@open-everywhere/core 0.1.0

package/dist/agent/audit/chain.js

@@ -0,0 +1,462 @@
+// Audit hash chain (OPE-52, audit-wedge WS-6c) — per-org `prev_sha` chaining that makes
+// silent deletion or mutation of an audit row DETECTABLE. Each appended row stores the
+// sha256 of the immediately preceding row for the SAME org; a verifier walks an org's
+// rows and recomputes each link, so removing a middle row (its successor's prev_sha no
+// longer matches the recomputed predecessor) or mutating any hashed field (the row's own
+// recomputed sha changes, breaking its successor's link) surfaces as a chain break.
+//
+// This is the INTEGRITY layer that sits UNDER the append-only posture (operational/
+// postgres.ts's FORCE-RLS SELECT/INSERT-only policies): the RLS makes mutation/deletion
+// impossible for a non-owner runtime role, and the chain makes it DETECTABLE if the owner
+// credential (or the un-RLS'd sqlite file) is used to rewrite history out of band. It is
+// NOT yet a public tamper-EVIDENT claim — that needs an external witness anchoring the
+// chain head (an off-box notarised head sha), which OPE-52 explicitly defers.
+//
+// ── WHAT IS HASHED (deliberate field choice) ──────────────────────────────────────────
+// IN, in this fixed positional order (a JSON array — positional so object key-order can
+// never perturb the digest): prev_sha, org, ts, platform, workspace, surface, principalId,
+// action, detail, and — only on a row that carries one — surfaceMode. EVERY caller-meaningful
+// fact is committed to, so tampering with WHO (principalId), WHERE (platform/workspace/surface,
+// and WHAT KIND of conversation that surface is), WHEN (ts), WHAT (action), or the payload
+// (detail) all break the chain — not just the "obvious" ones.
+//   - `surfaceMode` (OPE-1866) is hashed by EXTENSION, never by widening the fixed nine: a row
+//     that carries no mode hashes the nine-element array it always did, so every row written
+//     before the column existed keeps the sha its successor's `prev_sha` already stores. A row
+//     that carries one hashes a TENTH element, so stripping or rewriting the mode — the field
+//     the anti-doxxing mask routes on — breaks the chain exactly as rewriting `surface` does.
+//     🔴 Never move it into the fixed prefix: that re-hashes every historical row and reports a
+//     break on an untampered log.
+//   - `detail` is canonicalised with sorted keys (stableStringify) so a semantically
+//     identical object always hashes the same, regardless of the key order the DB round-
+//     trip happens to reconstruct (JSON.parse gives no key-order guarantee).
+// OUT, and why:
+//   - `seq` (the storage PK: sqlite AUTOINCREMENT / postgres IDENTITY): storage-assigned,
+//     differs between engines, and is not a caller fact — it establishes ORDER (the walk
+//     reads rows by seq) but is not part of the hashed CONTENT.
+//   - the row's OWN sha: a row cannot hash itself; it is always recomputable from the
+//     hashed fields + prev_sha, so it is never stored (one nullable `prev_sha` column is
+//     the entire additive schema cost).
+import { createHash } from "node:crypto";
+/** Deterministic JSON: object keys sorted recursively so a semantically identical value
+ *  always serialises identically (JSON.parse gives no key-order guarantee, so a DB round-
+ *  trip could otherwise reorder `detail`'s keys and change the digest). Arrays keep order;
+ *  primitives defer to JSON. `undefined` members are dropped exactly as JSON.stringify does. */
+function stableStringify(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "null";
+    if (Array.isArray(value))
+        return `[${value.map((v) => stableStringify(v)).join(",")}]`;
+    const obj = value;
+    const parts = [];
+    for (const key of Object.keys(obj).sort()) {
+        const v = obj[key];
+        if (v === undefined)
+            continue; // mirror JSON.stringify: undefined members are omitted
+        parts.push(`${JSON.stringify(key)}:${stableStringify(v)}`);
+    }
+    return `{${parts.join(",")}}`;
+}
+/** sha256 (hex) of one audit row's hashed fields chained to `prevSha` (null on genesis).
+ *  The canonical form is a positional JSON array — see the module header for IN/OUT. */
+export function auditRowSha(row, prevSha) {
+    const fields = [
+        prevSha,
+        row.org,
+        row.ts,
+        row.platform,
+        row.workspace,
+        row.surface ?? null,
+        row.principalId ?? null,
+        row.action,
+        row.detail === undefined ? null : stableStringify(row.detail),
+    ];
+    // The TENTH element is APPENDED, not reserved (OPE-1866). A row with no mode must produce the
+    // nine-element digest it produced before the column existed, or every pre-OPE-1866 row's stored
+    // link breaks on the next walk; a row with one commits to it.
