compartment 2.2__tar.gz → 2.3__tar.gz

{compartment-2.2 → compartment-2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: compartment
-Version: 2.2
+Version: 2.3
 Summary: Compartment - high-security, fully offline, encrypted vector memory for AI agents (MCP)
 Project-URL: Homepage, https://github.com/MaxFreedomPollard/Compartment
 Project-URL: Source, https://github.com/MaxFreedomPollard/Compartment

{compartment-2.2 → compartment-2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "compartment"
-version = "2.2"
+version = "2.3"
 description = "Compartment - high-security, fully offline, encrypted vector memory for AI agents (MCP)"
 readme = "README.md"
 requires-python = ">=3.11"

{compartment-2.2 → compartment-2.3}/src/compartment/__init__.py

@@ -1,6 +1,6 @@
 """Compartment - high-security, fully offline, encrypted vector memory for AI agents."""
 
-__version__ = "2.2"
+__version__ = "2.3"
 
 from . import offline_guard as _og
 

compartment-2.3/src/compartment/audit.py

@@ -0,0 +1,103 @@
+"""Hash-chained, tamper-evident audit log (stored inside the sealed payload).
+
+Each entry's hash covers the previous entry's hash, so any edit, deletion,
+or reordering of history breaks the chain at a detectable point.
+A failure to write the audit entry fails the operation (fail-fast), never
+the other way around.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import time
+
+GENESIS = "GENESIS"
+
+
+def _entry_hash(prev_hash: str, ts: float, caller: str, op: str, detail: str) -> str:
+    body = json.dumps(
+        {"prev": prev_hash, "ts": ts, "caller": caller, "op": op, "detail": detail},
+        sort_keys=True, separators=(",", ":"),
+    ).encode()
+    return hashlib.sha256(body).hexdigest()
+
+
+def append(conn, caller: str, op: str, detail: str, ts: float | None = None) -> str:
+    """Add an entry, linked to whatever is currently at the head.
+
+    `ts` is only passed when replaying a journalled operation, so the entry
+    keeps the time it actually happened. It is still linked to the head as it
+    stands at replay time, never to the head the original writer saw: that
+    head may never have reached disk (read operations are audited in RAM and
+    persist only on save), and chaining to an entry nobody else has is what
+    leaves a dangling link no future verify can resolve."""
+    row = conn.execute("SELECT hash FROM audit ORDER BY seq DESC LIMIT 1").fetchone()
+    prev = row["hash"] if row else GENESIS
+    ts = time.time() if ts is None else ts
+    h = _entry_hash(prev, ts, caller, op, detail)
+    conn.execute(
+        "INSERT INTO audit (ts, caller, op, detail, prev_hash, hash) VALUES (?,?,?,?,?,?)",
+        (ts, caller, op, detail, prev, h),
+    )
+    return h
+
+
+def head(conn) -> str:
+    row = conn.execute("SELECT hash FROM audit ORDER BY seq DESC LIMIT 1").fetchone()
+    return row["hash"] if row else GENESIS
+
+
+def verify(conn) -> tuple[bool, int, str]:
+    """Walk the chain. Returns (ok, entries_checked, message)."""
+    prev = GENESIS
+    n = 0
+    for row in conn.execute("SELECT * FROM audit ORDER BY seq"):
+        if row["prev_hash"] != prev:
+            return False, n, f"chain break at seq {row['seq']}: prev_hash mismatch"
+        want = _entry_hash(prev, row["ts"], row["caller"], row["op"], row["detail"])
+        if row["hash"] != want:
+            return False, n, f"chain break at seq {row['seq']}: entry hash mismatch"
+        prev = row["hash"]
+        n += 1
+    return True, n, f"audit chain intact ({n} entries)"
+
+
+def relink(conn) -> tuple[int, int | None]:
+    """Re-link entries whose prev_hash points at something not in the log.
+
+    Only for repairing damage done by builds before this one, which replayed a
+    journalled entry with the head its original writer saw rather than the head
+    the log actually has. The result was a permanent dangling link: verify
+    stopped at it and never reported anything after it again.
+
+    What this does NOT do is paper over an edit. Every entry's own hash covers
+    its content, so content tampering is caught by the self-hash check and this
+    refuses to touch a log that fails it. Only the links are rebuilt, and only
+    forward from the first break. Nothing is deleted, reordered or reworded:
+    ts, caller, op and detail are exactly what they were.
+
+    Returns (entries relinked, seq of the first break) - (0, None) if intact."""
+    rows = conn.execute("SELECT * FROM audit ORDER BY seq").fetchall()
+    for row in rows:
+        want = _entry_hash(row["prev_hash"], row["ts"], row["caller"], row["op"],
+                           row["detail"])
+        if row["hash"] != want:
+            raise ValueError(
+                f"audit entry seq {row['seq']} does not hash to its own content. "
+                "That is content tampering, not a dangling link, and relinking "
+                "would destroy the evidence. Refusing.")
+
+    prev, first, changed = GENESIS, None, 0
+    for row in rows:
+        if row["prev_hash"] != prev:
+            if first is None:
+                first = row["seq"]
+        if first is not None:                    # rewrite everything after it
+            h = _entry_hash(prev, row["ts"], row["caller"], row["op"], row["detail"])
+            conn.execute("UPDATE audit SET prev_hash = ?, hash = ? WHERE seq = ?",
+                         (prev, h, row["seq"]))
+            changed += 1
+            prev = h
+        else:
+            prev = row["hash"]
+    return changed, first

