mindforge-cc 11.0.0 → 11.2.1

package/.agent/hooks/mindforge-statusline.js

@@ -84,7 +84,7 @@ process.stdin.on('end', () => {
             const todos = JSON.parse(fs.readFileSync(path.join(todosDir, files[0].name), 'utf8'));
             const inProgress = todos.find(t => t.status === 'in_progress');
             if (inProgress) task = inProgress.activeForm || '';
-          } catch (e) {}
+          } catch (e) { /* intentionally empty */ }
         }
       } catch (e) {
         // Silently fail on file system errors - don't break statusline
@@ -103,7 +103,7 @@ process.stdin.on('end', () => {
         if (cache.stale_hooks && cache.stale_hooks.length > 0) {
           mindforgeUpdate += '\x1b[31m⚠ stale hooks — run /mindforge:update\x1b[0m │ ';
         }
-      } catch (e) {}
+      } catch (e) { /* intentionally empty */ }
     }
 
     // Output

package/.mindforge/config.json

@@ -1,11 +1,11 @@
 {
-  "version": "10.7.0",
+  "version": "11.2.1",
   "environment": "development",
   "governance": {
     "drift_threshold": 0.75,
     "critical_drift_threshold": 0.5,
     "res_threshold": 0.8,
-    "active_did": "did:mindforge:da5daf83-c478-490f-b528-bd907ad4eee3"
+    "active_did": "did:mindforge:cbca5a94-a796-4919-a1a3-d0488f228611"
   },
   "revops": {
     "market_registry": {
@@ -18,6 +18,8 @@
       "claude-sonnet-4-6": {
         "cost_input": 0.003,
         "cost_output": 0.015,
+        "cost_cache_read": 0.0003,
+        "cost_cache_creation": 0.00375,
         "benchmark": 99,
         "provider": "Anthropic"
       },
@@ -42,12 +44,16 @@
       "claude-haiku-4-5": {
         "cost_input": 0.0002,
         "cost_output": 0.0004,
+        "cost_cache_read": 0.00002,
+        "cost_cache_creation": 0.00025,
         "benchmark": 82,
         "provider": "Anthropic"
       },
       "claude-opus-4-7": {
         "cost_input": 0.015,
         "cost_output": 0.075,
+        "cost_cache_read": 0.0015,
+        "cost_cache_creation": 0.01875,
         "benchmark": 100,
         "provider": "Anthropic"
       }
@@ -56,9 +62,12 @@
     "premium_fallback_model": "claude-opus-4-7"
   },
   "security": {
-    "pqas_enabled": true,
+    "pqas_enabled": false,
     "enclave_tier": 2,
-    "provider": "simulated-lattice"
+    "provider": "Dilithium-5 (simulated — inactive)"
+  },
+  "experimental": {
+    "pqc_demo": false
   },
   "mesh": {
     "node_id": "beta-node",
@@ -98,6 +107,7 @@
   },
   "cost_routing": {
     "enabled": true,
+    "shadow_mode": true,
     "simple_threshold": 3,
     "standard_threshold": 6,
     "complex_threshold": 8,

