@cosmicdrift/kumiko-framework 0.145.1 → 0.146.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.145.1",
+  "version": "0.146.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -189,7 +189,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.145.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.146.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/__tests__/event-store-executor.integration.test.ts

@@ -124,17 +124,18 @@ describe("event-store-executor", () => {
   });
 });
 
-// Sensitive-field stripping: passwords/tokens/IBANs stay in the entity row
-// but MUST NOT land in the immutable event log (GDPR right-to-be-forgotten,
-// secrets-rotation, audit discoverability). Fields marked `sensitive: true`
-// are excluded from every event payload: create data, update changes,
-// update previous, delete previous, restore previous.
+// Sensitive fields (#967): passwords/tokens/IBANs must be ciphertext-at-rest
+// (boot validates sensitive ⇒ pii | encrypted). The event log carries the
+// table ciphertext — replay reproduces the row byte-identically. Plaintext
+// never lands in permanent history; the caller-facing event echo strips the
+// field entirely (#820).
+const SENSITIVE_TEST_KEY = Buffer.from("s3nS!t1vE.kP9xQ2@wN!vL$hR5yT8eU0").toString("base64");
 const sensitiveEntity = createEntity({
   table: "read_es_exec_sensitive",
   fields: {
     email: createTextField({ required: true }),
-    passwordHash: createTextField({ sensitive: true }),
-    apiToken: createTextField({ sensitive: true }),
+    passwordHash: createTextField({ sensitive: true, encrypted: true }),
+    apiToken: createTextField({ sensitive: true, encrypted: true }),
   },
   softDelete: true,
 });
@@ -143,6 +144,7 @@ const sensitiveTable = buildEntityTable("esExecSensitive", sensitiveEntity);
 describe("event-store-executor — sensitive fields", () => {
   const crud = createEventStoreExecutor(sensitiveTable, sensitiveEntity, {
     entityName: "esExecSensitive",
+    encryption: createTestEnvelopeCipher(SENSITIVE_TEST_KEY),
   });
 
   beforeAll(async () => {
@@ -172,26 +174,35 @@ describe("event-store-executor — sensitive fields", () => {
     };
   }
 
-  test("create event payload excludes sensitive fields but entity row keeps them", async () => {
+  test("create event payload carries sensitive fields as table ciphertext; echo strips them", async () => {
     const result = await crud.create(
       { email: "s@test.de", passwordHash: "pw-hash-123", apiToken: "tok-abc" },
       adminUser,
       tdb,
     );
     if (!result.isSuccess) throw new Error("create failed");
-    // Entity row: full data preserved.
+    // Caller-facing row: plaintext preserved.
     expect(result.data.data["passwordHash"]).toBe("pw-hash-123");
     expect(result.data.data["apiToken"]).toBe("tok-abc");
 
-    // Event payload: sensitive stripped, public retained.
+    // Event payload: ciphertext, byte-identical to the table column (#967).
     const event = await lastEvent();
     expect(event.type).toBe("esExecSensitive.created");
     expect(event.payload["email"]).toBe("s@test.de");
-    expect(event.payload["passwordHash"]).toBeUndefined();
-    expect(event.payload["apiToken"]).toBeUndefined();
+    expect(event.payload["passwordHash"]).toBeDefined();
+    expect(event.payload["passwordHash"]).not.toBe("pw-hash-123");
+    const rawRows = (await asRawClient(testDb.db).unsafe(
+      `SELECT password_hash FROM read_es_exec_sensitive WHERE email = 's@test.de' LIMIT 1`,
+    )) as Array<{ password_hash: string }>;
+    expect(event.payload["passwordHash"]).toBe(rawRows[0]!.password_hash);
+
+    // Caller-facing event echo stays stripped (#820).
+    if (!result.data.event) throw new Error("no event echo");
+    expect(result.data.event.payload["passwordHash"]).toBeUndefined();
+    expect(result.data.event.payload["apiToken"]).toBeUndefined();
   });
 
