relay-shell 0.5.1__tar.gz → 0.5.2__tar.gz

{relay_shell-0.5.1 → relay_shell-0.5.2}/CHANGELOG.md

@@ -6,6 +6,20 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-11-02
+
+### Fixed
+
+- Validate the actual audit descriptor before initial permission hardening and on
+  rotation reopens. Unsupported devices/FIFOs now degrade to stderr without
+  metadata changes or blocking; regular append sinks retain their behavior.
+- Validate regular descriptors for audit-tail and verification reads;
+  handle invalid paths and unavailable home directories through audit fallback.
+- Report rotation-open failures through audit health and preserve the first
+  degraded reason. Skip chain-tail reads after sink initialization fails.
+- Preserve operator-created rotation-file modes; newly created files remain
+  private. See [ADR 0007](docs/adr/0007-audit-hash-chain.md#audit-sink-descriptor-validation-2026-11-02).
+
 ## [0.5.1] - 2026-11-02
 
 ### Performance
@@ -1815,7 +1829,8 @@ All notable changes to this project are documented here. The format follows
   bundled logrotate config drops and restores the append-only attribute
   across rotation. See `docs/deployment.md` §6.
 
-[Unreleased]: https://github.com/rmednitzer/relay-shell/compare/v0.5.1...HEAD
+[Unreleased]: https://github.com/rmednitzer/relay-shell/compare/v0.5.2...HEAD
+[0.5.2]: https://github.com/rmednitzer/relay-shell/compare/v0.5.1...v0.5.2
 [0.5.1]: https://github.com/rmednitzer/relay-shell/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/rmednitzer/relay-shell/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/rmednitzer/relay-shell/compare/v0.3.0...v0.4.0

{relay_shell-0.5.1 → relay_shell-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: relay-shell
-Version: 0.5.1
+Version: 0.5.2
 Summary: A highly reliable, maximally capable MCP server for complete shell and SSH mastery: a governed relay in the shell/SSH path.
 Project-URL: Homepage, https://github.com/rmednitzer/relay-shell
 Project-URL: Documentation, https://rmednitzer.github.io/relay-shell/
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 # Relay Shell
 
-v0.5.1 · Python 3.12 / 3.14 · transports `stdio` and `streamable-http` · MCP SDK
+v0.5.2 · Python 3.12 / 3.14 · transports `stdio` and `streamable-http` · MCP SDK
 `mcp>=2,<3` · Apache-2.0
 
 `relay-shell` is a [Model Context Protocol](https://modelcontextprotocol.io) server that gives

{relay_shell-0.5.1 → relay_shell-0.5.2}/README.md

@@ -1,6 +1,6 @@
 # Relay Shell
 
-v0.5.1 · Python 3.12 / 3.14 · transports `stdio` and `streamable-http` · MCP SDK
+v0.5.2 · Python 3.12 / 3.14 · transports `stdio` and `streamable-http` · MCP SDK
 `mcp>=2,<3` · Apache-2.0
 
 `relay-shell` is a [Model Context Protocol](https://modelcontextprotocol.io) server that gives

{relay_shell-0.5.1 → relay_shell-0.5.2}/docs/adr/0007-audit-hash-chain.md

@@ -245,3 +245,39 @@ unchained, head-truncated (with and without `--segment`), and genesis logs.
 No change to policy admission, tier semantics, the no-sandbox posture, or
 any tool's response shape. This pass hardened a compensating control
 (ADR 0002's first one); it did not move the trust boundary.
+
+
+## Audit sink descriptor validation (2026-11-02)
+
+A privileged validation run exposed path-based permission hardening of a device
+before file-type validation. FIFO opens could also block, including chain resume
+after initialization failure, while a rotation-open error could escape the
+handler's degraded-state update.
+
+Validate the descriptor used for writes with fstat, both initially and after
+rotation. Open nonblocking so unsupported FIFOs cannot stall initialization or
+reopen. Only the initial regular descriptor is subject to best-effort fchmod;
+preserve existing rotation-file permissions and create missing files at 0600.
+Initialization failure uses the existing stderr fallback and skips chain-tail
+reads. Reopen failures mark degraded through the existing first-reason-wins API.
+
+This changes unsupported sink handling, with no record-schema, hash-chain,
+execution-authority or policy-mode change. Control-authority STPA changes are
+not applicable; the operational constraints are nonblocking FIFO failure, no device
+metadata mutation, visible degradation and unchanged valid-file append/rotation.
+Device/symlink, FIFO with/without readers, rotation, path replacement, descriptor
+cleanup and chmod-refusal regressions test these constraints. Qualified Python
+profiles and privileged file-mode evidence must be retained at release.
+
+Operator-controlled paths and other filesystem actors remain trusted. This does
+not establish durable storage, fsync guarantees, a hostile-directory boundary or
+independent off-host evidence. Roll back the complete runtime if necessary while
+preserving accepted audit records; no data migration is required.
+
+Audit-tail reads (plain and gzip) and chain-verification opens use the same
+regular-descriptor validation. This also prevents a regular-to-FIFO replacement
+from blocking between a path check and the actual read. Invalid paths and an
+unavailable home directory degrade initialization through the existing fallback.
+
+O_NONBLOCK is not a general storage or network-filesystem timeout; regular-file
+I/O latency remains governed by the operating system and storage.

