datatug / datatug-core / 41797766718

100%

push

github

feat(audit/integrity): tamper-evident audit integrity core for Perimeter (#448)

Adds `pkg/audit/integrity`, the pure, standard-library-only integrity core of the Perimeter audit log. It follows backstage `spec/features/perimeter` §19.2 and §19.4, and the architecture's §12.

What it provides:
- canonical, versioned event encoding;
- per-field salted commitments, so a field can be redacted from an export, or erased in the store, and the export still verifies;
- RFC 9162 Merkle trees with O(log n) proofs, with domain-separated leaf, node, root and statement hashes;
- 5-minute windows in canonical leaf order (`at`, then `id`);
- linked window roots, each signed once and carrying its expiry. `Seal` refuses expiry earlier than the window end plus the 90-day floor from the spec;
- signed tombstones and legal holds; a release must match its placement;
- pseudonymous actor references;
- `VerifyExport` / `VerifyErasure`, which name the first broken window, event and field. The report has two verdicts: Complete (every leaf present) and Disclosed (no field hidden).

Signing is behind a `Signer` / `Verifier` interface. Ed25519 is built in; the KMS signer belongs to the backend.

No new module dependency; it only adds files. Coverage 100%. It has seeded property tests (random exports, 9 kinds of tampering) and fuzz targets. vet and golangci-lint are clean.

Reviewed independently over four rounds. Probes that attacked holds, erasure, ordering, expiry and labels were turned into tests. The final review approves this head.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Source commits:

- c471cfc7ecfe feat(audit/integrity): pure audit integrity core for Perimeter (§19.4)
  Versioned canonical event encoding with per-field salted HMAC-SHA-256
  commitments, RFC 9162 Merkle windows chained by previous root, inclusion
  proofs, Signer/Verifier interface with signed root, expiry, tombstone and
  legal-hold statements, export verification with one error... (continued)

953 of 953 new or added lines in 10 files covered. (100.0%)

38811 of 38811 relevant lines covered (100.0%)

1.0 hits per line