@frockbot/plugin-audit 0.3.4 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/plugin-audit",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "private": false,
   "type": "module",
   "exports": {
@@ -25,11 +25,11 @@
     "typecheck": "vue-tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/client-core": "0.3.4",
-    "@frockbot/client-ui": "0.3.4",
-    "@frockbot/kernel-contracts": "0.3.4",
-    "@frockbot/plugin-shell": "0.3.4",
-    "@frockbot/secret-shapes": "0.3.4",
+    "@frockbot/client-core": "0.3.5",
+    "@frockbot/client-ui": "0.3.5",
+    "@frockbot/kernel-contracts": "0.3.5",
+    "@frockbot/plugin-shell": "0.3.5",
+    "@frockbot/secret-shapes": "0.3.5",
     "cordis": "4.0.0-rc.8",
     "vue": "3.5.41"
   },

package/src/bot.test.ts

@@ -248,3 +248,55 @@ describe("the Bot Durable Object's outbox", () => {
     expect(await outbox.state()).toEqual({ pending: 0, truncated: false });
   });
 });
+
+describe("what the row is allowed to claim", () => {
+  test("an approval-gated command is not `ok` before anybody approved it", async () => {
+    const entries = await auditEntriesFromStoredRunV1(
+      "foreman",
+      run([
+        call("tool:1:1:0", "machine_exec", {
+          command: "rm -rf /tmp/build",
+          machineId: "994dc2ee-1",
+        }),
+        result("tool:1:1:0", {
+          content:
+            'Command "cmd-1" is waiting on the user\'s approval. Nothing has run.',
+        }),
+      ]),
+    );
+
+    // The approval ends the Turn before anything runs, and `isError` is false
+    // at queue time — so the row used to say `ok` for a command that had not
+    // run and might never run.
+    expect(entries[0]).toMatchObject({
+      toolName: "machine_exec",
+      target: "machine:994dc2ee-1",
+      outcome: "unknown",
+    });
+  });
+
+  test("a namespaced dynamic tool is recorded under the tool that ran", async () => {
+    const entries = await auditEntriesFromStoredRunV1(
+      "foreman",
+      run([
+        call("tool:1:1:0", "call_dynamic_tool", {
+          namespace: "frockbot",
+          toolName: "package_author",
+          input: { packageId: "acme", path: "src/index.ts" },
+        }),
+        result("tool:1:1:0", { content: "written" }),
+      ]),
+    );
+
+    // `package_author` produced no row at all before: it is a namespaced
+    // dynamic tool, so the journalled name is `call_dynamic_tool`, and the
+    // same hole hid every Composio and publisher call.
+    expect(entries).toHaveLength(1);
+    expect(entries[0]).toMatchObject({
+      toolName: "package_author",
+      kind: "file",
+      outcome: "ok",
+    });
+    expect(entries[0]?.preview).toContain("acme");
+  });
+});

package/src/bot.ts

@@ -21,7 +21,11 @@
 // It reads the *stored* run rather than the client projection, because the
 // client projection drops `call.input` and the argument digest needs the exact
 // arguments.
-import { auditKindForToolV1 } from "./classify.js";
+import {
+  auditKindForToolV1,
+  dynamicToolInputV1,
+  resolveDynamicToolNameV1,
+} from "./classify.js";
 import { auditArgumentDigestV1, auditPreviewV1 } from "./redact.js";
 import {
   AUDIT_MAX_OUTBOX_V1,
@@ -71,6 +75,17 @@ export function isSettledAuditRunV1(run: { status: string }): boolean {
   );
 }
 