{relay_shell-0.5.1 → relay_shell-0.5.2}/docs/architecture.md

@@ -76,6 +76,14 @@ Every tool body is identical in shape (`Relay.run`):
    for tamper-evidence ([ADR 0007](adr/0007-audit-hash-chain.md)); default off
    keeps the record byte-identical.
 
+The audit file handler validates its opened descriptor at initialization and every
+rotation reopen. It uses nonblocking open to avoid FIFO stalls, rejects nonregular
+sinks and hardens only the initial regular descriptor. Invalid initialization
+falls back to stderr and skips chain-tail reads. Reopen failures mark audit health
+degraded while tool calls continue; existing rotation-file modes are preserved.
+Regular-file type checks alone do not prove storage durability or constrain an
+operator-controlled path.
+
 A tool may fail, time out, or be denied, but it always returns a single bounded, audited
 string; the one exception is a cancelled call, which is audited and then re-raised.
 
@@ -192,3 +200,8 @@ ASCII-only inputs also use equivalent ASCII regex variants for common Tier-3
 and Tier-2 scans. Inputs containing any non-ASCII character retain the original
 Unicode regexes; replacing a published table disables its optimized variant.
 Differential tests cover both paths.
+
+Audit-tail reads (plain and gzip) and chain-verification opens use the same
+regular-descriptor validation. This also prevents a regular-to-FIFO replacement
+from blocking between a path check and the actual read. Invalid paths and an
+unavailable home directory degrade initialization through the existing fallback.

{relay_shell-0.5.1 → relay_shell-0.5.2}/docs/index.md

@@ -6,7 +6,7 @@ title: Overview
 
 A [Model Context Protocol](https://modelcontextprotocol.io) server for **complete shell and
 SSH operation**: local commands and scripts, interactive PTY sessions, fleet operation over
-SSH, SFTP transfers and port forwards. Current release: **[v0.5.1](https://github.com/rmednitzer/relay-shell/releases/tag/v0.5.1)** (2026-11-02).
+SSH, SFTP transfers and port forwards. Current release: **[v0.5.2](https://github.com/rmednitzer/relay-shell/releases/tag/v0.5.2)** (2026-11-02).
 
 It is operator infrastructure for hosts you own and administer. It runs with the privileges
 of its service account, with no sandbox, and it is **open by default**: with the default

{relay_shell-0.5.1 → relay_shell-0.5.2}/docs/runbook.md

@@ -271,6 +271,14 @@ alertable; any HTTP response (including 401/403/404) means the listener is up.
 
