ee782b7d6e
Checkpoint implementation at user-requested stop; document known failures and incomplete release qualification. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: GPT-6 Codex <noreply@openai.com>
3.2 KiB
Strict generation audit
Wire config.withAudit(new GenerationAudit()) with the native generation QBit and its optional qqq-backend-module-rdbms dependency. The adapter writes only document_generation_event, a visible immutable QQQ table owned by generation. It does not use Record Files privileges, tables or audit callbacks. Normal QQQ writes/deletes are denied; reads apply current source-record access, and aggregate/count shortcuts are refused.
append opens a fresh independent JDBC connection, checks its database identity/writability/autocommit state, starts its own transaction, inserts the event and commits before returning. It never joins or replaces the caller's QContext transaction. A caller rollback cannot undo an acknowledged event. Database failure propagates; no log-only or in-memory fallback exists. Supported strategies are file-backed H2 with WRITE_DELAY=0 and native MySQL 8.4 under the current physical engine/settings/mapping checks in MYSQL.md. Unsupported strategies remain disabled; this QQQ backend does not support PostgreSQL. Owned statements have five-second JDBC deadlines.
Each event binds the current initiating actor, selected source, committed generation request, revision, format and exact retained/print receipt fields. Outcome checks distinguish STARTED, RETAINED, DISPATCHED and INCOMPLETE facts; PRINT_QUEUED requires an actual persisted queue receipt and does not claim physical output. The operation ID and outcome form a database unique key. A length-prefixed SHA-256 fingerprint includes every event meaning except retry timestamp. An exact retry returns the existing committed event; changed meaning conflicts. A concurrent duplicate or ambiguous commit is reconciled through a fresh connection and acknowledged only if that exact event is durable.
Apply the generated schema through the host migration process. Existing installations need the new event table/index and unique operation-ID constraint on requests. QBit registration does not execute DDL. Database service-account policy, filesystem/volume durability, backup/restore, retention and external administrative tamper controls remain deployment responsibilities. Application-level append-only behavior does not make a database administrator unable to alter a table.
This is a synchronous audit ledger, not an asynchronous dispatch queue. Generation requests retain uncertain state after external failures. Worker scheduling, bounded batch progress, request reconciliation and retrying print dispatch are separate generation-owned workflows; the audit table must not be presented as implementing those workflows merely because it stores events.
Current verification: full 109-test clean install passed 2026-10-31 00:45:47 CDT, including nine actual MySQL audit cases plus the H2 cases. Separate connections verify commit-before-return, ambient rollback independence, exact concurrent dedupe, failed inserts, request/stage conflicts, actual durability configuration and retained/queued recovery audit identity. Evidence: mysql-full-verification.log. Physical database/volume disaster recovery remains deployment work. The older 33-test reconciliation result is historical evidence, not the current test count.