+    if (row.surfaceMode !== undefined)
+        fields.push(row.surfaceMode);
+    return createHash("sha256").update(JSON.stringify(fields)).digest("hex");
+}
+// ── THE SEALED EPOCH (OPE-1636) ───────────────────────────────────────────────────────
+// Rows written BEFORE the chain existed carry a null `prev_sha`, so a walk that reaches one
+// mid-chain reports a break for every one of them. That is noise, not evidence: the rows are
+// not tampered, they simply predate the mechanism. The answer is an EXPLICIT marker, never a
+// silent skip — one row that says "the chain starts here", written once by an operator.
+//
+// The marker is an ordinary audit row with action `audit.chain_epoch` and a null `prev_sha`,
+// whose `detail.epoch` SEALS the era before it: how many rows it covered, their seq range, how
+// many broken links it contained at the moment of sealing, and an ERA DIGEST — sha256 over each
+// pre-epoch row's own recomputed sha, in seq order. The digest is what keeps the pre-epoch rows
+// under tamper detection at all: mutating or deleting one changes the digest, and a full walk
+// recomputes it. What the seal CANNOT say is anything about tampering that happened BEFORE the
+// seal was taken — it fixes the era's content as of that instant, no earlier. An operator
+// reading a sealed epoch therefore concludes: rows after the epoch carry link evidence; rows
+// before it carry era-digest evidence dated to the seal; `breaks_before` records what was already
+// broken then, and the walk CHECKS that number, so the seal cannot under-report its own era.
+//
+// A VERIFIED seal REPLACES link evidence with digest evidence for the era it covers, so a full
+// walk stops reporting that era's link breaks one by one — the marker's `breaks_before` is the
+// number an operator reads instead, and the walk returns how many it suppressed. That exchange
+// is the whole point: without it, sealing a pre-chain era buys nothing.
+//
+// A full walk re-verifies ALL THREE claims — the row count, the era digest, AND `breaks_before`.
+// The third one matters as much as the others: it is the sentence an operator reads as fact, and
+// a marker free to under-report its era would bury exactly what it claims to record.
+//
+// 🔴 THE MARKER IS NOT AUTHENTICATED, and verification is therefore NOT certification. Every
+// input to a seal is computable by anyone who can SELECT the rows, and the append-only posture
+// deliberately grants the runtime role INSERT — so one row can seal a broken era with a seal that
+// verifies. An epoch is an OPERATOR act, so the operator names it: the verifier CLI refuses to
+// certify a chain whose epoch no `--accept-epoch <seq>` vouches for, whatever the seal says.
+//
+// A walk NEVER accepts an epoch quietly. Every epoch it crosses is reported alongside the
+// breaks, so an epoch nobody sealed is as visible as a broken link. A seal that does NOT verify
+// suppresses nothing and adds a break of its own, and a `--tail` window verifies no seal at all,
+// so it suppresses nothing either — both failure directions stay noisy.
+/** The action key of the sealed-epoch marker row. */
+export const AUDIT_CHAIN_EPOCH_ACTION = "audit.chain_epoch";
+/**
+ * The era digest: sha256 over each row's own recomputed sha (`auditRowSha(row, row.prevSha)`),
+ * newline-joined in the order given. Rows MUST arrive oldest-first by seq, exactly as
+ * `readAuditChain` returns them — the digest commits to order as well as content.
+ */
+export function auditEraDigest(rows) {
+    const h = createHash("sha256");
+    for (const row of rows)
+        h.update(`${auditRowSha(row, row.prevSha)}\n`);
+    return h.digest("hex");
+}
+/** Build the `detail` an epoch marker row carries. The shape is the seal's wire form. */
+export function auditEpochDetail(seal) {
+    return {
+        epoch: {
+            rows_before: seal.rowsBefore,
+            first_seq_before: seal.firstSeqBefore,
+            last_seq_before: seal.lastSeqBefore,
+            breaks_before: seal.breaksBefore,
+            era_digest: seal.eraDigest,
+        },
+    };
+}
+/**
+ * Read a row's epoch seal, or null when the row is not a WELL-FORMED epoch marker. Deliberately
+ * strict on every field: a row that merely carries the action key, or whose seal is missing a
+ * number, is NOT an epoch — it is an ordinary row with a null link, i.e. a break. Accepting a
+ * half-formed marker would hand an attacker a one-row way to end a chain walk.