+/**
+ * A tool result that says the effect has not run yet.
+ *
+ * An approval-gated `machine_exec` answers the model at *queue* time, before
+ * anybody has approved anything, and `isError` is false — so the row said `ok`
+ * for a command that had not run and might never run. The durable log does not
+ * yet know how it ended, which is exactly what `unknown` means.
+ */
+const AWAITING_APPROVAL =
+  /\bnothing has run\b|waiting on the user's approval|awaiting (?:your )?approval|queued for approval/i;
+
 function outcomeFor(
   result: { isError?: boolean; status?: string; content?: string } | undefined,
 ): AuditOutcomeV1 {
@@ -79,7 +94,9 @@ function outcomeFor(
   // silent classification the constitution's reconciliation rule forbids.
   if (!result) return "unknown";
   if (result.status === "interrupted") return "interrupted";
-  if (result.isError !== true) return "ok";
+  if (result.isError !== true) {
+    return AWAITING_APPROVAL.test(result.content ?? "") ? "unknown" : "ok";
+  }
   // A tool that declined before doing anything is a refusal, which is a
   // materially different fact from an effect that ran and failed.
   return /\brefus|not allowed|denied|blocked while\b/i.test(
@@ -122,6 +139,11 @@ export async function auditEntriesFromStoredRunV1(
     if (!occurrenceId || !name) continue;
     const classification = auditKindForToolV1(name, event.input);
     if (!classification) continue;
+    // The row names the tool that ran, not the wrapper it was journalled
+    // under, and previews the arguments that tool was actually given.
+    const toolName = resolveDynamicToolNameV1(name, event.input);
+    const toolInput =
+      toolName === name ? event.input : dynamicToolInputV1(event.input);
     let coordinates: { turn: number; step: number; ordinal: number };
     try {
       coordinates = decodeAuditOccurrenceIdV1(occurrenceId);
@@ -146,9 +168,11 @@ export async function auditEntriesFromStoredRunV1(
       at,
       kind: classification.kind,
       target: classification.target,
-      toolName: name,
+      toolName,
+      // The digest stays over the exact argument JSON the durable `tool/call`
+      // event holds, so a row written months ago still reproduces.
       argumentDigest: await auditArgumentDigestV1(event.input),
-      preview: auditPreviewV1(classification.kind, name, event.input),
+      preview: auditPreviewV1(classification.kind, toolName, toolInput),
       outcome: outcomeFor(result),
       ...(result?.content === undefined
         ? {}

package/src/classify.test.ts

@@ -104,20 +104,56 @@ describe("the classifier table", () => {
     });
   });
 
-  test("a call naming a registered machine is audited against that machine", () => {
+  test("a Computer tool is audited against the Computer, whatever it claims", () => {
+    // `machineId` is model-supplied. Deriving the target from it on every tool
+    // let a Bot run a command on the Computer and have the durable audit row
+    // say it ran on the User's laptop — the one field the row exists to be
+    // trusted on.
     expect(
       auditKindForToolV1("computer_exec", {
         command: "ls",
         machineId: "994dc2ee-1",
       }),
+    ).toEqual({ kind: "shell", target: "computer" });
+    // The machine's own verbs still name the machine they reached.
+    expect(
+      auditKindForToolV1("machine_exec", {
+        command: "ls",
+        machineId: "994dc2ee-1",
+      }),
     ).toEqual({ kind: "shell", target: "machine:994dc2ee-1" });
     // A malformed machine id is the Bot's own Computer, not a target the row
     // would be lying about.
     expect(
-      auditKindForToolV1("computer_exec", { command: "ls", machineId: "../x" }),
+      auditKindForToolV1("machine_exec", { command: "ls", machineId: "../x" }),
     ).toEqual({ kind: "shell", target: "computer" });
   });
 
+  test("a namespaced dynamic tool is classified on the tool it resolves to", () => {
+    // `package_author` was dead: it is a namespaced dynamic tool, so the
+    // journalled name is `call_dynamic_tool` and no row was ever produced —
+    // the same hole hid every Composio and publisher call.
+    expect(
+      auditKindForToolV1("call_dynamic_tool", {
+        namespace: "frockbot",
+        toolName: "package_author",
+        input: { packageId: "acme" },
+      }),
+    ).toEqual({ kind: "file", target: "computer" });
+    // A wrapper that names nothing resolvable stays the wrapper, and the
+    // wrapper is not an audited effect.
+    expect(auditKindForToolV1("call_dynamic_tool", {})).toBeUndefined();
+  });
+
+  test("an MCP tool whose own name contains __ still names its server", () => {
+    // The slug capture was greedy: `mcp__gh__list__files` reported server
+    // `gh__list`, a target no Connection can resolve to a host.
+    expect(auditKindForToolV1("mcp__gh__list__files", {})).toEqual({
+      kind: "mcp",
+      target: "remote:gh",
+    });
+  });
+
   test("is pure: the same call always classifies the same way", () => {
     const first = auditKindForToolV1("computer_exec", { command: "ls" });
     const second = auditKindForToolV1("computer_exec", { command: "ls" });

package/src/classify.ts

@@ -77,13 +77,56 @@ const MACHINE_SHELL_TOOL = "machine_exec";
  */
 const MACHINE_MESSAGES_PREFIX = "machine_messages_";
 