package/CHANGELOG.md

@@ -1,5 +1,142 @@
 # Changelog
 
+## [11.2.1] - 2026-05-31 — "Hardening" (security & integrity audit remediation)
+
+Post-v11.2.0 audit remediation. Closes every exploitable security defect and
+false-assurance stub surfaced by the end-to-end audit. No new features, no
+breaking changes — fixes and honest-labeling only.
+
+### Security (fixed)
+
+- **trust-gate-hook**: scans the whole command + every line (a benign first line could previously cloak a destructive later line)
+- **orbital-guardian**: `verify()` re-checks the Ed25519 attestation signature (added `did`/`signed_message` columns + migration); rejects forged APPROVED rows
+- **policy-engine**: `reasoning_proof` alone no longer bypasses the blast-radius limit (`isProofValid` inits false; cryptographic `pq_proof` path unchanged)
+- **shadow-mirror**: git calls use `execFileSync` (argv) + fail-closed `sanitizeRemediationId()` — closes command injection via `remediation_id`
+- **trust-boundaries `isHighImpact`**: added chmod/chown/dd/mv/kill/shutdown/eval/command-substitution/redirect detection + shell-obfuscation normalization; narrowed interpreter-script pattern to stop false-positives on `node <projectfile>`
+- **eis-client**: `verifyRemoteProvenance` delegates to real ZTAI signature verification, fail-closed (was returning true for any non-empty signature)
+
+### Integrity / honest labeling (fixed)
+
+- **ztai-archiver**: `verifyIntegrity()` recomputes the Merkle root from the live log (was a no-op `return true`); fail-closed on tamper/delete/reorder
+- **mesh-self-healer**: emits an honest degraded advisory instead of fabricated 94%/100% consensus
+- **logic-validator**: probes Ollama when reachable, honest heuristic fallback; stopped advertising the dead model path
+- **reason-source-aligner**: consistent return shape (uninitialized no longer silently disables the mission-fidelity gate); real Jaccard similarity
+- **sre-manager**: HMAC artifact relabeled as integrity tag, not "ZK-Proof"
+- **installer-core**: PQAS-enabled message gated on the real `experimental.pqc_demo` flag
+- **finding-synthesizer**: detects real severity-gap contradictions (was hardcoded `[]`)
+- **logic-drift-detector**: relabeled heuristic, not "Neural"
+- **session-manager / shadow-mirror(docker) / regression-writer / skill-registry**: honest disclosure instead of silent empties / fake isolation / tautological tests / mock placeholders
+- **MINDFORGE.md**: `[PQAS_ENFORCED]` reconciled to reflect simulated/inactive default; **ztai-manager** logs relabeled `[ZTAI-HSM-SIM]`
+
+### CI / hygiene
+
+- **release workflow**: asserts the git tag matches `package.json` version (fail-closed) + skips publish if the version is already on npm
+- **version-check**: runtime drift check widened to all 4 sources (was 2); SDK README guarded by test
+- removed dead `AuditRotator` class (CHANGELOG had wrongly claimed it removed); deprecated orphaned `createAppendQueue`
+- refreshed stale `v11.1.0` banners → current; added `cost_routing.shadow_mode` latch
+- version bumped to 11.2.1 across all sources
+
+## [11.2.0] - 2026-05-31 — "Verification & Trust"
+
+### Added
+
+- **UC-08 — Unified Verification Runner**
+  - `bin/engine/verification-runner.js`: orchestrates test/lint/audit/typecheck stages into structured results with pass/fail/skip per stage
+  - `bin/engine/verify-cli.js`: CLI entrypoint writing `.planning/VERIFICATION.md` reports
+  - `mindforge verify` command registered in CLI
+
+- **UC-25 — Eval Harness**
+  - `bin/eval/eval-harness.js`: recall@k, nDCG (graded relevance), and `runEval()` orchestrator for measuring retrieval quality
+  - `bin/eval/golden-set-retrieval.json`: 10-query seed golden set covering orchestration, security, memory, cost, verification, hooks, and architecture domains
+
+- **UC-22 — Tool/MCP Trust Boundaries**
+  - `bin/security/trust-boundaries.js`: manifest pinning (deterministic SHA-256 with recursive key sort), tamper detection, untrusted output tagging with provenance, and high-impact command detection
+  - `bin/security/trust-gate-hook.js`: PreToolUse hook that blocks destructive Bash commands (rm -rf, force-push, DROP TABLE, hard reset) via native Claude Code hooks
+  - Trust-gate registered in `.claude/settings.json` PreToolUse
+
+- **Council CLI**
+  - `bin/council-cli.js`: thin wrapper wiring `runCouncil` to the `/mindforge:council` command with structured JSON output and formatted display
+
+### Fixed
+
+- `auto-runner.js`: removed erroneous `new` on singleton ZTAIManager instance (was line 692)
+
+### Removed
+
+- Dead `quantum-verify` CLI command entry (no handler existed)
+- Dead `AuditRotator` class and its export from `bin/utils/file-io.js` (zero callers; rotation broke the hash chain at rotation boundaries — see `bin/autonomous/audit-writer.js`)
+
+### Changed
+
+- Config `pqas_signing` provider clarified as "Dilithium-5 (simulated — inactive)"
+- Banner version strings updated to v11.1.0 in self-corrective-synthesizer and remediation-engine
+- SDK README heading updated to "New in v11.1.0"
+- Version bumped to 11.2.0 across package.json and config.json
+
+---
+
+## [11.1.0] - 2026-05-31 — "Beast Mode"
+
+### Added
+
+- **Pillar I — Integrity & Trust**