+ */
+export function readAuditEpochSeal(row) {
+    if (row.action !== AUDIT_CHAIN_EPOCH_ACTION || row.prevSha !== null)
+        return null;
+    const envelope = row.detail?.epoch;
+    if (envelope === null || typeof envelope !== "object" || Array.isArray(envelope))
+        return null;
+    const e = envelope;
+    const num = (v) => (typeof v === "number" && Number.isSafeInteger(v) && v >= 0 ? v : null);
+    const nullableNum = (v) => (v === null ? null : num(v) === null ? undefined : num(v));
+    const rowsBefore = num(e.rows_before);
+    const breaksBefore = num(e.breaks_before);
+    const firstSeqBefore = nullableNum(e.first_seq_before);
+    const lastSeqBefore = nullableNum(e.last_seq_before);
+    const eraDigest = e.era_digest;
+    if (rowsBefore === null || breaksBefore === null)
+        return null;
+    if (firstSeqBefore === undefined || lastSeqBefore === undefined)
+        return null;
+    if (typeof eraDigest !== "string" || !/^[0-9a-f]{64}$/.test(eraDigest))
+        return null;
+    return { rowsBefore, firstSeqBefore, lastSeqBefore, breaksBefore, eraDigest };
+}
+/**
+ * The FIRST broken link `walkAuditChain` finds, or null if every link holds. Detection cases:
+ *   - a MUTATED row: its successor's prev_sha no longer matches the row's recomputed sha;
+ *   - a DELETED row: the gap makes the successor's prev_sha (= sha of the removed row)
+ *     mismatch the recomputed predecessor;
+ *   - a FORK: two writers stamped the same prev_sha, so the second row by seq points at its
+ *     sibling rather than at the row before it;
+ *   - a null prev_sha after the genesis that no sealed epoch declares (a truncation/reset, or
+ *     an unsealed pre-chain row).
+ *
+ * Prefer `walkAuditChain` where the count matters — one break says a chain is unsound and
+ * nothing about how much of it is. This helper is for the callers that only need the verdict.
+ */
+export function findChainBreak(rows, opts) {
+    return walkAuditChain(rows, opts).breaks[0] ?? null;
+}
+/**
+ * Walk an org's rows (OLDEST-first, contiguous by seq) and enumerate EVERY broken link, plus
+ * every sealed epoch crossed. `findChainBreak` is this walk's first break.
+ *
+ * WHY ENUMERATE (OPE-1636): reporting only the first break answers "is this chain sound?" and
+ * nothing else. A live store measured 6,966 broken links across 53,218 rows while the CLI kept
+ * reporting one site per org, so the scale — and the concentration on the actions written
+ * outside a turn, which is what named the write-side cause — stayed invisible for weeks.
+ *
+ * THE WALK RESYNCS. After a broken link the walk does NOT stop and does not try to re-align:
+ * it takes the current row as the next segment's start and keeps comparing neighbours. So a
+ * single deleted row yields ONE break, not a break for every row after it, and the count is a
+ * count of DAMAGE SITES rather than of downstream rows.
+ *
+ * `expectGenesis` asserts rows[0].prev_sha === null — true only for a FULL walk from the org's
+ * genesis. It also gates epoch-seal verification: only a full walk holds the whole pre-epoch
+ * prefix the era digest commits to. When rows[0] IS an epoch marker the assertion becomes the
+ * seal's own: a marker at index 0 must seal an era of zero rows, or the walk reports the
+ * mismatch as a break.
+ *
+ * NOT detected (inherent, documented): mutation of the LAST row in the walked set — it has no
+ * successor yet to commit to it (the "tip is unanchored until the next append" property, the
+ * same reason a public claim needs an external witness on the head).
+ */
+export function walkAuditChain(rows, opts) {
+    const breaks = [];
+    const epochs = [];
+    let sealedThroughIndex = -1;
+    let breaksInsideSealedEra = 0;
+    if (rows.length === 0)
+        return { breaks, epochs, rowsWalked: 0, sealedThroughIndex, breaksInsideSealedEra };
+    const fullWalk = opts?.expectGenesis ?? false;
+    /**
+     * Report the epoch marker at `index`, and on a full walk re-verify ALL THREE of its claims —
+     * the row COUNT, the era DIGEST, and the number of links that were already BROKEN when it was
+     * sealed. Each one is a sentence an operator reads as fact. `breaks.length` at this point is
+     * exactly what a walk of the prefix would report, because a verified era's breaks are
+     * suppressed incrementally as the walk crosses it. On a window there is nothing to verify any
+     * claim against, so the seal is reported unverified and suppresses nothing.