-  test("update event strips sensitive from BOTH changes and previous", async () => {
+  test("update event carries ciphertext in BOTH changes and previous", async () => {
     const created = await crud.create(
       { email: "u@test.de", passwordHash: "old-hash", apiToken: "old-tok" },
       adminUser,
@@ -215,16 +226,29 @@ describe("event-store-executor — sensitive fields", () => {
       previous: { email?: string; passwordHash?: string; apiToken?: string };
     }>();
     expect(event.type).toBe("esExecSensitive.updated");
-    // Changes: email retained (public), passwordHash stripped.
+    // Changes: email plaintext (public), passwordHash ciphertext.
     expect(event.payload.changes.email).toBe("u2@test.de");
-    expect(event.payload.changes.passwordHash).toBeUndefined();
-    // Previous: email retained, passwordHash + apiToken stripped.
+    expect(event.payload.changes.passwordHash).toBeDefined();
+    expect(event.payload.changes.passwordHash).not.toBe("new-hash");
+    // Previous: email plaintext, passwordHash + apiToken ciphertext.
     expect(event.payload.previous.email).toBe("u@test.de");
-    expect(event.payload.previous.passwordHash).toBeUndefined();
-    expect(event.payload.previous.apiToken).toBeUndefined();
+    expect(event.payload.previous.passwordHash).toBeDefined();
+    expect(event.payload.previous.passwordHash).not.toBe("old-hash");
+    expect(event.payload.previous.apiToken).toBeDefined();
+    expect(event.payload.previous.apiToken).not.toBe("old-tok");
+
+    // Caller-facing event echo stays stripped (#820).
+    if (!result.data.event) throw new Error("no event echo");
+    const echoPayload = result.data.event.payload as {
+      changes: Record<string, unknown>;
+      previous: Record<string, unknown>;
+    };
+    expect(echoPayload.changes["passwordHash"]).toBeUndefined();
+    expect(echoPayload.previous["passwordHash"]).toBeUndefined();
+    expect(echoPayload.previous["apiToken"]).toBeUndefined();
   });
 
-  test("delete event strips sensitive from previous", async () => {
+  test("delete event carries ciphertext in previous", async () => {
     const created = await crud.create(
       { email: "d@test.de", passwordHash: "pw", apiToken: "tk" },
       adminUser,
@@ -240,11 +264,13 @@ describe("event-store-executor — sensitive fields", () => {
     const event = await lastEvent<SensitivePrevious>();
     expect(event.type).toBe("esExecSensitive.deleted");
     expect(event.payload.previous.email).toBe("d@test.de");
-    expect(event.payload.previous.passwordHash).toBeUndefined();
-    expect(event.payload.previous.apiToken).toBeUndefined();
+    expect(event.payload.previous.passwordHash).toBeDefined();
+    expect(event.payload.previous.passwordHash).not.toBe("pw");
+    expect(event.payload.previous.apiToken).toBeDefined();
+    expect(event.payload.previous.apiToken).not.toBe("tk");
   });
 
-  test("restore event strips sensitive from previous", async () => {
+  test("restore event carries ciphertext in previous", async () => {
     const created = await crud.create(
       { email: "r@test.de", passwordHash: "pw", apiToken: "tk" },
       adminUser,
@@ -261,8 +287,10 @@ describe("event-store-executor — sensitive fields", () => {
     const event = await lastEvent<SensitivePrevious>();
     expect(event.type).toBe("esExecSensitive.restored");
     expect(event.payload.previous.email).toBe("r@test.de");
-    expect(event.payload.previous.passwordHash).toBeUndefined();
-    expect(event.payload.previous.apiToken).toBeUndefined();
+    expect(event.payload.previous.passwordHash).toBeDefined();
+    expect(event.payload.previous.passwordHash).not.toBe("pw");
+    expect(event.payload.previous.apiToken).toBeDefined();
+    expect(event.payload.previous.apiToken).not.toBe("tk");
   });
 });
 

package/src/db/__tests__/implicit-projection-equivalence.integration.test.ts

@@ -15,7 +15,7 @@
 //   5. Snapshot erneut nehmen
 //   6. deep-equal: identische Rows in identischer Reihenfolge
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { createBooleanField, createEntity, createTextField, defineFeature } from "../../engine";
 import { createRegistry } from "../../engine/registry";
@@ -222,26 +222,33 @@ describe("implicit-projection / Live==Rebuild equivalence", () => {
   });
 });
 