+  - `bin/utils/append-queue.js`: single-writer fsync'd append queue for concurrent-safe durable writes (UC-09)
+  - `bin/governance/audit-hash.js`: single canonical SHA-256 hasher shared by writer + verifier (UC-04)
+  - `bin/governance/audit-verifier.js` + `bin/verify-audit.js` CLI: fail-closed hash-chain verifier (`exit 1` on any break) (UC-04)
+  - All 7 audit-write paths unified through `appendAuditEntrySync` — the audit log is now genuinely tamper-evident with a verifiable prev-hash chain (UC-04b)
+  - Simulated PQC demoted: `pqas_enabled=false` by default, gated behind `experimental.pqc_demo`; Tier-3 uses real Ed25519 (UC-24)
+
+- **Pillar II — Orchestration Correctness**
+  - `bin/autonomous/dependency-dag.js`: real Kahn topological sort + cycle detection, ported from test-only to the engine (UC-03)
+  - `planWaves(handoffs, {useDag:true})` opt-in DAG wave planning — explicit `.wave` always wins, legacy default unchanged (UC-03)
+  - Pre-flight cycle detection halts loud before any wave executes (UC-03)
+  - Wave-boundary timeout enforcement: `isTimedOut` + status `'timeout'` + resumable state (UC-14)
+  - Opt-in rollback hook records intent on terminal ESCALATE (no auto git-reset by default) (UC-14)
+  - `bin/engine/council-runtime.js`: minimal 4-voice council runtime (ADS loop) with injectable model, consensus scoring, dissent capture (UC-10)
+
+- **Pillar III — Cost-Aware Routing**
+  - `bin/models/pricing-registry.js`: single source of truth for model pricing, loaded from `config.json` market_registry (UC-05)
+  - All 3 providers routed through the registry — hardcoded pricing eliminated (UC-05)
+  - Prompt-cache accounting: `cache_control:{type:'ephemeral'}` on system blocks, `cache_read`/`cache_creation` parsed + priced at ~10% input rate (UC-21)
+  - `bin/models/difficulty-scorer.js`: heuristic 1-10 scorer with Tier-3 floor (UC-06)
+  - Shadow-mode difficulty routing: logs intended model without changing actual selection (UC-06)
+
+- **Pillar IV — Native Alignment + Observability**
+  - `.claude/settings.json` with hooks under real native events (`PostToolUse`/`PreToolUse`/`SessionStart`) — the security guard and context monitor now actually fire (UC-19a)
+  - `bin/hooks/instinct-capture-hook.js`: auto-captures behavioral patterns via PostToolUse, respects session limit (UC-11)
+  - `bin/engine/otel-exporter.js`: optional OTel GenAI exporter mapping NexusTracer spans to `gen_ai.*` semantic conventions, gated behind `OTEL_EXPORTER_OTLP_ENDPOINT` (UC-18)
+  - `bin/memory/retrieval-fusion.js`: Reciprocal Rank Fusion (RRF) over knowledge-graph + BM25 retrieval paths, replacing incomparable linear blends (UC-20)
+
+### Fixed
+
+- Audit-writer `close()` data-loss bug: threshold-triggered flushes were un-awaited, losing up to 10 entries on close (UC-09)
+- Audit-writer flush failure no longer crashes the process via unhandled rejection — logs to stderr (UC-09)
+- Vector-hub exit guard: `_dirty` boolean → pending-saves counter, closing a window where scheduled-but-unwritten saves were lost on hard exit (UC-09)
+- `isTimedOut` fails CLOSED on malformed `timeout_at` (garbage deadline = halt, not run unbounded) (UC-14)
+- Council position validation rejects NaN confidence / invalid recommendations (UC-10)
+- Dissent is now captured under NO_CONSENSUS verdict (the deadlock case where it matters most) (UC-10)
+- Pre-flight DAG check only cycle-checks stable-id tasks (id-less tasks can't be dependency targets) (UC-03)
+- `groupIntoWaves` self-defends: dangling dep throws "Unknown dependency" (not misleading "Circular") (UC-03)
+
+### Changed
+
+- Audit rotation retired (it broke the hash chain at every 5000-line boundary); AUDIT.jsonl grows unbounded for now — chain-aware compaction is a deferred future feature (UC-04b)
+- `knowledge-store.js` appends now use `appendDurableSync` (openSync+writeSync+fsyncSync+closeSync) for guaranteed durability (UC-09)
+- `auto-shadow.js` `generateShadowContext()` now fuses retrieval paths via RRF instead of a single-path linear blend (UC-20)
+
+### Removed
+
+- Orphaned `createAuditWriter` buffered path (zero production callers after UC-04b unification)
+- Hardcoded per-token pricing from `anthropic-provider.js`, `openai-provider.js`, `gemini-provider.js` (replaced by PricingRegistry)
+
+## [11.0.1] - 2026-05-30 — "Stability Patch"
+
+### Fixed
+
+- **Version drift**: reconciled `.mindforge/config.json` (was 10.7.0) with the 11.x line; added a fail-closed pre-flight version-consistency assertion (`bin/utils/version-check.js`) and a regression test that runs the migration and asserts its post-state, so the drift cannot silently return. (UC-01)
+- **Lint & dead code**: resolved all 109 ESLint errors, removed orphaned `bin/dashboard/team-tracker.js`, and made CI fail on any lint error. Fixed a latent `no-const-assign` runtime crash in `bin/review/ads-engine.js`. (UC-02)
+- **SDK `executeCommand` no-op**: replaced the published no-op stub (which made `batchExecute` report every task "fulfilled" while executing nothing) with a real `child_process.spawn` executor with stdout/stderr capture, timeout (SIGTERM→SIGKILL), and exit-code propagation; added a regression test against the compiled dist. (UC-07a)
+
 ## [11.0.0] - 2026-05-28 — "Sovereign Stability"
 