+     */
+    const crossEpoch = (index, row, seal) => {
+        let mismatch = null;
+        if (fullWalk) {
+            if (seal.rowsBefore !== index)
+                mismatch = `epoch seal claims ${seal.rowsBefore} preceding row(s) but ${index} are present (pre-epoch rows were added or removed)`;
+            else if (seal.eraDigest !== auditEraDigest(rows.slice(0, index)))
+                mismatch = `epoch seal does not match the era it covers (era digest disagrees over ${index} row(s) — a pre-epoch row was mutated, or the rows were reordered)`;
+            else if (seal.breaksBefore !== breaks.length)
+                mismatch = `epoch seal claims ${seal.breaksBefore} broken link(s) in the era it covers but the walk finds ${breaks.length} (the seal under-reports what it sealed)`;
+        }
+        const sealVerified = fullWalk && mismatch === null;
+        epochs.push({ index, seq: row.seq, ts: row.ts, org: row.org, seal, sealVerified });
+        if (mismatch !== null) {
+            breaks.push({ index, seq: row.seq, ts: row.ts, org: row.org, action: row.action, reason: mismatch, expectedPrev: null, actualPrev: null });
+        }
+        else if (sealVerified) {
+            // The seal held every claim, so the era it covers moves from LINK evidence to DIGEST
+            // evidence and its individual breaks stop being listed. Suppress incrementally, not at
+            // the end: the running count above is what the next seal's `breaksBefore` is checked
+            // against, and it must mean the same thing a fresh walk of that prefix would mean.
+            breaksInsideSealedEra += breaks.length;
+            breaks.length = 0;
+            sealedThroughIndex = index;
+        }
+    };
+    // ROW 0 IS READ AS A POSSIBLE EPOCH TOO, and that is a security property rather than symmetry
+    // (OPE-1636 review). A marker carries a null prev_sha, so judging row 0 by `prevSha !== null`
+    // alone passes a marker off as an ordinary genesis: delete every pre-epoch row with the owner
+    // credential and the marker becomes row 0, the walk reports NO epoch, verifies NONE of the
+    // seal's three claims — `rows_before: 6966` against 0 rows present — and the verifier prints
+    // "chain intact". Crossing it here means a full walk requires `rowsBefore === 0` (nothing may
+    // precede row 0) and otherwise pushes the mismatch break, and a window still REPORTS the epoch
+    // so an operator has to vouch for it.
+    const first = rows[0];
+    const firstSeal = readAuditEpochSeal(first);
+    if (firstSeal !== null) {
+        crossEpoch(0, first, firstSeal);
+    }
+    else if (fullWalk && first.prevSha !== null) {
+        breaks.push({
+            index: 0,
+            seq: first.seq,
+            ts: first.ts,
+            org: first.org,
+            action: first.action,
+            reason: "genesis row carries a non-null prev_sha (rows before it were removed, or the chain was reset)",
+            expectedPrev: null,
+            actualPrev: first.prevSha,
+        });
+    }
+    for (let i = 1; i < rows.length; i++) {
+        const prev = rows[i - 1];
+        const cur = rows[i];
+        const seal = readAuditEpochSeal(cur);
+        if (seal !== null) {
+            // A DECLARED restart, not a break.
+            crossEpoch(i, cur, seal);
+            continue;
+        }
+        const expected = auditRowSha(prev, prev.prevSha);
+        if (cur.prevSha !== expected) {
+            breaks.push({
+                index: i,
+                seq: cur.seq,
+                ts: cur.ts,
+                org: cur.org,
+                action: cur.action,
+                reason: cur.prevSha === null
+                    ? "prev_sha is null mid-chain (a row's link was cleared — truncation/reset, or a pre-chain row that no epoch marker seals)"
+                    : "prev_sha does not match the recomputed hash of the preceding row (the predecessor was mutated, a row between them was deleted, or two writers appended concurrently and forked the chain)",
+                expectedPrev: expected,
+                actualPrev: cur.prevSha,
+            });
+        }
+    }
+    return { breaks, epochs, rowsWalked: rows.length, sealedThroughIndex, breaksInsideSealedEra };
+}
+/**
+ * Compute the seal a NEW epoch marker would carry over `rows` — the org's WHOLE chain, oldest
+ * first. Returns null when there is nothing to seal: an empty chain, or a chain whose last row
+ * is already an epoch marker (sealing an era of zero rows records nothing and buys nothing).
+ *
+ * `breaksBefore` is the honest part. It is measured, not assumed to be zero, so the marker says
+ * on its face how much of the era it sealed was already broken. That is what makes a seal a
+ * declaration rather than a way to bury a break.
