feat(lab): CL-02 immutable evidence ledger and projection

devlog/_plan/260807_compatibility_lab/001_pr_stack_status.md

@@ -20,11 +20,17 @@ independent review, blockers, and whether a later phase is authorized.
 | Phase | Branch | Starting/base SHA | Accepted head | PR | State |
 |---|---|---|---|---|---|
 | CL-00 | `feat/cl-00-compatibility-contracts` | `3ad5bb6bd3f76f6879d84b78ea39edd3e01ec296` | `c014464237fd3c95bda08bc18bfab8ba8f532308` | [#1286](https://github.com/lidge-jun/opencodex/pull/1286) | ACCEPTED AFTER CODERABBIT REMEDIATION (merged to `dev` at `243c3f4905797aa11c62ba933bb03d6d721266fd`) |
-| CL-01 | `feat/cl-01-conformance-harness` | `c2113ca47b8a05c5a5f90679e4eaa640ca2c6a66` | `22d608c82d82e2746c0cef9cd761db19a8e465ee` | [draft Wibias #10](https://github.com/Wibias/opencodex/pull/10) | ACCEPTED (contract-corrected revalidation) |
+| CL-01 | `feat/cl-01-conformance-harness` | `c2113ca47b8a05c5a5f90679e4eaa640ca2c6a66` | `22d608c82d82e2746c0cef9cd761db19a8e465ee` | [#1320](https://github.com/lidge-jun/opencodex/pull/1320) | MERGED TO `dev` at `4bb249b756abd468c675d2d92fffe4da95ad3e2a` |
+| CL-02 | `feat/cl-02-evidence-ledger` | `4bb249b756abd468c675d2d92fffe4da95ad3e2a` | (phase-2 review fixes in progress) | [draft #1333](https://github.com/lidge-jun/opencodex/pull/1333) | IMPLEMENTATION COMPLETE — PHASE-2 REVIEW FIXES — NOT INDEPENDENTLY ACCEPTED |
+| CL-03 | — | — | — | — | NOT STARTED |
 
 The CL-01 starting SHA is the exact CL-00 tip recorded when CL-01 began. Its
 moving base-ref name is not a substitute for that historical SHA.
 
+CL-02 starts from the exact CL-01 merge commit on `dev`
+(`4bb249b756abd468c675d2d92fffe4da95ad3e2a` / upstream #1320). It does **not**
+base on the pre-merge CL-01 feature branch tip.
+
 ## CL-00 acceptance log
 
 - Live-tree audit covered provider registry/derivation, Routing Profiles,
@@ -62,6 +68,7 @@ Independent CL-00 acceptance review is frozen at
 - **CL-00 merge base on `dev`:** `243c3f4905797aa11c62ba933bb03d6d721266fd`
 - **Post-rebase harness commit:** `cfe27b0dcb26a1bf0bb56f68f952e6e4f4d80fe9` (rebase-only)
 - **Correction head:** `574f1d5eb93c091494549ffc0e26ea7a4879c12c` (implementation); **tip:** `22d608c82d82e2746c0cef9cd761db19a8e465ee`
+- **Merged to `dev`:** `4bb249b756abd468c675d2d92fffe4da95ad3e2a` via upstream [#1320](https://github.com/lidge-jun/opencodex/pull/1320).
 
 ### Corrections applied
 
@@ -88,8 +95,52 @@ Independent CL-00 acceptance review is frozen at
 - None for CL-01 correction.
 - Full-suite green remains unavailable on this host for documented Windows/Bun reasons.
 
+## CL-02 implementation log
+
+- **Branch:** `feat/cl-02-evidence-ledger`
+- **Starting/base SHA:** `4bb249b756abd468c675d2d92fffe4da95ad3e2a` (CL-01 merge via #1320)
+- **Scope:** append-only JSONL evidence ledger with an explicit sensitive-purge
+  exception: when the `ledger` purge action is requested, targeted evidence is
+  physically removed by atomic ledger rewrite and a `purge_tombstone` remains as
+  the auditable record; SQLite is rebuilt from the rewritten ledger and retained
+  content-addressed artifacts. The phase also includes the content-addressed
+  artifact store, disposable/rebuildable SQLite projection, ClaimSourceManifestV1,
+  invalidation semantics, and the CL-01 → observation persistence seam.
+- **Explicitly out of scope:** CL-03 live probes, CL-04 CLI/API, CL-05 UI,
+  CL-06 profile fields, Fabric, shadow workflows.
+
+### Boundary note (verdict algorithm)
+
+CL-02 implements frozen `all-applicable-required-pass-v1` evaluation with
+subject-aware applicability (required scenarios whose manifest requirements
+match the exact protocol subject, excluding live-reserved cases in fixture
+mode). Positive `VERIFIED` requires a non-empty applicable required set and a
+current pass for every member. Descriptor/handle-bound artifact I/O, fail-closed
+sensitive purge with shared-artifact retention, recursive event admission
+ceilings, and unusable-evidence exclusion from projection are implemented.
+Claims cannot produce `PROBED`/`VERIFIED`.
+
+### CL-02 validation status (2026-08-09 phase-2 review fixes)
+
+- **Prior accepted review-fix head:** `cf626d14c823413fbcd6ac2625d1da16bbac714e`
+- **Phase-2 scope:** eleven independent-review blockers (artifact dirfd I/O,
+  purge scratch/export + explicit sensitive artifacts, streaming JSONL replay,
+  zero-applicable UNKNOWN, `newest-required-observation-v1`, multi-surface
+  applicability, historical manifest no-substitution, closed event admission,
+  corrupt superseding claims, ArtifactStore lifecycle, frozen behaviour
+  fingerprint).
+- **Previous local validation:** `bun x tsc --noEmit`, `bun run privacy:scan`,
+  `tests/lab-evidence-ledger.test.ts` (41/41), `tests/lab-conformance-harness.test.ts`
+  (17/17), `tests/repo-hygiene.test.ts` (11/11), `git diff --check` green on
+  Windows host before the current CodeRabbit remediation pass.
+- **Current CodeRabbit remediation:** committed on draft PR #1333; current CI and
+  review reconciliation are required before this head may be recorded as accepted.
+- **Independent acceptance:** not yet — draft PR #1333 remains open for review.
+- **CL-03:** not started.
+
 ## Authorization
 