-// Sensitive-Drift ist eine bekannte Welle-3-Lücke: das Event-Log strippt
-// sensitive-Felder VOR dem Append (GDPR-Annahme), die Live-Read-Tabelle
-// bekommt sie über den unstripped flatData, der Rebuild-Pfad nur den
-// stripped event.payload. Bei Schema-Rebuilds gehen sensitive Daten
-// verloren.
-//
-// Dieser Test pinst die Drift explizit: Live row hat das sensitive Feld,
-// Rebuild row hat NULL. Wenn Welle 3 das fixt (z.B. via separater
-// sensitive-Spalte oder verschlüsseltem Event-Payload), bricht der Test
-// und zwingt zu Aufmerksamkeit.
-
+// Sensitive-Rebuild-Parität (#967): das Event-Log trägt für sensitive-Felder
+// den Tabellen-Ciphertext (boot-validiert pii/encrypted) — Live==Rebuild gilt
+// damit auch für sensitive Spalten + Blind-Index. Einzige legitime Divergenz
+// bleibt Crypto-Shredding: DEK erased → bidx NULL, Wert unlesbar.
+
+import {
+  computeBlindIndex,
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  decodeBlindIndexKey,
+  decryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "../../crypto";
 import { asRawClient, selectMany } from "../../db/query";
 
 const sensitiveTable = "read_implicit_sensitive_users";
+const SENSITIVE_BIDX_KEY_B64 = Buffer.alloc(32, 9).toString("base64");
+const SENSITIVE_BIDX_KEY = decodeBlindIndexKey(SENSITIVE_BIDX_KEY_B64);
 
 const sensitiveEntity = createEntity({
   table: sensitiveTable,
   fields: {
     email: createTextField({ required: true }),
-    apiKey: createTextField({ sensitive: true }),
+    apiKey: createTextField({ sensitive: true, pii: true, lookupable: true }),
   },
 });
 
@@ -250,8 +257,11 @@ const sensitiveFeature = defineFeature("implicitsensitive", (r) => {
 });
 
 const sensitiveEntityTable = buildEntityTable("sensitive-user", sensitiveEntity);
+const sensitiveProjection = "implicitsensitive:projection:sensitive-user-entity";
+
+describe("implicit-projection / sensitive Rebuild-Parität (#967)", () => {
+  let kms: InMemoryKmsAdapter;
 
-describe("implicit-projection / dokumentierte Sensitive-Drift", () => {
   beforeAll(async () => {
     await unsafeCreateEntityTable(testDb.db, sensitiveEntity, "sensitive-user");
   });
@@ -260,29 +270,46 @@ describe("implicit-projection / dokumentierte Sensitive-Drift", () => {
     await asRawClient(testDb.db).unsafe(
       `TRUNCATE ${sensitiveTable}, kumiko_events, kumiko_projections RESTART IDENTITY CASCADE`,
     );
+    kms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(kms);
+    configureBlindIndexKey(SENSITIVE_BIDX_KEY_B64);
   });
 
-  test("Live schreibt sensitive-Felder, Rebuild lässt sie NULL (Welle-3-Roadmap)", async () => {
-    const crud = createEventStoreExecutor(sensitiveEntityTable, sensitiveEntity, {
-      entityName: "sensitive-user",
-    });
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+    resetBlindIndexKeyForTests();
+  });
 
-    // 1. Live: create mit apiKey (sensitive). Read-Tabelle bekommt den
-    //    Wert direkt vom Live-Pfad (unstripped flatData).
+  const crud = createEventStoreExecutor(sensitiveEntityTable, sensitiveEntity, {
+    entityName: "sensitive-user",
+  });
+
+  async function rawSensitiveRow(id: string): Promise<Record<string, unknown>> {
+    const rows = await asRawClient(testDb.db).unsafe<Record<string, unknown>>(
+      `SELECT * FROM ${sensitiveTable} WHERE id = $1`,
+      [id],
+    );
+    const row = rows[0];
+    if (!row) throw new Error(`no row for ${id}`);
+    return row;
+  }
+
+  test("Live==Rebuild inkl. sensitive-Ciphertext + bidx (byte-gleiche Kopie aus dem Event)", async () => {
     const created = await crud.create(
       { email: "x@test.de", apiKey: "secret-token-abc" },
       adminUser,
       tdb,
     );
     if (!created.isSuccess) throw new Error("setup failed");
+    const id = String(created.data.id);
 