+ */
+export function auditEpochSealFor(rows) {
+    if (rows.length === 0)
+        return null;
+    const last = rows[rows.length - 1];
+    if (readAuditEpochSeal(last) !== null)
+        return null;
+    return {
+        rowsBefore: rows.length,
+        firstSeqBefore: rows[0].seq,
+        lastSeqBefore: last.seq,
+        breaksBefore: walkAuditChain(rows, { expectGenesis: true }).breaks.length,
+        eraDigest: auditEraDigest(rows),
+    };
+}
+/** Broken links counted by the action of the row that carries them, descending. The distribution
+ *  is what names a write-side cause: a fork concentrates on the paths that write concurrently. */
+export function breaksByAction(breaks) {
+    const counts = new Map();
+    for (const b of breaks)
+        counts.set(b.action, (counts.get(b.action) ?? 0) + 1);
+    return [...counts.entries()]
+        .map(([action, count]) => ({ action, count }))
+        .sort((a, b) => b.count - a.count || a.action.localeCompare(b.action));
+}
+// ── Concurrency stance (per-org write serialisation) — CONCLUSION / WHY / FRAGILE ───────
+//
+// CONCLUSION: an audit append for one org is a read-last-row-then-insert, and the two
+// statements must not interleave for one org or two concurrent appends read the same
+// predecessor and stamp the SAME prev_sha — a FORK. Two locks, layered, keep them apart:
+//
+//  1. IN-PROCESS, and it lives in the STORE (withOrgAuditLock, called from sqlite.ts's and
+//     postgres.ts's appendAudit). It used to sit in audit.ts instead, which covered every
+//     caller that went through appendAudit and NOTHING else — operational/postgres.ts's own
+//     `audit.integrity` row writes the chain directly and forked it at every boot that
+//     repaired the append-only posture. At the store it covers every path by construction.
+//  2. CROSS-PROCESS, for hosted Postgres: the tail read and the insert run inside ONE
+//     transaction on ONE pinned connection, behind `pg_advisory_xact_lock` keyed on the org.
+//     The xact form releases at COMMIT/ROLLBACK, so it cannot leak a lock onto a pooled
+//     connection — the constraint that made the older session-level advisory lock unusable.
+//     The wait is BOUNDED by a `SET LOCAL lock_timeout` (postgres.ts's
+//     AUDIT_CHAIN_LOCK_TIMEOUT_MS): an append is awaited on the hot path, so a holder that dies
+//     mid-transaction must not stall the org's appends forever. Past the bound the append fails,
+//     audit.ts retries once and then drops the row with its counter and warn — a counted gap
+//     rather than a hung turn.
+//
+// WHY BOTH: layer 1 alone is what the deployment had, and it is exactly as wide as one
+// process. The hosted runtime answers ingress and control-plane HTTP in functions separate
+// from the turn, so the rows written OUTSIDE a turn — `control.service_call`,
+// `surface.wake_dropped` — are the ones two instances write at once. Measured on the live
+// store (OPE-1636, 2026-09-09): 6,966 broken links across 53,218 rows, led by
+// `control.service_call` (2,673) and `surface.wake_dropped` (1,436). Layer 1 is still
+// required: it keeps the local sqlite and embedded-PGlite floors correct with no DB lock at
+// all, and it is what stops two appends in one process from opening two transactions on the
+// one connection an embedded engine has.
+//
+// FRAGILE POINT: layer 2 needs a connection it can pin, which the `PgClient` port exposes as
+// the OPTIONAL `withConnection`. A client that does not offer one (the embedded PGlite floor,
+// a hand-rolled self-host client) falls back to the plain read-then-insert. That is correct
+// for the embedded floor, which holds a single-writer file lock and is one process by
+// construction; it is NOT correct for a pooled hosted client, so initOperationalSchema warns
+// once at boot when a Postgres store has no pinning seam.
+//
+// WHAT LAYER 2 COSTS, stated because the old stance justified the in-process design partly on
+// being cheap. An append on a pinned client is now five statements — BEGIN, the advisory lock,
+// the tail read, the INSERT, COMMIT — where it was two, and one org's appends queue behind the
+// whole round trip rather than behind the read and the insert. That is UNMEASURED against hosted
+// Postgres from this repo: the number that would settle it is a timed append burst for one org
+// against a real Neon endpoint, which no offline tier can produce. It is the price of a chain
+// that does not fork, and the fork rate it replaces was 13% of all rows.
+//
+// The honest framing has not changed at the top: a fork and a tamper both surface as a break,
+// and the chain guarantees DETECTION, not a third-party-verifiable proof, until an external
+// head-witness lands.
+const orgAppendChains = new Map();
+/**
+ * Serialise `fn` against other appends for the same `org` within this process (see the
+ * stance block above). Always-releasing: the stored tail runs `fn` regardless of the prior
+ * call's outcome and swallows so a rejection can't wedge the org's queue; the returned
+ * promise still carries `fn`'s real result/throw to the caller.