 ### 2.9 Audit-log hygiene
 
+Configure a regular audit file. Device/FIFO sinks are unsupported: initialization
+degrades to stderr without changing their permissions or waiting for a reader.
+Each rotation reopen also validates the actual descriptor; failure marks runtime
+audit health degraded. Initial regular-file hardening is best effort (append-only
+files may refuse chmod), and existing operator-created rotation-file modes remain
+unchanged. New files use mode 0600. Do not interpret a regular-file check as a
+proof of durable persistence.
+
 On a real deployment:
 
 ```bash
@@ -1204,3 +1212,8 @@ ASCII-only inputs also use equivalent ASCII regex variants for common Tier-3
 and Tier-2 scans. Inputs containing any non-ASCII character retain the original
 Unicode regexes; replacing a published table disables its optimized variant.
 Differential tests cover both paths.
+
+Audit-tail reads (plain and gzip) and chain-verification opens use the same
+regular-descriptor validation. This also prevents a regular-to-FIFO replacement
+from blocking between a path check and the actual read. Invalid paths and an
+unavailable home directory degrade initialization through the existing fallback.

{relay_shell-0.5.1 → relay_shell-0.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "relay-shell"
-version = "0.5.1"
+version = "0.5.2"
 description = "A highly reliable, maximally capable MCP server for complete shell and SSH mastery: a governed relay in the shell/SSH path."
 readme = "README.md"
 requires-python = ">=3.12"

{relay_shell-0.5.1 → relay_shell-0.5.2}/src/relay_shell/__init__.py

@@ -4,4 +4,4 @@ from __future__ import annotations
 
 __all__ = ["__version__"]
 
-__version__ = "0.5.1"
+__version__ = "0.5.2"

{relay_shell-0.5.1 → relay_shell-0.5.2}/src/relay_shell/audit.py

@@ -15,14 +15,17 @@ logger degrades to stderr (or silence) and records ``degraded=True``.
 from __future__ import annotations
 
 import contextlib
+import errno
 import gzip
 import json
 import logging
 import os
+import stat
 import sys
 import threading
 from collections import deque
 from dataclasses import dataclass
+from io import TextIOWrapper
 from logging.handlers import WatchedFileHandler
 from pathlib import Path
 from typing import Any
@@ -112,20 +115,37 @@ _FORMATTERS = {"jsonl": _format_jsonl, "cef": _format_cef, "leef": _format_leef}
 _CHAIN_GENESIS = "0" * 64
 
 
+def _open_regular_fd(path: str | os.PathLike[str], flags: int) -> int:
+    """Open and validate a regular descriptor without blocking on a FIFO."""
+    fd = os.open(path, flags | os.O_NONBLOCK, 0o600)
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise OSError(
+                errno.EINVAL,
+                "audit path is not a regular file (records not durably stored)",
+                str(path),
+            )
+        return fd
+    except BaseException:
+        with contextlib.suppress(OSError):
+            os.close(fd)
+        raise
+
+
 def _tail_path(path: Path, lines: int) -> str:
     """Return the last non-empty lines from a plain or gzip-compressed file."""
     if lines <= 0:
         return ""
 
-    if path.suffix == ".gz":
-        compressed_records: deque[str] = deque(maxlen=lines)
-        with gzip.open(path, "rt", encoding="utf-8", errors="replace") as fh:
-            for raw in fh:
-                if raw.strip():
-                    compressed_records.append(raw.rstrip("\r\n"))
-        return "\n".join(compressed_records)
+    with os.fdopen(_open_regular_fd(path, os.O_RDONLY), "rb") as fh:
+        if path.suffix == ".gz":
+            compressed_records: deque[str] = deque(maxlen=lines)
+            with gzip.open(fh, "rt", encoding="utf-8", errors="replace") as compressed:
+                for raw in compressed:
+                    if raw.strip():
+                        compressed_records.append(raw.rstrip("\r\n"))
+            return "\n".join(compressed_records)
 
-    with path.open("rb") as fh:
         fh.seek(0, os.SEEK_END)
         size = fh.tell()
         if size == 0:
@@ -254,7 +274,9 @@ def verify_chain(path: str) -> ChainResult:
     expected_seq = 0
     expected_prev = _CHAIN_GENESIS
     try:
-        with p.open("r", encoding="utf-8", errors="replace") as fh:
+        with os.fdopen(
+            _open_regular_fd(p, os.O_RDONLY), "r", encoding="utf-8", errors="replace"
+        ) as fh:
             for lineno, raw in enumerate(fh, start=1):
                 line = raw.strip()
                 if not line:
@@ -351,11 +373,39 @@ def verify_chain(path: str) -> ChainResult:
 
 class _AuditFileHandler(WatchedFileHandler):
     owner: Any = None
+    _initial_open = True
+
+    def _open(self) -> TextIOWrapper[Any]:
+        # Validate the descriptor we will write, rather than chmodding a path
+        # that may refer to a device or change between inspection and use.
+        # O_NONBLOCK prevents an unsupported FIFO from hanging initialization
+        # or a rotation reopen. It has no effect on regular files.
+        fd = _open_regular_fd(self.baseFilename, os.O_APPEND | os.O_CREAT | os.O_WRONLY)
+        try:
+            # Existing append-only files can refuse chmod while still accepting
+            # append writes. Preserve the existing best-effort hardening policy.
+            if self._initial_open:
+                with contextlib.suppress(OSError):
+                    os.fchmod(fd, 0o600)
+            stream = os.fdopen(fd, "a", encoding=self.encoding, errors=self.errors)
+            self._initial_open = False
+            return stream
+        except BaseException:
+            with contextlib.suppress(OSError):
+                os.close(fd)
+            raise
+
+    def emit(self, record: logging.LogRecord) -> None:
+        try:
+            super().emit(record)
+        except OSError:
+            # WatchedFileHandler reopens before FileHandler's error handler.
+            # Surface a rejected rotation target without breaking the tool call.
+            self.handleError(record)
 
     def handleError(self, record: logging.LogRecord) -> None:
         if self.owner is not None:
-            self.owner.degraded = True
-            self.owner.degraded_reason = "audit write failed at runtime"
+            self.owner.mark_degraded("audit write failed at runtime")
         super().handleError(record)
 
 
@@ -397,24 +447,9 @@ class AuditLogger:
         try:
             target = Path(path).expanduser()
             target.parent.mkdir(parents=True, exist_ok=True)
-            # O_APPEND keeps this compatible with `chattr +a` files.
-            fd = os.open(str(target), os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o600)
-            os.close(fd)
-            # Defensive for existing files that might already be too permissive.
-            with contextlib.suppress(OSError):
-                target.chmod(0o600)
-            # OBS-1: a non-regular sink (`/dev/null`, device, FIFO) accepts
-            # writes but stores nothing durable. Flag it degraded so the
-            # `relay_shell_audit_degraded` gauge and `server_info.audit` show
-            # it; the sink itself is left as configured.
-            if not target.is_file():
-                self.degraded = True
-                self.degraded_reason = (
-                    f"audit path is not a regular file (records not durably stored): {path}"
-                )
             sink = _AuditFileHandler(str(target), encoding="utf-8", errors="backslashreplace")
             sink.owner = self
-        except OSError as exc:  # unwritable path -> degrade, never crash
+        except (OSError, ValueError, RuntimeError) as exc:  # invalid/unwritable path -> degrade
             self.degraded = True
             self.degraded_reason = str(exc)
             sink = logging.StreamHandler(sys.stderr)
@@ -426,7 +461,7 @@ class AuditLogger:
             echo.setFormatter(logging.Formatter("AUDIT %(message)s"))
             self._log.addHandler(echo)
 
-        if self.chain:
+        if self.chain and not self.degraded:
             self._resume_chain()
 
     def _resume_chain(self) -> None:

relay_shell-0.5.2/tests/test_audit_sink.py

@@ -0,0 +1,273 @@
+"""Audit sinks must not mutate devices, hang on FIFOs, or hide reopen failure."""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from relay_shell.audit import AuditLogger
+
+
+@pytest.mark.parametrize("symlink", [False, True])
+def test_device_sink_never_attempts_permission_changes(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, symlink: bool
+) -> None:
+    device = Path("/dev/null")
+    path = tmp_path / "device" if symlink else device
+    if symlink:
+        path.symlink_to(device)
+    before = device.stat()
+    real_chmod = Path.chmod
