Phase (c) of docs/DESIGN.md:
- the WORM Audit app and home: chain status, export status, retention,
recent purges and setup warnings (missing triggers, owner role, signing
and trusted keys, bucket without Object Lock, stale verification), plus
a summary card for host dashboards; no audit content is rendered;
- alert types renamed to wormaudit.* (core name pattern) and declared,
with daily heartbeat monitors;
- full verification holds one page plus one checkpoint range;
- plain field labels, record labels, full-width sections and child lists;
- a test-scope demo server and screenshots (home and records, light and
dark, 390/1440/1920) with overflow checks;
- DESIGN.md consistency edits (alert names, object_versions,
s3:GetObjectVersion, snake_case columns).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (b) of docs/DESIGN.md:
- daily and on-demand exports of contiguous chain ranges up to the latest
signed checkpoint: links.jsonl, checkpoints.jsonl and a manifest that
chains to the previous export, each put through qbit-object-storage with
COMPLIANCE retention (default 6 years) and checked by head; sealed
object version ids are recorded;
- refuses and alerts (worm_audit.export.failed) on buckets without Object
Lock or without versions; heartbeat on scheduled runs;
- Verify sealed export: manifest hashes, lock and retention, the manifest
chain, link and checkpoint recomputation, overwrite detection against the
pinned versions, and comparison with the live chain and audit rows;
- MinIO Testcontainers round trip, retention, delete refusal, overwrite and
live tamper detection, and the unsupported-bucket refusal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (a) of docs/DESIGN.md:
- Postgres DDL template and renderer: write-once triggers on the core
audit tables and worm_audit_* tables, lookup id/name protection, the
SECURITY DEFINER retention purge (call-stack guarded, chain prefix only,
recorded) and the INSERT/SELECT-only grant model;
- capability guard and a clear write-once error;
- RFC 8785 canonical audit content, a single-writer chainer (advisory
lock, settle horizon, contiguous ids, late arrivals and late details),
Ed25519 checkpoints with Merkle roots;
- a paged verifier naming the exact break, the Verify audit chain table
action, and the daily verification with QAlerts break/heartbeat;
- the assistant deny pattern for worm_audit_* (reflective until RC.6);
- tests: Postgres Testcontainers (triggers, grants, purge, tamper,
concurrency, time zone), PHI canary, chain and checkpoint units.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5