-    const [liveRow] = await selectMany(testDb.db, sensitiveEntityTable, {
-      id: created.data.id as string,
-    });
-    expect(liveRow?.["apiKey"]).toBe("secret-token-abc");
-    expect(liveRow?.["email"]).toBe("x@test.de");
+    // Live-Row: Ciphertext + bidx, nie Klartext.
+    const liveRow = await rawSensitiveRow(id);
+    const liveCipher = liveRow["api_key"];
+    expect(isPiiCiphertext(liveCipher)).toBe(true);
+    expect(liveRow["api_key_bidx"]).toBe(computeBlindIndex(SENSITIVE_BIDX_KEY, "secret-token-abc"));
 
-    // 2. Verifiziere dass das Event-Log das Feld NICHT enthält (stripped).
+    // Event-Payload trägt exakt den Tabellen-Ciphertext (byte-gleich).
     const { eventsTable } = await import("../../event-store");
     const [event] = await selectMany(
       testDb.db,
@@ -290,23 +317,75 @@ describe("implicit-projection / dokumentierte Sensitive-Drift", () => {
       { aggregateId: created.data.id },
       { orderBy: { col: "version", direction: "asc" } },
     );
-    expect(event?.payload?.["apiKey"]).toBeUndefined();
+    expect(event?.payload?.["apiKey"]).toBe(liveCipher);
     expect(event?.payload?.["email"]).toBe("x@test.de");
+    expect(JSON.stringify(event?.payload)).not.toContain("secret-token-abc");
 
-    // 3. Rebuild über die ImplicitProjection. Read-Tabelle wird aus
-    //    event.payload neu materialisiert — apiKey ist nicht im Log,
-    //    landet also als NULL/undefined in der rebuilt Row.
     const registry = createRegistry([sensitiveFeature]);
-    await rebuildProjection("implicitsensitive:projection:sensitive-user-entity", {
-      db: testDb.db,
-      registry,
-    });
+    await rebuildProjection(sensitiveProjection, { db: testDb.db, registry });
+
+    const rebuiltRow = await rawSensitiveRow(id);
+    expect(rebuiltRow["email"]).toBe("x@test.de");
+    expect(rebuiltRow["api_key"]).toBe(liveCipher);
+    expect(rebuiltRow["api_key_bidx"]).toBe(liveRow["api_key_bidx"]);
+  });
 