+ */
+export function withOrgAuditLock(org, fn) {
+    const prev = orgAppendChains.get(org) ?? Promise.resolve();
+    const run = prev.then(fn, fn);
+    orgAppendChains.set(org, run.then(() => undefined, () => undefined));
+    return run;
+}
+/** Default number of tail rows the boot check re-verifies per org. */
+const BOOT_TAIL_LIMIT = 32;
+/**
+ * Verify the LAST N rows' links for every org (a WINDOW, so expectGenesis is false —
+ * the window's first predecessor is out of frame). Read-only, NEVER throws: a store error
+ * on one org becomes that org's `error` note and the walk continues. Returns per-org
+ * reports; the caller decides how loudly to surface a break.
+ */
+export async function verifyAuditChainTail(store, opts) {
+    const tailLimit = opts?.perOrgTail ?? BOOT_TAIL_LIMIT;
+    let orgs;
+    try {
+        orgs = await store.listAuditOrgs();
+    }
+    catch (err) {
+        return [{ org: "*", break: null, breaks: [], epochs: [], error: `could not list audit orgs: ${String(err)}` }];
+    }
+    const reports = [];
+    for (const org of orgs) {
+        try {
+            const rows = await store.readAuditChain(org, { tailLimit });
+            const walk = walkAuditChain(rows, { expectGenesis: false });
+            reports.push({ org, break: walk.breaks[0] ?? null, breaks: walk.breaks, epochs: walk.epochs });
+        }
+        catch (err) {
+            reports.push({ org, break: null, breaks: [], epochs: [], error: `could not read audit chain: ${String(err)}` });
+        }
+    }
+    return reports;
+}
+/**
+ * Boot-time tail-check: verify each org's last N audit links and log ONE loud warn per
+ * detected break. DELIBERATELY availability-over-integrity — a chain break must NEVER crash
+ * the boot: the store still functions, refusing to serve would turn a detected-integrity
+ * signal into an outage, and the audit log's own `audit.integrity` posture record + this
+ * warn are the durable signals. Never throws (the whole body is guarded).
+ */
+export async function bootVerifyAuditChainTail(store, opts) {
+    try {
+        const reports = await verifyAuditChainTail(store, opts);
+        for (const r of reports) {
+            if (r.error) {
+                console.warn(`[open-everywhere:audit] chain tail-check could not read org "${r.org}": ${r.error}`);
+                continue;
+            }
+            for (const e of r.epochs) {
+                // A window cannot re-verify a seal, and an epoch is an operator act that should happen
+                // once. Seeing one in the last N rows is worth a line every boot until it ages out.
+                console.warn(`[open-everywhere:audit] ⚠ AUDIT CHAIN EPOCH for org "${r.org}" at seq ${e.seq} (${e.ts}): a sealed chain restart covering ` +
+                    `${e.seal.rowsBefore} earlier row(s) (${e.seal.breaksBefore} already broken when sealed). The seal is NOT verified from a tail ` +
+                    `window — run the full verifier (npm run audit:verify-chain) to check it.`);
+            }
+            if (r.break) {
+                const b = r.break;
+                const more = r.breaks.length > 1 ? ` (${r.breaks.length} broken link(s) in this window; first shown)` : "";
+                console.warn(`[open-everywhere:audit] ⚠ AUDIT CHAIN BREAK for org "${r.org}" at seq ${b.seq} (${b.ts}, action "${b.action}"): ${b.reason} ` +
+                    `[expected prev_sha ${b.expectedPrev ?? "null"}, found ${b.actualPrev ?? "null"}]${more} — the audit history may have been altered out of band; investigate (docs/security/audit-and-provenance.md).`);
+            }
+        }
+    }
+    catch (err) {
+        // Boot-critical guard: the tail-check is best-effort and must never block startup.
