4 Commits

Include renames

Author	SHA1	Message	Date
cayce	09fe9199b3	audit-3: append-only audit log + strict legacy-prefix rule + anchor cross-check ... - verify_audit_chain(): rows with entry_hash IS NULL are only tolerated BEFORE the first hashed row (documented legacy prefix). A NULL hash AFTER the chain started is tampering and fails verification at that row id — previously any NULL row anywhere was silently skipped, so an attacker with UPDATE could erase intermediate evidence undetected. - migration 0004: audit_log becomes append-only. SQLite: BEFORE UPDATE/ DELETE triggers RAISE(ABORT). Postgres: BEFORE triggers RAISE EXCEPTION. Closes the hole for the table owner and direct SQL connections. - monitor.verify_chain_against_anchors(): compares the chain tail against anchors published to Nostr. Explicit statuses: no_anchors (never anchored / notes missing on relays), local_only (no fetcher), ok (relay note attests the tail or the last local anchor), mismatch. - tests: NULL-before-genesis ok, NULL-in-middle fails at that id, NULL late fails, UPDATE rejected, DELETE rejected, INSERT still allowed, no-anchors explicit, local-only explicit, mismatch detected, match ok. Gate: ruff 0 · 81 unit + 1 PG integration · alembic 0001→0004 on PG · gitleaks clean · make check exit 0.	2026-10-28 19:56:50 +00:00
cayce	ffe425320d	audit-4: serialized audit chain + legacy genesis + daily Nostr anchoring ... - audit() writes are serialized: pg_advisory_xact_lock on Postgres; in-process RLock held until session commit/rollback on SQLite (test: 4 concurrent writers x 25 entries -> chain verifies, 100 rows) - legacy rows (entry_hash NULL, pre-0002) are skipped: the chain begins GENESIS at the first hashed row; migrated DBs verify clean by design - monitor anchor: publishes the last chain hash as a signed NIP-01 note once per day, logs it in the audit log (self-verified before publish) tests: concurrent writers; legacy-genesis verification; anchor signs, logs once per day.	2026-10-20 02:20:56 +00:00
cayce	a282aedb94	lint: wrap long lines (E501), fix F841/F821/E731 — make check fully green ... All 32 findings resolved: regex literals kept single-line with noqa (pattern IS the reviewed artifact), HTML rows string-concatenated for line length, walrus tuple in BIP-340 verify split into named generator, unused pytest import dropped. No behavior changes; 44/44 tests pass. Full-gate discipline restored: ruff exit 0.	2026-10-19 22:03:53 +00:00
cayce	f61372e28e	monitor: static status page — health, queue, gates, audit tail ... - self-contained HTML (no external assets/JS), everything html-escaped - daemon health from daemon_runs (last status + last run per daemon) - proposal queue counts by state; human-gate counters (mail drafts awaiting approval, content draft/approved) - audit tail: actor/action/result only — no detail payloads, no addresses, no subjects, no content bodies (tests assert the negatives) - DaemonRun bookkeeping like every other daemon tests: 3 new (sections render, leak-negatives, XSS escape) — 44 total	2026-10-19 21:57:31 +00:00