkpoint resuming after a fresh db opened). The
+  // tip we signed belongs to a database that is gone; anchoring it into the
+  // current one would forge a checkpoint. Write nothing.
+  if (db()._dbGeneration() !== dbGenAtEntry) return null;
+
   var ckptId = generateToken(TRACE_ID_BYTES);
   var fencingToken = cluster.fencingToken();
   await _insertCheckpoint(
@@ -1445,6 +1470,69 @@ function safeEmit(event) {
   } catch (_e) { /* audit best-effort — never break the caller */ }
 }
 
+/**
+ * @primitive b.audit.namespaced
+ * @signature b.audit.namespaced(prefix, opts?)
+ * @since     0.15.13
+ * @status    stable
+ * @compliance hipaa, pci-dss, gdpr, soc2
+ * @related   b.audit.safeEmit, b.audit.emit, b.observability.namespaced
+ *
+ * Build a drop-silent emitter bound to one action namespace — the shape every
+ * framework primitive hand-rolled as a private `_emitAudit(action, outcome,
+ * metadata)` closure (or inline) (`if (!on) return; try { safeEmit({ action:
+ * "ns." + action, outcome, metadata }); } catch {}`). The returned function
+ * prefixes `action` with `prefix + "."`, fills `metadata` with `{}` when
+ * omitted, and routes through `safeEmit` (so the same redaction + outcome
+ * normalization applies).
+ *
+ * Every caller drives the SAME 4-argument emitter `(action, outcome, metadata,
+ * extra?)`: `extra` is an object whose fields are merged onto the event, which
+ * carries the only per-emit variations seen across the framework — `actor`
+ * (constant `{ type: "system" }` for an unattended worker, or a per-request
+ * `ctx.actor`) and `resource`. So a hand-rolled emitter with extra event fields
+ * is never an exception — pass them through `extra`. `opts` is the gate flag for
+ * the common case OR `{ audit, sink }`, where `sink` emits to an
+ * operator-supplied audit object instead of the framework chain (the emitter is
+ * a no-op if that sink has no `safeEmit`, matching the hand-rolled sink guard).
+ *
+ * A falsy `prefix` (`null` / `""`) builds the no-namespace variant: `action`
+ * passes through verbatim (no `prefix + "."`). This serves the primitives whose
+ * audit actions are already fully-qualified at the call site (`emitAudit(
+ * "system.outbox.started", …)`) — the same gated drop-silent passthrough,
+ * without re-homing the qualifier.
+ *
+ * @opts
+ *   audit:  boolean,   // false disables the emitter (default on); passing a bare boolean === { audit }
+ *   sink:   object,    // alternate audit target with a .safeEmit(event) (defaults to b.audit)
+ *
+ * @example
+ *   var emitAudit = b.audit.namespaced("gdpr.ropa", opts.audit);
+ *   emitAudit("activity_added", "success", { activityId: id });
+ *   // → safeEmit({ action: "gdpr.ropa.activity_added", outcome: "success",
+ *   //             metadata: { activityId: id } })
+ *
+ *   var emitGate = b.audit.namespaced("guardSql.gate");
+ *   emitGate("refused", "denied", { route: r }, { actor: ctx.actor });  // per-call actor
+ */
+function namespaced(prefix, opts) {
+  // Back-compat: a bare boolean/undefined is the gate; an object carries the
+  // gate plus the sink axis.
+  var cfg = (opts && typeof opts === "object") ? opts : { audit: opts };
+  var on = cfg.audit !== false;
+  return function (action, outcome, metadata, extra) {
+    if (!on) return;
+    // module.exports.safeEmit (late-bound) so a test that stubs b.audit.safeEmit
+    // still observes the emit; cfg.sink routes to an operator-supplied audit
+    // object (no-op if it lacks safeEmit, matching the hand-rolled sink guard).
+    var sink = cfg.sink || module.exports;
+    if (!sink || typeof sink.safeEmit !== "function") return;
+    var evt = { action: prefix ? prefix + "." + action : action, outcome: outcome, metadata: metadata || {} };
+    if (extra) { for (var k in extra) { if (Object.prototype.hasOwnProperty.call(extra, k)) evt[k] = extra[k]; } }
+    try { sink.safeEmit(evt); } catch (_e) { /* drop-silent — audit is best-effort */ }
+  };
+}
+
 /**
  * @primitive b.audit.flush
  * @signature b.audit.flush()
@@ -1814,6 +1902,7 @@ module.exports = {
   useStore:             useStore,
   emit:                 emit,
   safeEmit:             safeEmit,
+  namespaced:           namespaced,
   applyPosture:         applyPosture,
   activePosture:        activePosture,
   bindActor:            bindActor,