+    real_fchmod = os.fchmod
+
+    def guard_path_chmod(self: Path, mode: int, *args, **kwargs) -> None:
+        assert self.resolve() != device, "permission change attempted on a device"
+        real_chmod(self, mode, *args, **kwargs)
+
+    def guard_fchmod(fd: int, mode: int) -> None:
+        assert stat.S_ISREG(os.fstat(fd).st_mode), "fchmod attempted on a nonregular sink"
+        real_fchmod(fd, mode)
+
+    monkeypatch.setattr(Path, "chmod", guard_path_chmod)
+    monkeypatch.setattr(os, "fchmod", guard_fchmod)
+    log = AuditLogger(str(path), chain=True)
+    assert log.degraded
+    assert "regular file" in log.degraded_reason
+    log.record(tool="test", args={}, output="synthetic", exit_code=0, tier=0)
+    after = device.stat()
+    assert (after.st_mode, after.st_rdev, after.st_uid, after.st_gid) == (
+        before.st_mode,
+        before.st_rdev,
+        before.st_uid,
+        before.st_gid,
+    )
+
+
+def test_existing_regular_sink_is_hardened_and_appended(tmp_path: Path) -> None:
+    path = tmp_path / "audit.jsonl"
+    path.write_text("existing\n")
+    path.chmod(0o644)
+    log = AuditLogger(str(path))
+    assert not log.degraded
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    log.record(tool="test", args={}, output="synthetic", exit_code=0, tier=0)
+    assert path.read_text().startswith("existing\n")
+
+
+@pytest.mark.parametrize("reader", [False, True])
+def test_fifo_initialization_is_bounded_and_preserves_mode(tmp_path: Path, reader: bool) -> None:
+    path = tmp_path / "audit.fifo"
+    os.mkfifo(path, 0o640)
+    path.chmod(0o640)
+    code = """
+import json,os,sys
+from relay_shell.audit import AuditLogger
+reader = os.open(sys.argv[1], os.O_RDONLY | os.O_NONBLOCK) if sys.argv[2] == '1' else None
+log = AuditLogger(sys.argv[1], chain=True)
+log.record(tool='test',args={},output='synthetic',exit_code=0,tier=0)
+print(json.dumps({'degraded':log.degraded}))
+if reader is not None:os.close(reader)
+"""
+    result = subprocess.run(
+        [sys.executable, "-c", code, str(path), str(int(reader))],
+        capture_output=True,
+        text=True,
+        timeout=3,
+        check=True,
+    )
+    assert json.loads(result.stdout)["degraded"] is True
+    assert stat.S_ISFIFO(path.stat().st_mode)
+    assert stat.S_IMODE(path.stat().st_mode) == 0o640
+
+
+def test_rotation_to_fifo_is_bounded_and_reported(tmp_path: Path) -> None:
+    path = tmp_path / "audit.jsonl"
+    code = """
+import json,os,sys
+from pathlib import Path
+from relay_shell.audit import AuditLogger
+path=Path(sys.argv[1]);log=AuditLogger(str(path),chain=True)
+log.record(tool='before',args={},output='synthetic',exit_code=0,tier=0)
+path.rename(str(path)+'.old')
+os.mkfifo(path,0o640);path.chmod(0o640)
+log.record(tool='after',args={},output='synthetic',exit_code=0,tier=0)
+print(json.dumps({'degraded':log.degraded,'reason':log.degraded_reason}))
+"""
+    result = subprocess.run(
+        [sys.executable, "-c", code, str(path)],
+        capture_output=True,
+        text=True,
+        timeout=3,
+        check=True,
+    )
+    assert json.loads(result.stdout)["degraded"] is True
+    assert "runtime" in json.loads(result.stdout)["reason"]
+    assert stat.S_IMODE(path.stat().st_mode) == 0o640
+
+
+@pytest.mark.parametrize("earlier_gap", [False, True])
+def test_rotation_to_device_is_reported(tmp_path: Path, earlier_gap: bool) -> None:
+    path = tmp_path / "audit.jsonl"
+    log = AuditLogger(str(path), chain=True)
+    log.record(tool="before", args={}, output="synthetic", exit_code=0, tier=0)
+    path.rename(tmp_path / "audit.old")
+    path.symlink_to("/dev/null")
+    if earlier_gap:
+        log.mark_degraded("earlier gap")
+    log.record(tool="after", args={}, output="synthetic", exit_code=0, tier=0)
+    assert log.degraded
+    if earlier_gap:
+        assert log.degraded_reason == "earlier gap"
+    else:
+        assert "runtime" in log.degraded_reason
+
+
+def test_rotation_preserves_operator_created_file_mode(tmp_path: Path) -> None:
+    path = tmp_path / "audit.jsonl"
+    log = AuditLogger(str(path))
+    log.record(tool="before", args={}, output="synthetic", exit_code=0, tier=0)
+    path.rename(tmp_path / "audit.old")
+    path.write_text("")
+    path.chmod(0o640)
+    log.record(tool="after", args={}, output="synthetic", exit_code=0, tier=0)