-    const [rebuiltRow] = await selectMany(testDb.db, sensitiveEntityTable, {
-      id: created.data.id as string,
+  test("DEK-Stabilität: Update re-encryptet mit demselben Subject-DEK — alter Event-Ciphertext bleibt lesbar", async () => {
+    const created = await crud.create(
+      { email: "y@test.de", apiKey: "first-secret" },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("setup failed");
+    const updated = await crud.update(
+      { id: created.data.id, version: 1, changes: { apiKey: "second-secret" } },
+      adminUser,
+      tdb,
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+
+    // Created-Event (v1-Ciphertext) muss mit dem aktuellen DEK lesbar bleiben —
+    // eine DEK-Rotation beim Update würde das immutable Log unlesbar machen.
+    const { eventsTable } = await import("../../event-store");
+    const [createdEvent] = await selectMany(
+      testDb.db,
+      eventsTable,
+      { aggregateId: created.data.id },
+      { orderBy: { col: "version", direction: "asc" } },
+    );
+    const v1Cipher = createdEvent?.payload?.["apiKey"];
+    expect(isPiiCiphertext(v1Cipher)).toBe(true);
+    const decrypted = await decryptPiiFieldValues({ apiKey: v1Cipher }, ["apiKey"], kms, {
+      requestId: "test",
     });
-    expect(rebuiltRow?.["email"]).toBe("x@test.de");
-    // DAS ist die Drift: sensitive Feld ist nach Rebuild weg.
-    expect(rebuiltRow?.["apiKey"]).toBeNull();
+    expect(decrypted["apiKey"]).toBe("first-secret");
+
+    // Rebuild spielt created+updated: bidx-Recompute entschlüsselt beide
+    // Ciphertexte — schlägt bei rotiertem DEK fehl statt still zu heilen.
+    const registry = createRegistry([sensitiveFeature]);
+    await rebuildProjection(sensitiveProjection, { db: testDb.db, registry });
+    const rebuiltRow = await rawSensitiveRow(String(created.data.id));
+    expect(rebuiltRow["api_key_bidx"]).toBe(computeBlindIndex(SENSITIVE_BIDX_KEY, "second-secret"));
+  });
+
+  test("Erase-Divergenz bleibt die einzige legitime: DEK erased → Rebuild bidx NULL, Wert unlesbar", async () => {
+    const created = await crud.create(
+      { email: "z@test.de", apiKey: "gone-after-forget" },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("setup failed");
+    const id = String(created.data.id);
+
+    await kms.eraseKey({ kind: "user", userId: id });
+
+    const registry = createRegistry([sensitiveFeature]);
+    await rebuildProjection(sensitiveProjection, { db: testDb.db, registry });
+
+    const rebuiltRow = await rawSensitiveRow(id);
+    expect(rebuiltRow["api_key_bidx"]).toBeNull();
+    // Ciphertext-Bytes werden kopiert, sind aber ohne DEK unlesbar.
+    expect(isPiiCiphertext(rebuiltRow["api_key"])).toBe(true);
+    expect(rebuiltRow["api_key"]).not.toBe("gone-after-forget");
   });
 });

package/src/db/apply-entity-event.ts

@@ -1,22 +1,18 @@
 // applyEntityEvent — die EINZIGE Schreib-Logik für r.entity-Tabellen aus
 // Stored-Events. Beide Aufrufer benutzen sie:
 //
-//   - createEventStoreExecutor (live, im Write-TX) — übergibt ein
-//     "live event" mit unstripped flatData/flatChanges als payload damit
-//     sensitive Felder in der Read-Tabelle landen, das Event-Log selbst
-//     bleibt aber stripped (siehe append-Site im Executor).
+//   - createEventStoreExecutor (live, im Write-TX) — übergibt das gerade
+//     appendete StoredEvent direkt; sensitive Felder liegen als Tabellen-
+//     Ciphertext im Payload (boot-validiert pii/encrypted, #967).
 //   - rebuildProjection via ImplicitProjection (replay, im Rebuild-TX) —
-//     übergibt das StoredEvent direkt; payload ist dort ohne sensitive,
-//     was bei Rebuild akzeptiert wird (sensitive-Drift durch GDPR-Strip
-//     ist als load-bearing Backlog-Item gepinnt — siehe
-//     docs/plans/architecture/migrations.md Sektion "Backlog (Welle 3+)"
-//     → "Sensitive-Field-Persistenz im Rebuild" für Optionen a/b/c).
+//     übergibt dasselbe StoredEvent; apply kopiert Ciphertext byte-gleich
+//     zurück, bidx wird unten neu berechnet.
 //
-// Live==Rebuild-Equivalence ist damit by-construction für alle Felder
-// die NICHT als sensitive markiert sind — eine geänderte Schreib-Logik
-// muss nur an EINER Stelle gepflegt werden, kein Sync-Contract mehr.
-// Der load-bearing Test bleibt für non-sensitive-Drift in
-// db/__tests__/implicit-projection-equivalence.integration.ts.
+// Live==Rebuild-Equivalence ist damit by-construction für ALLE Felder —
+// eine geänderte Schreib-Logik muss nur an EINER Stelle gepflegt werden,
+// kein Sync-Contract mehr. Einzige legitime Divergenz: Crypto-Shredding
+// (DEK erased → Wert unlesbar, bidx NULL). Load-bearing Test:
+// db/__tests__/implicit-projection-equivalence.integration.test.ts.
 //
 // Tenant-Isolation: applyEntityEvent erwartet einen rohen DbRunner (TX
 // oder pool), KEINEN TenantDb-Wrapper. Schutz kommt aus zwei Quellen:

package/src/db/event-store-executor.ts

@@ -304,11 +304,10 @@ export function createEventStoreExecutor(
     if (def !== undefined) fieldDefaults[name] = def;
   }
 