-const MCP_TOOL = /^mcp__([a-zA-Z0-9_]{1,64})__(.{1,96})$/;
+// The slug capture is LAZY. Greedy, `mcp__gh__list__files` reported server
+// `gh__list` — a target that names no Connection, so `resolveAuditTargetV1`
+// could never resolve it to a host and the row filtered under a server nobody
+// has. The slug is the first segment; everything after the second `__` is the
+// remote tool's own name, `__` included.
+const MCP_TOOL = /^mcp__([a-zA-Z0-9_]{1,64}?)__(.{1,96})$/;
 const MACHINE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 
 function isObject(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+/** The wrapper every namespaced Package tool is journalled under. */
+const DYNAMIC_TOOL = "call_dynamic_tool";
+
+/**
+ * The tool a call actually made.
+ *
+ * `package_author` was dead code here: it is a namespaced dynamic tool, so the
+ * journalled `tool/call` name is `call_dynamic_tool` and no row was ever
+ * produced for it — the same hole hid every Composio and publisher call. The
+ * wrapper's own input names the tool, exactly as the provider's presented name
+ * does, so the classifier reads it off the call and stays pure.
+ */
+export function resolveDynamicToolNameV1(name: string, input: unknown): string {
+  if (name !== DYNAMIC_TOOL || !isObject(input)) return name;
+  const { namespace, toolName } = input;
+  if (typeof namespace !== "string" || typeof toolName !== "string") {
+    return name;
+  }
+  return namespace === "frockbot" ? toolName : `${namespace}/${toolName}`;
+}
+
+/** The arguments the wrapped tool was actually given. */
+export function dynamicToolInputV1(input: unknown): unknown {
+  if (!isObject(input)) return input;
+  return Object.hasOwn(input, "input") ? input.input : input;
+}
+
+/** Whether a tool reaches the User's registered machine rather than the Computer. */
+function isMachineToolV1(name: string): boolean {
+  return (
+    name === MACHINE_SHELL_TOOL ||
+    name.startsWith(MACHINE_MESSAGES_PREFIX) ||
+    name === "machine_read" ||
+    name === "machine_copy_to_computer" ||
+    name === "machine_copy_from_computer"
+  );
+}
+
 /**
  * The registered Mac, when the call named one.
  *
@@ -114,7 +157,17 @@ export function auditKindForToolV1(
   name: string,
   input: unknown,
 ): AuditClassificationV1 | undefined {
-  const onComputer = machineTarget(input) ?? AUDIT_TARGET_COMPUTER_V1;
+  // Only a tool that actually reaches a registered machine may be targeted at
+  // one. The target used to come off `machineId` for every tool, and
+  // `machineId` is model-supplied: a Bot could run a command on the Computer
+  // and have the audit row say it ran on the User's laptop. A Computer tool is
+  // audited against the Computer, whatever its arguments claim.
+  const resolved = resolveDynamicToolNameV1(name, input);
+  const onMachine = isMachineToolV1(resolved)
+    ? (machineTarget(input) ?? AUDIT_TARGET_COMPUTER_V1)
+    : AUDIT_TARGET_COMPUTER_V1;
+  const onComputer = onMachine;
+  name = resolved;
   if (name === "computer_exec") {
     // A background command outlives the Turn that launched it and is acted on
     // afterwards by the three `computer_process_*` tools, so it is a process

package/src/redact.test.ts

@@ -89,3 +89,58 @@ describe("the argument digest", () => {
     );
   });
 });
+
+describe("secrets a preview must not carry", () => {
+  test("redacts an env-var assignment whose keyword sits behind an underscore", () => {
+    // `_` is a word character, so the old `\bsecret\b` anchor did not match
+    // inside `AWS_SECRET_ACCESS_KEY` and these landed verbatim in a durable
+    // table a person reads — the exact shape a leased credential takes in a
+    // `computer_exec` command.
+    for (const command of [
+      "AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKEY aws s3 ls",
+      "GITHUB_TOKEN=abcdefghijklmnopqrst gh pr list",
+      "MYSQL_PASSWORD=hunter2hunter2 mysql -u root",
+    ]) {
+      const preview = auditPreviewV1("shell", "computer_exec", { command });
+      expect(preview).toContain("[redacted:credential-assignment]");
+      expect(preview).not.toContain("wJalrXUtnFEMIK");
+      expect(preview).not.toContain("abcdefghijklmnopqrst");
+      expect(preview).not.toContain("hunter2hunter2");
+    }
+  });
+
+  test("redacts credentials carried in a URL", () => {
+    const withUser = auditPreviewV1("browser", "computer_browser", {
+      action: "open",
+      url: "https://alice:s3cr3tpass@internal.example.com/reports",
+    });
+    expect(withUser).toContain("[redacted:url-credentials]");
+    expect(withUser).not.toContain("s3cr3tpass");
+
+    for (const [url, secret] of [
+      ["https://example.com/cb?token=abcdefghijklmnop", "abcdefghijklmnop"],
+      ["https://example.com/cb?code=4%2F0AeanS0abcdefgh", "AeanS0abcdefgh"],
+      ["https://example.com/f.zip?sig=aGVsbG93b3JsZA", "aGVsbG93b3JsZA"],
+    ] as const) {
+      const preview = auditPreviewV1("browser", "computer_browser", {
+        action: "open",
+        url,
+      });
+      // Which shape catches it does not matter; that it never reaches the
+      // durable table does.
+      expect(preview).toMatch(/\[redacted:/);
+      expect(preview).not.toContain(secret);
+    }
+  });
+
+  test("never previews the body of a memory or skill write", () => {
+    const preview = auditPreviewV1("file", "memory_write", {
+      path: "by-agent/scout/profile.md",
+      text: "Tim's home address is 12 Somewhere Street and his PIN is 4021.",
+    });
+    // The audit row says where something was written. What was written is the
+    // Workspace's business and the digest's.
+    expect(preview).toBe("by-agent/scout/profile.md");
+    expect(preview).not.toContain("Somewhere Street");
+  });
+});