{compartment-2.2 → compartment-2.3}/src/compartment/cli.py

@@ -468,6 +468,25 @@ def cmd_audit(args) -> None:
         sys.exit(2)
 
 
+def cmd_audit_repair(args) -> None:
+    v = _open_vault(args)
+    try:
+        changed, first = audit.relink(v.db.conn)
+    except ValueError as exc:
+        _die(str(exc))
+    if not changed:
+        _print({"ok": True, "relinked": 0, "message": "audit chain already intact"})
+        return
+    v._audit_and_capture("user", "audit-repair",
+                         f"relinked {changed} entries from seq {first}")
+    v.save()
+    ok, n, msg = audit.verify(v.db.conn)
+    _print({"ok": ok, "relinked": changed, "first_break_at_seq": first,
+            "entries": n, "message": msg, "head": audit.head(v.db.conn)})
+    if not ok:
+        sys.exit(2)
+
+
 def cmd_verify(args) -> None:
     loaded = read_vault_file(args.vault)   # structure + format checks
     out = {"vault": args.vault, "format": "ok",
@@ -1165,6 +1184,8 @@ def main(argv: list[str] | None = None) -> None:
     pa_sub = pa.add_subparsers(dest="audit_cmd", required=True)
     p = pa_sub.add_parser("verify", help="verify the hash chain")
     p.set_defaults(fn=cmd_audit)
+    p = pa_sub.add_parser("repair", help="re-link a chain broken by an older build")
+    p.set_defaults(fn=cmd_audit_repair)
 
     p = sub.add_parser("verify", help="check vault structure + signed manifest")
     p.set_defaults(fn=cmd_verify)

{compartment-2.2 → compartment-2.3}/src/compartment/vault.py

@@ -359,12 +359,14 @@ class Vault:
             self.db.delete_relation(e["id"])
         else:
             raise TamperError(f"Unknown journal op {op!r}")
+        # Link to the head this log actually has, keeping the original time.
+        # The writer's own head may never have reached disk - a read is audited
+        # in RAM and persists only on save - so replaying its prev_hash
+        # verbatim leaves a link pointing at an entry no one else has, and
+        # verify stops there permanently. The journal entry's contents are
+        # already AEAD-authenticated, so nothing is lost by re-linking.
         a = e["audit"]
-        self.db.conn.execute(
-            "INSERT INTO audit (ts, caller, op, detail, prev_hash, hash)"
-            " VALUES (?,?,?,?,?,?)",
-            (a["ts"], a["caller"], a["op"], a["detail"], a["prev_hash"], a["hash"]),
-        )
+        audit.append(self.db.conn, a["caller"], a["op"], a["detail"], ts=a["ts"])
 
     def _audit_and_capture(self, caller: str, op: str, detail: str) -> dict:
         audit.append(self.db.conn, caller, op, detail)