-  // Pre-compute the set of sensitive field names once. Every event payload
-  // (create data, update changes + previous, delete previous, restore
-  // previous) strips these before writing to the immutable event log. Keeps
-  // GDPR right-to-be-forgotten tractable — only entity rows hold the
-  // sensitive data, and entity rows can be deleted / re-encrypted.
+  // Pre-compute the set of sensitive field names once. The event log stores
+  // these fields as table ciphertext (boot validates sensitive ⇒ pii |
+  // encrypted, #967) — the set only strips the caller-facing event echo so
+  // responses never carry the value (#820).
   const sensitiveFields = new Set<string>();
   for (const [name, field] of Object.entries(entity.fields)) {
     if ("sensitive" in field && field.sensitive === true) {
@@ -526,8 +525,9 @@ export function createEventStoreExecutor(
 
       // 1. Append event (same TX as the projection write — both must succeed
       //    or both roll back; the dispatcher wraps both in one transaction).
-      //    Sensitive fields are stripped from the event payload; the entity
-      //    row below still receives the full data.
+      //    flatData is already table ciphertext for pii/encrypted fields, so
+      //    the immutable log never sees plaintext and replay reproduces the
+      //    row byte-identically (#967).
       //
       //    `expectedVersion: 0` heißt: stream existiert noch nicht. Bei
       //    deterministic-aggregate-id-Patterns (z.B. uuidv5(tenantId|naturalKey))
@@ -542,7 +542,7 @@ export function createEventStoreExecutor(
           tenantId: streamTenantFor(user),
           expectedVersion: 0,
           type: entityEventName(entityName, "created"),
-          payload: stripSensitive(flatData),
+          payload: flatData,
           metadata: buildEventMetadata(user),
         });
       } catch (e) {
@@ -573,9 +573,8 @@ export function createEventStoreExecutor(
       }
 
       // 2. Update projection via applyEntityEvent — derselbe Code-Pfad den
-      //    rebuildProjection für Replay nutzt → Live==Rebuild by-construction.
-      //    Wir bauen ein "live event" mit unstripped flatData (damit sensitive
-      //    Felder in der Read-Tabelle landen, aber nicht im Event-Log).
+      //    rebuildProjection für Replay nutzt, mit demselben StoredEvent →
+      //    Live==Rebuild by-construction (#967).
       //
       //    F8-Patch: app-level unique-violations (z.B. (tenantId, email)
       //    auf User-Entity, (tenantId, slug) auf Article) werfen pg-23505
@@ -583,10 +582,9 @@ export function createEventStoreExecutor(
       //    unhandled exception → 500 internal_error. Map auf
       //    UniqueViolationError 409 damit Designer/Frontend einen sauberen
       //    "duplicate" zeigen können statt cryptic "internal server error".
-      const liveEvent = { ...event, payload: flatData };
       let result: Awaited<ReturnType<typeof applyEntityEvent>>;
       try {
-        result = await applyEntityEvent(liveEvent, table, entity, db.raw);
+        result = await applyEntityEvent(event, table, entity, db.raw);
       } catch (e) {
         const mapped = tryMapUniqueViolation(e, entityName);
         if (mapped) return mapped;
@@ -718,11 +716,10 @@ export function createEventStoreExecutor(
         // previous value to decrement/undo when a parent-FK moves — without it
         // you'd have to snapshot-and-diff on every apply, and replays would
         // break. Storage cost is acceptable (rows are bounded), correctness is
-        // not negotiable. Sensitive fields are stripped from BOTH halves so
-        // they never reach the immutable event log. `previous` came from
-        // loadById(), which decrypts — re-encrypt it before it's persisted so
-        // an `encrypted` field's plaintext doesn't land in the immutable log
-        // (flatChanges is already ciphertext from encryptForStorage above).
+        // not negotiable. `previous` came from loadById(), which decrypts —
+        // re-encrypt it before it's persisted so plaintext of pii/encrypted
+        // fields doesn't land in the immutable log (flatChanges is already
+        // ciphertext from encryptForStorage above).
         const event = await append(db.raw, {
           aggregateId: String(payload.id),
           aggregateType: entityName,
@@ -730,26 +727,23 @@ export function createEventStoreExecutor(
           expectedVersion: currentVersion,
           type: entityEventName(entityName, "updated"),
           payload: {
-            changes: stripSensitive(flatChanges),
-            previous: stripSensitive(await encryptForStorage(previous, user)),
+            changes: flatChanges,
+            previous: await encryptForStorage(previous, user),
           },
           metadata: buildEventMetadata(user),
         });
 