package/src/redact.ts

@@ -43,7 +43,11 @@ const PREVIEW_FIELDS: Record<AuditKindV1, readonly string[]> = {
   shell: ["command", "machineId"],
   browser: ["action", "url", "role", "name", "label", "key"],
   process: ["action", "command", "processId", "machineId"],
-  file: ["path", "root", "project", "packageId", "skill", "text"],
+  // No `text`: it previewed up to 200 characters of a `memory_write` or
+  // `skill_write` body into a durable table a person reads later. What was
+  // written is the Workspace's business and the digest's; the audit row says
+  // where it was written, which is the question an audit answers.
+  file: ["path", "root", "project", "packageId", "skill"],
   mcp: [],
 };
 

package/src/store.test.ts

@@ -166,3 +166,102 @@ describe("the audit table", () => {
     expect(table.count()).toBe(0);
   });
 });
+
+describe("a rebuild that fails", () => {
+  test("leaves the live table exactly as it was", async () => {
+    const table = store();
+    table.insert([entry(), entry({ occurrenceId: "tool:1:1:1" })]);
+    expect(table.count()).toBe(2);
+
+    // The rebuild used to `DELETE FROM` the live table before it fetched page
+    // one, so any source failure left a truncated table still reporting
+    // `ready` — a person would read an audit log with rows silently missing
+    // and nothing saying so.
+    await expect(
+      table.rebuild([
+        {
+          botId: "foreman",
+          page: async () => {
+            throw new Error("the Bot object is unreachable");
+          },
+        },
+      ]),
+    ).rejects.toThrow("unreachable");
+
+    expect(table.count()).toBe(2);
+    expect(table.state()).toBe("ready");
+  });
+
+  test("a rebuild that succeeds replaces the table wholesale", async () => {
+    const table = store();
+    table.insert([entry({ occurrenceId: "tool:9:9:9" })]);
+
+    const receipt = await table.rebuild([
+      {
+        botId: "foreman",
+        page: async (cursor?: string) =>
+          cursor === undefined
+            ? {
+                entries: [entry({ occurrenceId: "tool:1:1:0" })],
+                nextCursor: "p1",
+              }
+            : { entries: [entry({ occurrenceId: "tool:1:1:1" })] },
+      },
+    ]);
+
+    expect(receipt).toMatchObject({ entries: 2, bots: 1, indexState: "ready" });
+    expect(table.count()).toBe(2);
+    // The row the old table held and the sources no longer offer is gone: a
+    // rebuild is a replacement, not a merge.
+    expect(
+      table
+        .query({})
+        .entries.map((row) => row.occurrenceId)
+        .sort(),
+    ).toEqual(["tool:1:1:0", "tool:1:1:1"]);
+  });
+
+  test("refuses a second rebuild while one is running", async () => {
+    const table = store();
+    let release: (() => void) | undefined;
+    const gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const first = table.rebuild([
+      {
+        botId: "foreman",
+        page: async () => {
+          await gate;
+          return { entries: [entry()] };
+        },
+      },
+    ]);
+
+    // `audit-rebuilding` was written and never read as a lock, so two
+    // concurrent rebuilds wiped each other.
+    await expect(
+      table.rebuild([
+        { botId: "foreman", page: async () => ({ entries: [] }) },
+      ]),
+    ).rejects.toThrow("already running");
+
+    release?.();
+    await first;
+    expect(table.state()).toBe("ready");
+  });
+});
+
+describe("retention", () => {
+  test("is enforced on a read too, not only when something is written", () => {
+    let now = Date.parse("2026-08-31T00:00:00.000Z");
+    const table = store({ maxAgeMs: 60_000, now: () => now });
+    table.insert([entry({ at: "2026-08-31T00:00:00.000Z" })]);
+    expect(table.count()).toBe(1);
+
+    // A Bot nobody has spoken to since kept every row past the age bound,
+    // because eviction only ever ran on insert. Retention is a promise about
+    // time.
+    now += 10 * 60_000;
+    expect(table.query({}).entries).toHaveLength(0);
+  });
+});