{compartment-2.2 → compartment-2.3}/src/compartment.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: compartment
-Version: 2.2
+Version: 2.3
 Summary: Compartment - high-security, fully offline, encrypted vector memory for AI agents (MCP)
 Project-URL: Homepage, https://github.com/MaxFreedomPollard/Compartment
 Project-URL: Source, https://github.com/MaxFreedomPollard/Compartment

{compartment-2.2 → compartment-2.3}/src/compartment.egg-info/SOURCES.txt

@@ -41,6 +41,7 @@ src/compartment/data/hermes-plugin/plugin.yaml
 src/compartment/models/bge-small-en-v1.5-int8/model_quantized.onnx
 src/compartment/models/bge-small-en-v1.5-int8/tokenizer.json
 tests/test_acl_audit_packs.py
+tests/test_audit_chain.py
 tests/test_claude_hooks_and_integrate.py
 tests/test_claude_memory_and_recent.py
 tests/test_crypto.py

compartment-2.3/tests/test_audit_chain.py

@@ -0,0 +1,123 @@
+"""The audit chain has to survive ordinary multi-process use.
+
+It did not. A write is journalled the moment it happens; a read is audited in
+RAM and only reaches disk on the next save. So a `store` would chain off a
+`search` entry that no other process had, its journal entry was replayed
+verbatim into a log missing that entry, and the link dangled. verify() stopped
+there and never reported on anything after it again.
+
+That is not a hypothetical either: it happened five times in one day on a real
+vault, every one of them a `store` from a long-running MCP server.
+"""
+import pytest
+
+from compartment import audit, store, vaultfile
+from compartment.vault import Vault
+
+from conftest import PASS
+
+
+def _audit_rows(conn):
+    return conn.execute("SELECT * FROM audit ORDER BY seq").fetchall()
+
+
+def test_replaying_a_journalled_write_keeps_the_chain_linked(vault_path):
+    """The regression. A read between saves used to poison the next write."""
+    v = Vault.create(vault_path, PASS, creator="test")
+    v.save()
+
+    # a read: audited in RAM, deliberately not journalled and not saved
+    v.search("anything", caller="test")
+    # a write: journalled immediately, chaining off that RAM-only entry
+    v.store("a memory written after a search", caller="test")
+    # crash before save, so the payload never learns about either entry
+    del v
+
+    reopened = Vault.unlock(vault_path, passphrase=PASS)
+    ok, n, msg = audit.verify(reopened.db.conn)
+    assert ok, msg
+    texts = {reopened.db.decrypt_text(r, reopened._master)
+             for r in reopened.db.conn.execute("SELECT * FROM records")}
+    assert "a memory written after a search" in texts
+
+
+def test_replay_preserves_when_the_operation_happened(vault_path):
+    v = Vault.create(vault_path, PASS, creator="test")
+    v.save()
+    v.store("timed", caller="test")
+    stored_at = _audit_rows(v.db.conn)[-1]["ts"]
+    del v
+
+    reopened = Vault.unlock(vault_path, passphrase=PASS)
+    replayed = [r for r in _audit_rows(reopened.db.conn) if r["op"] == "store"][-1]
+    assert replayed["ts"] == stored_at, "replay must not restamp history"
+
+
+def test_append_links_to_the_head_it_can_see(vault_path):
+    v = Vault.create(vault_path, PASS, creator="test")
+    conn = v.db.conn
+    audit.append(conn, "a", "op1", "one")
+    head = audit.head(conn)
+    audit.append(conn, "b", "op2", "two", ts=123.0)
+    last = _audit_rows(conn)[-1]
+    assert last["prev_hash"] == head
+    assert last["ts"] == 123.0
+    ok, _, msg = audit.verify(conn)
+    assert ok, msg
+
+
+# ---------------------------------------------------------------------------
+# Repairing a log an older build already broke
+# ---------------------------------------------------------------------------
+
+def _break_the_chain(conn):
+    """Exactly the old damage: a dangling prev_hash, contents untouched."""
+    rows = _audit_rows(conn)
+    victim = rows[len(rows) // 2]
+    bad = "f" * 64
+    h = audit._entry_hash(bad, victim["ts"], victim["caller"], victim["op"],
+                          victim["detail"])
+    conn.execute("UPDATE audit SET prev_hash = ?, hash = ? WHERE seq = ?",
+                 (bad, h, victim["seq"]))
+    return victim["seq"]
+
+
+def test_relink_repairs_a_dangling_link_and_keeps_every_entry(vault):
+    conn = vault.db.conn
+    for i in range(6):
+        audit.append(conn, "test", "store", f"entry {i}")
+    before = [(r["ts"], r["caller"], r["op"], r["detail"]) for r in _audit_rows(conn)]
+
+    broken_at = _break_the_chain(conn)
+    assert not audit.verify(conn)[0]
+
+    changed, first = audit.relink(conn)
+    assert first == broken_at
+    assert changed >= 1
+    ok, n, msg = audit.verify(conn)
+    assert ok, msg
+    assert n == len(before)
+
+    after = [(r["ts"], r["caller"], r["op"], r["detail"]) for r in _audit_rows(conn)]
+    assert after == before, "relink must not alter what the log says"
+
+
+def test_relink_is_a_no_op_on_an_intact_chain(vault):
+    conn = vault.db.conn
+    audit.append(conn, "test", "store", "x")
+    assert audit.relink(conn) == (0, None)
+    assert audit.verify(conn)[0]
+
+
+def test_relink_refuses_to_hide_edited_content(vault):
+    """The distinction that matters: a dangling link is damage, a reworded
+    entry is tampering, and relinking the second would erase the proof."""
+    conn = vault.db.conn
+    audit.append(conn, "test", "forget", "id=secret-thing")
+    rows = _audit_rows(conn)
+    conn.execute("UPDATE audit SET detail = ? WHERE seq = ?",
+                 ("id=something-harmless", rows[-1]["seq"]))
+
+    with pytest.raises(ValueError, match="content tampering"):
+        audit.relink(conn)
+    assert not audit.verify(conn)[0], "and it stays broken, as it should"