 ### Breaking Changes

package/MINDFORGE.md

@@ -1,12 +1,12 @@
-# MINDFORGE.md — Parameter Registry (v11.0.0)
+# MINDFORGE.md — Parameter Registry (v11.2.1)
 
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.0.0
+[VERSION] = 11.2.1
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
-[REQUIRED_CORE_VERSION] = 11.0.0
+[REQUIRED_CORE_VERSION] = 11.2.1
 [SOVEREIGN_IDENTITY] = true
 [SRE_LAYER_ENABLED]  = true
 
@@ -26,7 +26,7 @@
 [ZTAI_KEY_TYPE] = "Dilithium-5"
 [NEXUS_TRACE_RETENTION_DAYS] = 30
 [CADIA_CORE] = true
-[PQAS_ENFORCED] = true
+[PQAS_ENFORCED] = false  # PQAS is SIMULATED/inactive by default (config: pqas_enabled=false, gated behind experimental.pqc_demo). Tier-3 trust uses real Ed25519. See .mindforge/config.json + bin/governance/quantum-crypto.js.
 [PROACTIVE_HOMING] = true
 
 ---
@@ -100,6 +100,6 @@ The following parameters cannot be overridden by plugins, agents, or session-lev
 - [MIN_SOUL_SCORE] — Minimum SOUL score required for architectural changes
 - [BLOCK_ON_SECURITY] — Security gate enforcement cannot be disabled
 - [COST_HARD_LIMIT_USD] — Hard cost limit cannot be raised without human approval
-- [PQAS_ENFORCED] — Post-quantum security cannot be disabled
+- [BLOCK_ON_SECURITY] is non-overridable; PQAS itself is simulated/experimental (inactive by default) and is NOT a non-overridable guarantee — do not rely on it as an enforced control
 - [SOVEREIGN_IDENTITY] — Identity verification is always required
 - [ENABLE_ZTAI] — Zero-trust identity cannot be bypassed

package/RELEASENOTES.md

@@ -266,7 +266,7 @@ If your scripts call `mindforge sync-jira` or `mindforge sync-confluence`, remov
 ### Step 6: Verify
 
 ```bash
-npx mindforge-cc --version   # Should print 10.0.1
+npx mindforge-cc --version   # Should print 11.0.0
 npm test                      # All 41 tests should pass
 ```
 