package/src/store.ts

@@ -42,6 +42,15 @@ export interface AuditSqlV1 {
 }
 
 const TABLE = "audit_entries";
+/**
+ * Where a rebuild accumulates rows before it replaces the live table.
+ *
+ * A rebuild used to `DELETE FROM` the live table before it fetched page one,
+ * so any source failure left a truncated table still reporting `ready`. It
+ * fills this instead and swaps at the end, which makes a failed rebuild cost
+ * nothing.
+ */
+const SHADOW_TABLE = "audit_entries_rebuild";
 const META_TABLE = "audit_meta";
 const TRUNCATED_KEY = "audit-truncated";
 const REBUILDING_KEY = "audit-rebuilding";
@@ -49,6 +58,26 @@ const REBUILDING_KEY = "audit-rebuilding";
 /** The page size a rebuild pulls from one Bot at a time. */
 export const AUDIT_REBUILD_PAGE_V1 = 32;
 
+/**
+ * How long a rebuild holds the lock before another may take it.
+ *
+ * `REBUILDING_KEY` was written and never read as a lock, so two concurrent
+ * rebuilds wiped each other. It now records when the rebuild started, and a
+ * marker older than this is a rebuild whose isolate died — not a reason for
+ * the table to be unrebuildable for ever.
+ */
+export const AUDIT_REBUILD_LOCK_MS = 10 * 60_000;
+
+/** The columns both the live table and the rebuild's shadow carry. */
+const AUDIT_COLUMNS =
+  "bot_id TEXT NOT NULL, run_id TEXT NOT NULL, occurrence_id TEXT NOT NULL, " +
+  "turn INTEGER NOT NULL, step INTEGER NOT NULL, ordinal INTEGER NOT NULL, " +
+  "effect_id TEXT NOT NULL, at TEXT NOT NULL, kind TEXT NOT NULL, " +
+  "target TEXT NOT NULL, tool_name TEXT NOT NULL, argument_digest TEXT NOT NULL, " +
+  "preview TEXT NOT NULL, outcome TEXT NOT NULL, exit_code INTEGER, " +
+  "duration_ms INTEGER, bytes_out INTEGER, " +
+  "PRIMARY KEY (bot_id, run_id, occurrence_id)";
+
 export interface AuditStoreOptionsV1 {
   sql: AuditSqlV1;
   /** Overridable so a test can drive eviction without twenty thousand rows. */
@@ -134,16 +163,7 @@ export class AuditStoreV1 {
   /** Creates the table if it is absent. Safe to call on every request. */
   open(): void {
     if (this.opened) return;
-    this.sql.exec(
-      `CREATE TABLE IF NOT EXISTS ${TABLE} (` +
-        "bot_id TEXT NOT NULL, run_id TEXT NOT NULL, occurrence_id TEXT NOT NULL, " +
-        "turn INTEGER NOT NULL, step INTEGER NOT NULL, ordinal INTEGER NOT NULL, " +
-        "effect_id TEXT NOT NULL, at TEXT NOT NULL, kind TEXT NOT NULL, " +
-        "target TEXT NOT NULL, tool_name TEXT NOT NULL, argument_digest TEXT NOT NULL, " +
-        "preview TEXT NOT NULL, outcome TEXT NOT NULL, exit_code INTEGER, " +
-        "duration_ms INTEGER, bytes_out INTEGER, " +
-        "PRIMARY KEY (bot_id, run_id, occurrence_id))",
-    );
+    this.sql.exec(`CREATE TABLE IF NOT EXISTS ${TABLE} (${AUDIT_COLUMNS})`);
     this.sql.exec(`CREATE INDEX IF NOT EXISTS ${TABLE}_at ON ${TABLE} (at)`);
     this.sql.exec(
       `CREATE INDEX IF NOT EXISTS ${TABLE}_bot_at ON ${TABLE} (bot_id, at)`,
@@ -204,11 +224,18 @@ export class AuditStoreV1 {
    */
   insert(entries: readonly AuditEntryV1[]): number {
     this.open();
+    const inserted = this.insertInto(TABLE, entries);
+    this.evict();
+    return inserted;
+  }
+
+  /** The insert half, named so a rebuild can aim it at its shadow table. */
+  private insertInto(table: string, entries: readonly AuditEntryV1[]): number {
     let inserted = 0;
     for (const entry of entries) {
       const existing = this.sql
         .exec<{ n: number }>(
-          `SELECT count(*) AS n FROM ${TABLE} WHERE bot_id = ? AND run_id = ? AND occurrence_id = ?`,
+          `SELECT count(*) AS n FROM ${table} WHERE bot_id = ? AND run_id = ? AND occurrence_id = ?`,
           entry.botId,
           entry.runId,
           entry.occurrenceId,
@@ -216,7 +243,7 @@ export class AuditStoreV1 {
         .toArray();
       if (Number(existing[0]?.n ?? 0) > 0) continue;
       this.sql.exec(
-        `INSERT INTO ${TABLE} (bot_id, run_id, occurrence_id, turn, step, ordinal, ` +
+        `INSERT INTO ${table} (bot_id, run_id, occurrence_id, turn, step, ordinal, ` +
           "effect_id, at, kind, target, tool_name, argument_digest, preview, outcome, " +
           "exit_code, duration_ms, bytes_out) " +
           "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
@@ -240,7 +267,6 @@ export class AuditStoreV1 {
       );
       inserted += 1;
     }
-    this.evict();
     return inserted;
   }
 