-        // Live==Rebuild via applyEntityEvent: live-event mit unstripped
-        // flatChanges damit sensitive Felder in der Read-Tabelle landen.
+        // Live==Rebuild via applyEntityEvent mit demselben StoredEvent —
+        // apply liest nur `changes`, und die sind live wie im Replay
+        // identischer Ciphertext (#967).
         //
         // F8-Patch: dasselbe unique-violation-handling wie im create-Pfad
         // — ein update das einen unique-Index verletzt (z.B. email-update
         // auf einen schon-existierenden Wert) wird mit 409 unique_violation
         // statt 500 internal_error rückgemeldet.
-        const liveEvent = {
-          ...event,
-          payload: { changes: flatChanges, previous },
-        };
         let result: Awaited<ReturnType<typeof applyEntityEvent>>;
         try {
-          result = await applyEntityEvent(liveEvent, table, entity, db.raw);
+          result = await applyEntityEvent(event, table, entity, db.raw);
         } catch (e) {
           const mapped = tryMapUniqueViolation(e, entityName);
           if (mapped) return mapped;
@@ -837,17 +831,16 @@ export function createEventStoreExecutor(
       // Deletes carry the full pre-delete row as `previous`. That's what
       // projections and downstream consumers need to reverse any aggregates —
       // a `{}`-payload delete would make cross-aggregate projections impossible
-      // to rebuild from the event log alone. Sensitive fields are stripped.
-      // `existing` came from loadById(), which decrypts — re-encrypt before
-      // persisting so an `encrypted` field's plaintext doesn't land in the
-      // immutable log.
+      // to rebuild from the event log alone. `existing` came from loadById(),
+      // which decrypts — re-encrypt before persisting so plaintext doesn't
+      // land in the immutable log.
       const event = await append(db.raw, {
         aggregateId: String(payload.id),
         aggregateType: entityName,
         tenantId: streamTenantFor(user),
         expectedVersion: currentVersion,
         type: entityEventName(entityName, "deleted"),
-        payload: { previous: stripSensitive(await encryptForStorage(existing, user)) },
+        payload: { previous: await encryptForStorage(existing, user) },
         metadata: buildEventMetadata(user),
       });
 
@@ -918,7 +911,7 @@ export function createEventStoreExecutor(
         type: entityEventName(entityName, "forgotten"),
         // Re-encrypt like delete(): `existing` came decrypted from loadById —
         // plaintext must not land in the immutable log, least of all on forget.
-        payload: { previous: stripSensitive(await encryptForStorage(existing, user)) },
+        payload: { previous: await encryptForStorage(existing, user) },
         metadata: buildEventMetadata(user),
       });
 
@@ -992,14 +985,15 @@ export function createEventStoreExecutor(
       // Restore carries the soft-deleted snapshot as `previous` — mirror of
       // delete for symmetry. Projections that decremented on delete use
       // `previous` to re-increment on restore without re-querying the entity
-      // table. Sensitive fields are stripped.
+      // table. `data` is the raw stored row — pii/encrypted fields are
+      // already ciphertext, no re-encrypt needed.
       const event = await append(db.raw, {
         aggregateId: String(payload.id),
         aggregateType: entityName,
         tenantId: streamTenantFor(user),
         expectedVersion: currentVersion,
         type: entityEventName(entityName, "restored"),
-        payload: { previous: stripSensitive(data) },
+        payload: { previous: data },
         metadata: buildEventMetadata(user),
       });
 

package/src/engine/__tests__/boot-validator-pii-retention.test.ts

@@ -117,6 +117,55 @@ describe("validateBoot — PII annotations", () => {
     expect(() => validateBoot([feature])).toThrow(/multiple subject-key annotations/);
   });
 