package/bin/autonomous/audit-writer.js

@@ -1,103 +1,125 @@
 /**
- * MindForge — Audit Writer (Async Buffered)
- * Extracted from auto-runner.js — handles all JSONL audit append operations.
- * Buffers entries and flushes every 100ms or when buffer reaches 10 entries.
+ * MindForge — Audit Writer (Synchronous Durable, Hash-Chained)
+ *
+ * Provides the ONE unified audit-append primitive {@link appendAuditEntrySync}
+ * that every audit write site funnels through, producing a single verifiable
+ * hash chain (UC-04 / UC-04b).
+ *
+ * Retired in UC-04b: the old buffered async writer (`createAuditWriter`) and its
+ * AuditRotator-based 5000-line rotation. Rotation BROKE the hash chain — archiving
+ * + truncating AUDIT.jsonl orphaned the carried head's `previous_hash` from an entry
+ * no longer on disk, so the verifier failed closed on a rotated-but-untampered file.
+ * As a result AUDIT.jsonl now grows UNBOUNDED. That is an accepted short-term tradeoff
+ * at single-operator/dev scale. The proper fix — chain-aware compaction (archive old
+ * entries AND re-anchor the first carried entry to previous_hash=null so the live tail
+ * verifies standalone) — is a DEFERRED future feature, intentionally NOT in scope here.
  */
 'use strict';
 
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
-const { AuditRotator } = require('../utils/file-io');
-
-const FLUSH_INTERVAL_MS = 100;
-const FLUSH_THRESHOLD = 10;
-
-const rotator = new AuditRotator({ maxLines: 5000 });
+const { hashAuditEntry } = require('../governance/audit-hash');
 
 /**
- * Creates a buffered async audit writer.
- * @param {string} auditPath — Path to the AUDIT.jsonl file
- * @returns {{ write: (entry: object) => void, flush: () => Promise<void>, close: () => Promise<void> }}
+ * Computes the SHA-256 hash of an entry chained to its predecessor (UC-04).
+ * Delegates to the canonical {@link hashAuditEntry} (bin/governance/audit-hash.js)
+ * so the writer and verifier share ONE hasher — material drift is impossible.
+ * The material is {...entry, previous_hash} where `entry` does NOT contain `_hash`.
+ * @param {object} entry — entry WITHOUT a `_hash` field
+ * @param {string|null} previousHash — prior entry's `_hash` (null for the first link)
+ * @returns {string} hex-encoded SHA-256 digest
  */
-function createAuditWriter(auditPath) {
-  let buffer = [];
-  let flushTimer = null;
-  let isClosed = false;
-
-  function scheduleFlush() {
-    if (flushTimer !== null) return;
-    flushTimer = setTimeout(async () => {
-      flushTimer = null;
-      await flush();
-    }, FLUSH_INTERVAL_MS);
-  }
-
-  /**
-   * Adds an entry to the buffer. Triggers flush if threshold reached.
-   * Stamps entry with id and timestamp if missing (immutable — creates new object).
-   */
-  function write(entry) {
-    if (isClosed) {
-      throw new Error('AuditWriter is closed — cannot write after close()');
-    }
-
-    const stamped = Object.assign(Object.create(null), entry, {
-      id: entry.id || crypto.randomBytes(8).toString('hex'),
-      timestamp: entry.timestamp || new Date().toISOString(),
-    });
-
-    buffer = [...buffer, stamped];
-
-    if (buffer.length >= FLUSH_THRESHOLD) {
-      // Immediate flush — don't wait for timer
-      if (flushTimer !== null) {
-        clearTimeout(flushTimer);
-        flushTimer = null;
-      }
-      flush();
-    } else {
-      scheduleFlush();
-    }
-
-    return stamped;
-  }
-
-  /**
-   * Flushes the buffer to disk using async appendFile.
-   */
-  async function flush() {
-    if (buffer.length === 0) return;
-
-    const toWrite = buffer;
-    buffer = [];
+function hashEntry(entry, previousHash) {
+  return hashAuditEntry(entry, previousHash);
+}
 
-    const payload = toWrite.map(e => JSON.stringify(e)).join('\n') + '\n';
-    await fs.promises.appendFile(auditPath, payload);
+/**
+ * Reads the `_hash` of the last entry already on disk so a re-opened writer
+ * continues the existing chain instead of starting a fresh, disconnected one.
+ * @param {string} auditPath — path to the AUDIT.jsonl file
+ * @returns {string|null} last `_hash`, or null if absent/unreadable/empty
+ */
+function readLastHash(auditPath) {
+  try {
+    const lines = fs.readFileSync(auditPath, 'utf8').split('\n').filter(Boolean);
+    if (lines.length === 0) return null;
+    const last = JSON.parse(lines[lines.length - 1]);
+    return last._hash || null;
+  } catch { return null; }
+}
 