@@ -333,6 +359,10 @@ export class AuditStoreV1 {
     limit?: number;
   }): { entries: AuditEntryV1[]; nextCursor?: string; total: number } {
     this.open();
+    // Retention is a promise about time, so it cannot be enforced only when
+    // something is written: a Bot nobody has spoken to for a year kept every
+    // row past the 180-day bound simply because no insert came to evict them.
+    this.evict();
     const limit = Math.min(Math.max(request.limit ?? 50, 1), 500);
     const offset = decodeAuditOffsetV1(request.before);
     const clauses: string[] = [];
@@ -391,17 +421,33 @@ export class AuditStoreV1 {
     sources: readonly AuditEntrySourceV1[],
   ): Promise<AuditRebuildOutcomeV1> {
     this.open();
-    this.setMeta(REBUILDING_KEY, "1");
-    this.sql.exec(`DELETE FROM ${TABLE}`);
-    this.setMeta(TRUNCATED_KEY, undefined);
+    const held = this.meta(REBUILDING_KEY);
+    const startedAt = held === undefined ? undefined : Number(held);
+    if (
+      startedAt !== undefined &&
+      Number.isFinite(startedAt) &&
+      this.now() - startedAt < AUDIT_REBUILD_LOCK_MS
+    ) {
+      // The marker was written and never read as a lock, so two concurrent
+      // rebuilds wiped each other. It is a lock now.
+      throw new Error("an audit rebuild is already running");
+    }
+    this.setMeta(REBUILDING_KEY, String(this.now()));
     let entries = 0;
     try {
+      // Append, then swap. Nothing touches the live table until every source
+      // has answered, so a source that fails halfway costs a rebuild and not
+      // the table — where before the rows were deleted before page one was
+      // even fetched, and a failure left a truncated table reporting `ready`.
+      this.sql.exec(`DROP TABLE IF EXISTS ${SHADOW_TABLE}`);
+      this.sql.exec(`CREATE TABLE ${SHADOW_TABLE} (${AUDIT_COLUMNS})`);
       for (const source of sources) {
         let cursor: string | undefined;
         let pages = 0;
         do {
           const page = await source.page(cursor);
-          entries += this.insert(
+          entries += this.insertInto(
+            SHADOW_TABLE,
             page.entries.filter((entry) => entry.botId === source.botId),
           );
           cursor = page.nextCursor;
@@ -410,6 +456,16 @@ export class AuditStoreV1 {
           // that never stops offering pages is a fault, not a large Bot.
         } while (cursor && pages < 10_000);
       }
+      this.sql.exec(`DROP TABLE ${TABLE}`);
+      this.sql.exec(`ALTER TABLE ${SHADOW_TABLE} RENAME TO ${TABLE}`);
+      // The indexes went with the table the rename replaced.
+      this.opened = false;
+      this.open();
+      this.setMeta(TRUNCATED_KEY, undefined);
+      this.evict();
+    } catch (error) {
+      this.sql.exec(`DROP TABLE IF EXISTS ${SHADOW_TABLE}`);
+      throw error;
     } finally {
       this.setMeta(REBUILDING_KEY, undefined);
     }

package/src/testing.ts

@@ -65,11 +65,33 @@ function order(left: FakeRow, right: FakeRow): number {
 }
 
 export class FakeAuditSql implements AuditSqlV1 {
-  private rows: FakeRow[] = [];
+  /**
+   * One row list per table, because a rebuild fills a shadow table and swaps
+   * it in: a fake with a single list could not tell the two apart and would
+   * report the swap as working whatever the store did.
+   */
+  private tables = new Map<string, FakeRow[]>([["audit_entries", []]]);
   private meta = new Map<string, string>();
   /** Every statement the module issued, for tests that assert on shape. */
   readonly statements: string[] = [];
 