+  test("naked sensitive (no pii/encrypted) throws — event log needs ciphertext-at-rest (#967)", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "vault",
+        createEntity({
+          fields: {
+            apiToken: createTextField({ sensitive: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/sensitive: true.*without ciphertext-at-rest/);
+  });
+
+  test("sensitive with pii subject annotation passes", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "vault",
+        createEntity({
+          fields: {
+            apiToken: createTextField({ sensitive: true, pii: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).not.toThrow();
+  });
+
+  test("sensitive with encrypted passes", () => {
+    process.env["KUMIKO_SECRETS_MASTER_KEY_V1"] = Buffer.from(
+      "0123456789abcdef0123456789abcdef",
+    ).toString("base64");
+    try {
+      const feature = defineFeature("test", (r) => {
+        r.entity(
+          "vault",
+          createEntity({
+            fields: {
+              apiToken: createTextField({ sensitive: true, encrypted: true }),
+            },
+          }),
+        );
+      });
+      expect(() => validateBoot([feature])).not.toThrow();
+    } finally {
+      delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
+    }
+  });
+
   test("userOwned.ownerField pointing to non-existent field throws", () => {
     const feature = defineFeature("test", (r) => {
       r.entity(

package/src/engine/boot-validator/pii-retention.ts

@@ -80,6 +80,23 @@ export function validatePiiAndRetention(feature: FeatureDefinition): void {
         }
       }
 
+      // sensitive-Felder liegen seit #967 als Tabellen-Ciphertext im Event-
+      // Log — ohne ciphertext-at-rest würde der Append Klartext in die
+      // immutable History schreiben.
+      const sensitiveFlags = field as {
+        readonly sensitive?: boolean;
+        readonly encrypted?: boolean;
+      }; // @cast-boundary schema-walk
+      if (
+        sensitiveFlags.sensitive === true &&
+        annotCount === 0 &&
+        sensitiveFlags.encrypted !== true
+      ) {
+        throw new Error(
+          `[Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" declares { sensitive: true } without ciphertext-at-rest. Since #967 the event log stores sensitive fields as table ciphertext — add a subject annotation (pii / userOwned / tenantOwned) or { encrypted: true }.`,
+        );
+      }
+
       // Substring-Suche/Sortierung auf Ciphertext ist prinzipbedingt
       // unmöglich — searchable würde Plaintext-Kopien in den Suchindex
       // schieben, sortable sortiert Base64-Blobs. Equality → lookupable.

package/src/engine/types/fields.ts

@@ -12,13 +12,13 @@ export type FieldAccess = {
   readonly write?: OwnershipMap | readonly string[];
 };
 
-// `sensitive: true` — the field's value is excluded from event payloads
-// (create data, update changes/previous, delete/restore previous). The entity
-// row still stores it; only the immutable event-log won't. Use for data that
-// must never land in permanent history: password hashes, API tokens,
-// unhashed PII, bank details, tax IDs. The trade-off: event-replay and
-// custom projections cannot read sensitive field values. See
-// docs/plans/architecture/projections.md.
+// `sensitive: true` — the field's value is excluded from caller-facing event
+// echoes in write responses (#820) and MUST be ciphertext-at-rest: boot
+// validation requires a subject annotation (pii / userOwned / tenantOwned)
+// or `encrypted: true` (#967). Event payloads carry the table ciphertext,
+// so replay reproduces the row byte-identically; plaintext never lands in
+// permanent history. Use for password hashes, API tokens, bank details,
+// tax IDs. See docs/plans/architecture/projections.md.
 
 // --- PII / Subject-Key Annotations (DSGVO Art. 17 — Crypto-Shredding) ---
 //