Phase (b) of docs/DESIGN.md:
- daily and on-demand exports of contiguous chain ranges up to the latest
signed checkpoint: links.jsonl, checkpoints.jsonl and a manifest that
chains to the previous export, each put through qbit-object-storage with
COMPLIANCE retention (default 6 years) and checked by head; sealed
object version ids are recorded;
- refuses and alerts (worm_audit.export.failed) on buckets without Object
Lock or without versions; heartbeat on scheduled runs;
- Verify sealed export: manifest hashes, lock and retention, the manifest
chain, link and checkpoint recomputation, overwrite detection against the
pinned versions, and comparison with the live chain and audit rows;
- MinIO Testcontainers round trip, retention, delete refusal, overwrite and
live tamper detection, and the unsupported-bucket refusal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (a) of docs/DESIGN.md:
- Postgres DDL template and renderer: write-once triggers on the core
audit tables and worm_audit_* tables, lookup id/name protection, the
SECURITY DEFINER retention purge (call-stack guarded, chain prefix only,
recorded) and the INSERT/SELECT-only grant model;
- capability guard and a clear write-once error;
- RFC 8785 canonical audit content, a single-writer chainer (advisory
lock, settle horizon, contiguous ids, late arrivals and late details),
Ed25519 checkpoints with Merkle roots;
- a paged verifier naming the exact break, the Verify audit chain table
action, and the daily verification with QAlerts break/heartbeat;
- the assistant deny pattern for worm_audit_* (reflective until RC.6);
- tests: Postgres Testcontainers (triggers, grants, purge, tamper,
concurrency, time zone), PHI canary, chain and checkpoint units.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5