+  /** The table one statement names, defaulting to the live one. */
+  private static table(sql: string): string {
+    return (
+      /(?:FROM|INTO|TABLE(?: IF NOT EXISTS)?(?: IF EXISTS)?) (audit_entries(?:_rebuild)?)/.exec(
+        sql,
+      )?.[1] ?? "audit_entries"
+    );
+  }
+
+  private rowsIn(table: string): FakeRow[] {
+    const rows = this.tables.get(table);
+    if (rows) return rows;
+    const created: FakeRow[] = [];
+    this.tables.set(table, created);
+    return created;
+  }
+
   exec<Row extends Record<string, AuditSqlValueV1>>(
     query: string,
     ...bindings: unknown[]
@@ -77,7 +99,23 @@ export class FakeAuditSql implements AuditSqlV1 {
     this.statements.push(query);
     const sql = query.replace(/\s+/g, " ").trim();
     const answer = (rows: unknown[]) => cursor(rows as Row[]);
+    const table = FakeAuditSql.table(sql);
 
+    const renamed = /^ALTER TABLE (\S+) RENAME TO (\S+)$/.exec(sql);
+    if (renamed) {
+      this.tables.set(renamed[2]!, this.rowsIn(renamed[1]!));
+      this.tables.delete(renamed[1]!);
+      return answer([]);
+    }
+    if (sql.startsWith("DROP TABLE")) {
+      this.tables.delete(table);
+      return answer([]);
+    }
+    if (sql.startsWith("CREATE TABLE")) {
+      if (!sql.includes("IF NOT EXISTS")) this.tables.set(table, []);
+      else this.rowsIn(table);
+      return answer([]);
+    }
     if (sql.startsWith("CREATE") || sql.startsWith("DROP")) return answer([]);
 
     if (sql.startsWith("SELECT value FROM audit_meta")) {
@@ -96,16 +134,16 @@ export class FakeAuditSql implements AuditSqlV1 {
       const row = Object.fromEntries(
         COLUMNS.map((column, index) => [column, bindings[index] ?? null]),
       ) as FakeRow;
-      this.rows.push(row);
+      this.rowsIn(table).push(row);
       return answer([]);
     }
     if (sql.startsWith("SELECT count(*) AS n FROM audit_entries")) {
-      return answer([{ n: this.filtered(sql, bindings).length }]);
+      return answer([{ n: this.filtered(table, sql, bindings).length }]);
     }
     if (sql.startsWith("SELECT bot_id, run_id, occurrence_id FROM")) {
       const limit = Number(bindings[0]);
       return answer(
-        [...this.rows]
+        [...this.rowsIn(table)]
           .sort(order)
           .slice(0, limit)
           .map((row) => ({
@@ -116,7 +154,10 @@ export class FakeAuditSql implements AuditSqlV1 {
       );
     }
     if (sql.startsWith("DELETE FROM audit_entries WHERE at <")) {
-      this.rows = this.rows.filter((row) => row.at >= String(bindings[0]));
+      this.tables.set(
+        table,
+        this.rowsIn(table).filter((row) => row.at >= String(bindings[0])),
+      );
       return answer([]);
     }
     if (
@@ -124,26 +165,32 @@ export class FakeAuditSql implements AuditSqlV1 {
         "DELETE FROM audit_entries WHERE bot_id = ? AND run_id = ? AND occurrence_id = ?",
       )
     ) {
-      this.rows = this.rows.filter(
-        (row) =>
-          !(
-            row.bot_id === bindings[0] &&
-            row.run_id === bindings[1] &&
-            row.occurrence_id === bindings[2]
-          ),
+      this.tables.set(
+        table,
+        this.rowsIn(table).filter(
+          (row) =>
+            !(
+              row.bot_id === bindings[0] &&
+              row.run_id === bindings[1] &&
+              row.occurrence_id === bindings[2]
+            ),
+        ),
       );
       return answer([]);
     }
     if (sql.startsWith("DELETE FROM audit_entries WHERE bot_id = ?")) {
-      this.rows = this.rows.filter((row) => row.bot_id !== bindings[0]);
+      this.tables.set(
+        table,
+        this.rowsIn(table).filter((row) => row.bot_id !== bindings[0]),
+      );
       return answer([]);
     }
     if (sql === "DELETE FROM audit_entries") {
-      this.rows = [];
+      this.tables.set(table, []);
       return answer([]);
     }
     if (sql.startsWith("SELECT * FROM audit_entries")) {
-      const descending = [...this.filtered(sql, bindings)].sort(
+      const descending = [...this.filtered(table, sql, bindings)].sort(
         (left, right) => -order(left, right),
       );
       if (!sql.includes("LIMIT")) return answer(descending);
@@ -155,11 +202,11 @@ export class FakeAuditSql implements AuditSqlV1 {
   }
 