-    try {
-      if (rotator.shouldRotate(auditPath)) {
-        const archiveDir = path.join(path.dirname(auditPath), '..', '.planning', 'audit-archive');
-        rotator.rotate(auditPath, archiveDir);
-      }
-    } catch (err) {
-      process.stderr.write(`[audit-writer] rotation warning: ${err.message}\n`);
-    }
-  }
+// ── Unified synchronous-durable chained append (UC-04b) ───────────────────────
+// ONE primitive that ALL audit write sites funnel through, producing a single
+// verifiable chain via the canonical hashAuditEntry. Synchronous + fsync'd so an
+// acknowledged write is on disk before the call returns (UC-09 durability) — this
+// is what lets us delete the old raw `appendFileSync` shadow-writes: the durable
+// sync write gives in-process consumers (e.g. StuckMonitor, which is fed the event
+// object directly but may also re-read the file) immediate, durable data.
+//
+// Chain head caching: re-reading the file's tail on every append is O(file) — bad
+// on hot paths. Instead we keep a per-path in-memory lastHash (Map keyed by the
+// RESOLVED absolute path), seeded ONCE from the file's last entry on the first
+// append, then advanced in-process for O(1) appends. If the cache is cold (new
+// process, or a path never written in this process) we seed from disk — so a
+// second process correctly continues the on-disk chain from its tail.
+//
+// Concurrency: within a process this is fully synchronous, so calls cannot
+// interleave and the cached lastHash is always current. ACROSS processes, each
+// process seeds from the file tail on its first append; this is correct only under
+// the single-operator model (no two processes appending CONCURRENTLY to the same
+// audit file). MindForge runs one autonomous operator at a time, so this holds.
+const _lastHashCache = new Map(); // resolvedPath -> last `_hash` written/seen
 
-  /**
-   * Flushes remaining entries and stops the timer. After close(), write() will throw.
-   */
-  async function close() {
-    isClosed = true;
-    if (flushTimer !== null) {
-      clearTimeout(flushTimer);
-      flushTimer = null;
-    }
-    await flush();
+/**
+ * Synchronously appends ONE hash-chained, durable entry to an audit JSONL file.
+ * This is the single unified append used by every audit write site (UC-04b).
+ *
+ * NOTE: performs an fsync (openSync('a') + writeSync + fsyncSync + closeSync) on
+ * EVERY call. This is deliberate for audit integrity/durability — but it makes the
+ * call relatively expensive, so it is intended for audit-grade events, NOT for
+ * high-frequency telemetry. Hot-path callers (e.g. nexus-tracer span/reasoning
+ * events) pay one fsync per event; keep that cost in mind before adding new hot
+ * write sites.
+ *
+ * @param {string} auditPath — path to the AUDIT.jsonl file
+ * @param {object} event — the event payload (id/timestamp stamped if missing)
+ * @returns {object} the stamped + chained entry actually written
+ */
+function appendAuditEntrySync(auditPath, event) {
+  const resolved = path.resolve(auditPath);
+
+  // 1. Stamp id + timestamp if missing — immutable (new object, never mutate input).
+  const stamped = {
+    ...event,
+    id: event.id || crypto.randomBytes(8).toString('hex'),
+    timestamp: event.timestamp || new Date().toISOString(),
+  };
+
+  // 2. Seed previous_hash: prefer the warm in-process cache; fall back to the
+  //    file's last entry when cold (first append in this process for this path).
+  let previous_hash = _lastHashCache.has(resolved)
+    ? _lastHashCache.get(resolved)
+    : readLastHash(resolved);
+
+  // 3. Compute _hash over {...stamped, previous_hash} WITHOUT _hash in the material.
+  const _hash = hashEntry(stamped, previous_hash);
+
+  // 4. Write {...stamped, previous_hash, _hash} as one JSON line, durably+synchronously
+  //    (openSync('a') + writeSync + fsyncSync + closeSync — mirrors appendDurableSync).
+  const chained = { ...stamped, previous_hash, _hash };
+  fs.mkdirSync(path.dirname(resolved), { recursive: true });
+  const fd = fs.openSync(resolved, 'a');
+  try {
+    fs.writeSync(fd, JSON.stringify(chained) + '\n');
+    fs.fsyncSync(fd);
+  } finally {
+    fs.closeSync(fd);
   }
 
-  return Object.freeze({ write, flush, close });
+  // 5. Advance the in-process chain head and return the written entry.
+  _lastHashCache.set(resolved, _hash);
+  return chained;
 }
 
-module.exports = { createAuditWriter };
+module.exports = { appendAuditEntrySync };