+    assert not log.degraded
+    assert json.loads(path.read_text())["tool"] == "after"
+    assert stat.S_IMODE(path.stat().st_mode) == 0o640
+
+
+def test_hardening_uses_open_descriptor_during_path_replacement(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    path = tmp_path / "audit.jsonl"
+    moved = tmp_path / "original"
+    path.write_text("")
+    path.chmod(0o644)
+    real_open = os.open
+    replaced = False
+
+    def replace_after_open(file: str, flags: int, mode: int = 0o777) -> int:
+        nonlocal replaced
+        fd = real_open(file, flags, mode)
+        if file == str(path) and not replaced:
+            replaced = True
+            path.rename(moved)
+            path.write_text("")
+            path.chmod(0o644)
+        return fd
+
+    monkeypatch.setattr(os, "open", replace_after_open)
+    log = AuditLogger(str(path))
+    assert not log.degraded
+    assert stat.S_IMODE(moved.stat().st_mode) == 0o600
+    assert stat.S_IMODE(path.stat().st_mode) == 0o644
+
+
+def test_rejected_sink_closes_open_descriptor(monkeypatch: pytest.MonkeyPatch) -> None:
+    device = "/dev/null"
+    real_open = os.open
+    captured: list[int] = []
+
+    def capture_open(file: str, flags: int, mode: int = 0o777) -> int:
+        fd = real_open(file, flags, mode)
+        if file == device:
+            captured.append(fd)
+        return fd
+
+    monkeypatch.setattr(os, "open", capture_open)
+    log = AuditLogger(device)
+    assert log.degraded
+    assert captured
+    for fd in captured:
+        with pytest.raises(OSError):
+            os.fstat(fd)
+
+
+def test_append_continues_when_descriptor_chmod_is_refused(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    path = tmp_path / "audit.jsonl"
+    path.write_text("")
+    path.chmod(0o640)
+
+    def refuse_chmod(fd: int, mode: int) -> None:
+        raise PermissionError("synthetic append-only chmod refusal")
+
+    monkeypatch.setattr(os, "fchmod", refuse_chmod)
+    log = AuditLogger(str(path))
+    log.record(tool="test", args={}, output="synthetic", exit_code=0, tier=0)
+    assert not log.degraded
+    assert json.loads(path.read_text())["tool"] == "test"
+    assert stat.S_IMODE(path.stat().st_mode) == 0o640
+
+
+@pytest.mark.parametrize("suffix", [".jsonl", ".gz"])
+def test_tail_of_fifo_is_bounded(tmp_path: Path, suffix: str) -> None:
+    path = tmp_path / ("audit" + suffix)
+    os.mkfifo(path, 0o640)
+    path.chmod(0o640)
+    code = """
+import json,sys
+from relay_shell.audit import AuditLogger
+log=AuditLogger.__new__(AuditLogger);log.path=sys.argv[1]
+print(json.dumps({'tail':log.tail(10)}))
+"""
+    result = subprocess.run(
+        [sys.executable, "-c", code, str(path)],
+        capture_output=True,
+        text=True,
+        timeout=3,
+        check=True,
+    )
+    assert json.loads(result.stdout)["tail"] == ""
+    assert stat.S_IMODE(path.stat().st_mode) == 0o640
+
+
+def test_verifier_rejects_path_replacement_with_fifo(tmp_path: Path) -> None:
+    path = tmp_path / "audit.jsonl"
+    path.write_text("")
+    code = """
+import json,os,sys
+from pathlib import Path
+from relay_shell.audit import verify_chain
+target=Path(sys.argv[1]);real_is_file=Path.is_file
+def replace_after_stat(self):
+    result=real_is_file(self)
+    if self==target and result:
+        self.unlink();os.mkfifo(self,0o640)
+    return result
+Path.is_file=replace_after_stat
+r=verify_chain(str(target))
+print(json.dumps({'ok':r.ok,'reason':r.reason}))
+"""
+    result = subprocess.run(
+        [sys.executable, "-c", code, str(path)],
+        capture_output=True,
+        text=True,
+        timeout=3,
+        check=True,
+    )
+    assert json.loads(result.stdout)["ok"] is False
+    assert "regular file" in json.loads(result.stdout)["reason"]
+
+
+def test_invalid_path_degrades_without_raising() -> None:
+    log = AuditLogger("bad\x00audit")
+    assert log.degraded
+    log.record(tool="test", args={}, output="synthetic", exit_code=0, tier=0)
+
+
+def test_unavailable_home_degrades_without_raising(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def unavailable_home(self: Path) -> Path:
+        raise RuntimeError("synthetic unavailable home")
+
+    monkeypatch.setattr(Path, "expanduser", unavailable_home)
+    log = AuditLogger("~/audit.jsonl")
+    assert log.degraded