   /** Applies the `WHERE bot_id/kind/target` clauses the store builds. */
-  private filtered(sql: string, bindings: unknown[]): FakeRow[] {
+  private filtered(table: string, sql: string, bindings: unknown[]): FakeRow[] {
     const values = [...bindings];
     const where = /WHERE (.+?)(?: ORDER BY| LIMIT|$)/.exec(sql)?.[1] ?? "";
     if (where.startsWith("at <")) {
-      return this.rows.filter((row) => row.at < String(values[0]));
+      return this.rowsIn(table).filter((row) => row.at < String(values[0]));
     }
     const predicates: Array<(row: FakeRow) => boolean> = [];
     for (const clause of where.split(" AND ").filter(Boolean)) {
@@ -168,7 +215,7 @@ export class FakeAuditSql implements AuditSqlV1 {
       const expected = String(values.shift());
       predicates.push((row) => String(row[column]) === expected);
     }
-    return this.rows.filter((row) =>
+    return this.rowsIn(table).filter((row) =>
       predicates.every((predicate) => predicate(row)),
     );
   }

package/src/user.test.ts

@@ -93,9 +93,25 @@ describe("the User Contribution", () => {
     await expect(
       audit.indexAuditEntries(Array.from({ length: 513 }, () => entry())),
     ).rejects.toThrow("bound");
-    await expect(
-      audit.indexAuditEntries([{ ...entry(), turn: 7 }]),
-    ).rejects.toThrow("disagree");
+  });
+
+  test("quarantines one undecodable entry and indexes the rest", async () => {
+    const audit = contribution();
+
+    // The page carries one entry whose `turn` disagrees with its occurrence id
+    // — reachable in production through the tool-name length and slug mismatch
+    // between the classifier and the wire codec.
+    const receipt = await audit.indexAuditEntries([
+      entry(),
+      { ...entry(), turn: 7 },
+    ]);
+
+    // Before this, the whole page threw. The throw was swallowed at the Bot's
+    // drain, the outbox was never drained again, and every later entry was
+    // dropped at the 512 bound: one malformed row cost the Bot its whole audit
+    // trail, silently.
+    expect(receipt).toEqual({ indexed: 1, quarantined: 1 });
+    expect(audit.query({}).entries).toHaveLength(1);
   });
 
   test("counts host-journal discrepancies without writing them in", async () => {

package/src/user.ts

@@ -115,17 +115,36 @@ export class AuditUserBackendContribution {
   /**
    * Idempotent on `(botId, runId, occurrenceId)`; a redelivered outbox page
    * inserts nothing the second time.
+   *
+   * ONE BAD ENTRY IS ONE BAD ENTRY. Decoding used to be `input.map(decode)`,
+   * so a single undecodable entry threw for the whole page. The throw was
+   * swallowed at the Bot's drain, the outbox was never drained again, and
+   * every later entry was dropped at the 512 bound — one malformed row cost
+   * the Bot its entire audit trail, silently. Entries are decoded one at a
+   * time now: the bad one is quarantined and counted, the rest are indexed,
+   * and the page is accepted so the outbox clears.
    */
-  async indexAuditEntries(input: unknown): Promise<{ indexed: number }> {
+  async indexAuditEntries(
+    input: unknown,
+  ): Promise<{ indexed: number; quarantined: number }> {
     if (!Array.isArray(input)) {
       throw new AuditDecodeError("audit entries must be an array");
     }
     if (input.length > AUDIT_MAX_ENTRY_PAGE_V1) {
       throw new AuditDecodeError("audit entries exceed their bound");
     }
-    const entries = input.map(decodeAuditEntryV1);
+    const entries: AuditEntryV1[] = [];
+    let quarantined = 0;
+    for (const candidate of input) {
+      try {
+        entries.push(decodeAuditEntryV1(candidate));
+      } catch {
+        quarantined += 1;
+      }
+    }
     return {
       indexed: this.store.insert(this.resolve(entries, await this.hosts())),
+      quarantined,
     };
   }