compartment-2.2/src/compartment/audit.py

@@ -1,54 +0,0 @@
-"""Hash-chained, tamper-evident audit log (stored inside the sealed payload).
-
-Each entry's hash covers the previous entry's hash, so any edit, deletion,
-or reordering of history breaks the chain at a detectable point.
-A failure to write the audit entry fails the operation (fail-fast), never
-the other way around.
-"""
-from __future__ import annotations
-
-import hashlib
-import json
-import time
-
-GENESIS = "GENESIS"
-
-
-def _entry_hash(prev_hash: str, ts: float, caller: str, op: str, detail: str) -> str:
-    body = json.dumps(
-        {"prev": prev_hash, "ts": ts, "caller": caller, "op": op, "detail": detail},
-        sort_keys=True, separators=(",", ":"),
-    ).encode()
-    return hashlib.sha256(body).hexdigest()
-
-
-def append(conn, caller: str, op: str, detail: str) -> str:
-    row = conn.execute("SELECT hash FROM audit ORDER BY seq DESC LIMIT 1").fetchone()
-    prev = row["hash"] if row else GENESIS
-    ts = time.time()
-    h = _entry_hash(prev, ts, caller, op, detail)
-    conn.execute(
-        "INSERT INTO audit (ts, caller, op, detail, prev_hash, hash) VALUES (?,?,?,?,?,?)",
-        (ts, caller, op, detail, prev, h),
-    )
-    return h
-
-
-def head(conn) -> str:
-    row = conn.execute("SELECT hash FROM audit ORDER BY seq DESC LIMIT 1").fetchone()
-    return row["hash"] if row else GENESIS
-
-
-def verify(conn) -> tuple[bool, int, str]:
-    """Walk the chain. Returns (ok, entries_checked, message)."""
-    prev = GENESIS
-    n = 0
-    for row in conn.execute("SELECT * FROM audit ORDER BY seq"):
-        if row["prev_hash"] != prev:
-            return False, n, f"chain break at seq {row['seq']}: prev_hash mismatch"
-        want = _entry_hash(prev, row["ts"], row["caller"], row["op"], row["detail"])
-        if row["hash"] != want:
-            return False, n, f"chain break at seq {row['seq']}: entry hash mismatch"
-        prev = row["hash"]
-        n += 1
-    return True, n, f"audit chain intact ({n} entries)"