+        console.warn(`[open-everywhere:audit] chain tail-check failed to run (ignored — boot continues): ${String(err)}`);
+    }
+}
+//# sourceMappingURL=chain.js.map

package/dist/agent/audit/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../../agent/audit/chain.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,uFAAuF;AACvF,sFAAsF;AACtF,uFAAuF;AACvF,yFAAyF;AACzF,oFAAoF;AACpF,EAAE;AACF,oFAAoF;AACpF,wFAAwF;AACxF,0FAA0F;AAC1F,yFAAyF;AACzF,uFAAuF;AACvF,8EAA8E;AAC9E,EAAE;AACF,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,8FAA8F;AAC9F,gGAAgG;AAChG,2FAA2F;AAC3F,8DAA8D;AAC9D,+FAA+F;AAC/F,6FAA6F;AAC7F,+FAA+F;AAC/F,8FAA8F;AAC9F,8FAA8F;AAC9F,gGAAgG;AAChG,kCAAkC;AAClC,qFAAqF;AACrF,yFAAyF;AACzF,6EAA6E;AAC7E,gBAAgB;AAChB,0FAA0F;AAC1F,yFAAyF;AACzF,gEAAgE;AAChE,sFAAsF;AACtF,yFAAyF;AACzF,wCAAwC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC;;;gGAGgG;AAChG,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS,CAAC,uDAAuD;QACtF,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,CAAC;AAED;wFACwF;AACxF,MAAM,UAAU,WAAW,CAAC,GAAqB,EAAE,OAAsB;IACvE,MAAM,MAAM,GAAc;QACxB,OAAO;QACP,GAAG,CAAC,GAAG;QACP,GAAG,CAAC,EAAE;QACN,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,OAAO,IAAI,IAAI;QACnB,GAAG,CAAC,WAAW,IAAI,IAAI;QACvB,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;KAC9D,CAAC;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,8DAA8D;IAC9D,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,yFAAyF;AACzF,4FAA4F;AAC5F,6FAA6F;AAC7F,6FAA6F;AAC7F,wFAAwF;AACxF,EAAE;AACF,6FAA6F;AAC7F,+FAA+F;AAC/F,gGAAgG;AAChG,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,0FAA0F;AAC1F,6FAA6F;AAC7F,kGAAkG;AAClG,6FAA6F;AAC7F,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,+FAA+F;AAC/F,wEAAwE;AACxE,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,qFAAqF;AACrF,EAAE;AACF,6FAA6F;AAC7F,+FAA+F;AAC/F,kGAAkG;AAClG,+FAA+F;AAC/F,6FAA6F;AAC7F,EAAE;AACF,0FAA0F;AAC1F,gGAAgG;AAChG,iGAAiG;AACjG,wEAAwE;AAExE,qDAAqD;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAe5D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAA8B;IAC3D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,OAAO;QACL,KAAK,EAAE;YACL,WAAW,EAAE,IAAI,CAAC,UAAU;YAC5B,gBAAgB,EAAE,IAAI,CAAC,cAAc;YACrC,eAAe,EAAE,IAAI,CAAC,aAAa;YACnC,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAyD;IAC1F,IAAI,GAAG,CAAC,MAAM,KAAK,wBAAwB,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;IACnC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,MAAM,CAAC,GAAG,QAAmC,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnH,MAAM,WAAW,GAAG,CAAC,CAAU,EAA6B,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1H,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC;IAC/B,IAAI,UAAU,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,cAAc,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAChF,CAAC;AA+BD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAA8B,EAAE,IAA2C;IACxG,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACtD,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,cAAc,CAAC,IAA8B,EAAE,IAA2C;IACxG,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,IAAI,kBAAkB,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,CAAC;IAC3G,MAAM,QAAQ,GAAG,IAAI,EAAE,aAAa,IAAI,KAAK,CAAC;IAE9C;;;;;;;OAOG;IACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,GAAkB,EAAE,IAAoB,EAAQ,EAAE;QACnF,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK;gBAC3B,QAAQ,GAAG,qBAAqB,IAAI,CAAC,UAAU,yBAAyB,KAAK,qDAAqD,CAAC;iBAChI,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC9D,QAAQ,GAAG,0EAA0E,KAAK,oEAAoE,CAAC;iBAC5J,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM;gBAC1C,QAAQ,GAAG,qBAAqB,IAAI,CAAC,YAAY,2DAA2D,MAAM,CAAC,MAAM,0CAA0C,CAAC;QACxK,CAAC;QACD,MAAM,YAAY,GAAG,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACnF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7I,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,qFAAqF;YACrF,uFAAuF;YACvF,qFAAqF;YACrF,mFAAmF;YACnF,qBAAqB,IAAI,MAAM,CAAC,MAAM,CAAC;YACvC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAClB,kBAAkB,GAAG,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,2FAA2F;IAC3F,6FAA6F;IAC7F,8FAA8F;IAC9F,+FAA+F;IAC/F,sCAAsC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,CAAC;YACR,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,+FAA+F;YACvG,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,KAAK,CAAC,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,mCAAmC;YACnC,UAAU,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,CAAC;gBACR,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EACJ,GAAG,CAAC,OAAO,KAAK,IAAI;oBAClB,CAAC,CAAC,yHAAyH;oBAC3H,CAAC,CAAC,2LAA2L;gBACjM,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,CAAC;AAChG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8B;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG;QAC3B,aAAa,EAAE,IAAI,CAAC,GAAG;QACvB,YAAY,EAAE,cAAc,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;QACzE,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;kGACkG;AAClG,MAAM,UAAU,cAAc,CAAC,MAA6B;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,EAAE;AACF,sFAAsF;AACtF,qFAAqF;AACrF,yFAAyF;AACzF,EAAE;AACF,2FAA2F;AAC3F,0FAA0F;AAC1F,4FAA4F;AAC5F,uFAAuF;AACvF,2FAA2F;AAC3F,sFAAsF;AACtF,6FAA6F;AAC7F,wFAAwF;AACxF,4FAA4F;AAC5F,uEAAuE;AACvE,gGAAgG;AAChG,iGAAiG;AACjG,6FAA6F;AAC7F,+BAA+B;AAC/B,EAAE;AACF,uFAAuF;AACvF,2FAA2F;AAC3F,8EAA8E;AAC9E,0FAA0F;AAC1F,8EAA8E;AAC9E,sFAAsF;AACtF,4FAA4F;AAC5F,4FAA4F;AAC5F,yCAAyC;AACzC,EAAE;AACF,6FAA6F;AAC7F,8FAA8F;AAC9F,4FAA4F;AAC5F,sFAAsF;AACtF,6FAA6F;AAC7F,0DAA0D;AAC1D,EAAE;AACF,8FAA8F;AAC9F,+FAA+F;AAC/F,+FAA+F;AAC/F,iGAAiG;AACjG,+FAA+F;AAC/F,8FAA8F;AAC9F,yEAAyE;AACzE,EAAE;AACF,8FAA8F;AAC9F,4FAA4F;AAC5F,sBAAsB;AAEtB,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAI,GAAW,EAAE,EAAoB;IACnE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9B,eAAe,CAAC,GAAG,CACjB,GAAG,EACH,GAAG,CAAC,IAAI,CACN,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAsBD,sEAAsE;AACtE,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAyB,EAAE,IAAuC;IAC3G,MAAM,SAAS,GAAG,IAAI,EAAE,UAAU,IAAI,eAAe,CAAC;IACtD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,+BAA+B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAyB,EAAE,IAAuC;IAC/G,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnG,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACzB,uFAAuF;gBACvF,oFAAoF;gBACpF,OAAO,CAAC,IAAI,CACV,wDAAwD,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,qCAAqC;oBAC1H,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,oBAAoB,CAAC,CAAC,IAAI,CAAC,YAAY,qEAAqE;oBAChI,0EAA0E,CAC7E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;gBAClB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,8CAA8C,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3G,OAAO,CAAC,IAAI,CACV,wDAAwD,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG;oBAC5H,sBAAsB,CAAC,CAAC,YAAY,IAAI,MAAM,WAAW,CAAC,CAAC,UAAU,IAAI,MAAM,IAAI,IAAI,8GAA8G,CACxM,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mFAAmF;QACnF,OAAO,CAAC,IAAI,CAAC,sFAAsF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpH,CAAC;AACH,CAAC"}

package/dist/agent/audit/tool-action.d.ts

@@ -0,0 +1,26 @@
+import type { BindableContext } from "../identity/binding.js";
+/**
+ * Reduce a caught error to the ONE field an audit detail should carry: a short, scrubbed message.
+ *
+ * WHY THIS EXISTS (OPE-393, measured live 2026-08-11): `describe_image` audited
+ * `{ ok:false, reason:"vision-error" }` with NO error text, so a red e2e leg said only "the vision
+ * call failed" — the actual cause (the AI Gateway returning 403 "Your team has restricted access to
+ * this provider. Providers considered: alibaba") existed ONLY in the tool's model-facing message,
+ * which meant reading a child session's transcript to diagnose a one-line failure. A `reason` code
+ * classifies; it does not diagnose. Any tool auditing a caught failure should carry this too.
+ *
+ * Truncated to {@link MAX_AUDIT_ERROR_CHARS} and scrubbed of credential shapes — an upstream error
+ * string is attacker-influenceable and provider-echoed, so it is treated as untrusted TEXT: it is a
+ * diagnostic, never an instruction, and never a place a token gets to land.
+ *
+ * The scrub is a SEAM ({@link scrubForAudit}): the built-in arm always runs, and a deployment may
+ * register an `auditScrub` arm on AppConfig to ADD redactions for shapes it holds that the built-in
+ * does not know. The arm runs on the untruncated text, before the whitespace collapse, so it sees
+ * the whole message and cannot widen the row.
+ */
+export declare function auditErrorDetail(err: unknown): {
+    readonly error: string;
+};
+export declare function auditErrorFrames(err: unknown): string;
+export declare function auditToolAction(ctx: BindableContext, action: string, detail?: Readonly<Record<string, unknown>>): Promise<void>;
+//# sourceMappingURL=tool-action.d.ts.map

package/dist/agent/audit/tool-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-action.d.ts","sourceRoot":"","sources":["../../../agent/audit/tool-action.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAgG9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAKzE;AAmGD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAWrD;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACzC,OAAO,CAAC,IAAI,CAAC,CA+Bf"}