 - CL-00: **ACCEPTED** (merged #1286).
-- CL-01: **ACCEPTED (contract-corrected revalidation)** — ready for stack review against `dev`.
-- CL-02: **NOT STARTED / NOT AUTHORIZED**.
+- CL-01: **MERGED** via #1320 at `4bb249b756abd468c675d2d92fffe4da95ad3e2a`.
+- CL-02: **IMPLEMENTATION COMPLETE — PHASE-2 REVIEW FIXES — NOT INDEPENDENTLY ACCEPTED** on `feat/cl-02-evidence-ledger` (draft #1333).
+- CL-03: **NOT STARTED**.

src/lab/artifacts/sanitize.ts

@@ -0,0 +1,114 @@
+/**
+ * Deny-by-default sanitization before artifact hashing/writing.
+ * Never persists prompts, secrets, paths, account IDs, raw URLs, or provider bodies.
+ */
+import type { ArtifactClass } from "../constants";
+import { MAX_SANITIZED_STRING_FIELD } from "../constants";
+import { jcsStringify } from "../digest";
+import { redactSecretString } from "../../lib/redact";
+
+const FORBIDDEN_KEY = /^(?:authorization|proxy-authorization|cookie|set-cookie|api[-_]?key|x-api-key|token|secret|password|email|prompt|messages|content|body|url|hostname|baseUrl|path|account|alias)$/i;
+const SECRETISH = /sk-[a-z0-9]{10,}|Bearer\s+[A-Za-z0-9._\-]+|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}/i;
+const SECRETISH_GLOBAL = /sk-[a-z0-9]{10,}|Bearer\s+[A-Za-z0-9._\-]+|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}/gi;
+
+export function redactForArtifact(artifactClass: ArtifactClass, payload: unknown): unknown {
+  if (
+    artifactClass === "fixture" ||
+    artifactClass === "scenario_manifest" ||
+    artifactClass === "suite_manifest" ||
+    artifactClass === "claim_source_manifest"
+  ) {
+    // Contract artifacts are already synthetic/canonical. Mutating them would
+    // invalidate content-addressed digests; reject secret-shaped material instead.
+    assertNoSecretMaterial(payload, 0);
+    return payload;
+  }
+  return scrubValue(payload, 0);
+}
+
+const FORBIDDEN_CONTRACT_KEYS = /^(?:authorization|proxy-authorization|cookie|set-cookie|api[-_]?key|x-api-key|token|secret|password|email|prompt|messages|baseUrl|hostname|account|alias)$/i;
+
+function assertNoSecretMaterial(value: unknown, depth: number): void {
+  if (depth > 8) {
+    throw new Error("contract artifact exceeds sanitization inspection depth");
+  }
+  if (typeof value === "string") {
+    if (SECRETISH.test(value)) {
+      throw new Error("contract artifact contains forbidden secret-shaped material");
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) assertNoSecretMaterial(item, depth + 1);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const [key, child] of Object.entries(value as object)) {
+      if (FORBIDDEN_CONTRACT_KEYS.test(key)) {
+        throw new Error(`contract artifact forbids key ${key}`);
+      }
+      assertNoSecretMaterial(child, depth + 1);
+    }
+  }
+}
+
+function scrubValue(value: unknown, depth: number): unknown {
+  if (depth > 8) return "[truncated_depth]";
+  if (value === null || typeof value === "boolean" || typeof value === "number") return value;
+  if (typeof value === "string") return scrubString(value);
+  if (value instanceof Uint8Array) {
+    const text = new TextDecoder().decode(value);
+    return new TextEncoder().encode(scrubString(text));
+  }
+  if (Array.isArray(value)) {
+    if (value.length > 256) return value.slice(0, 256).map((v) => scrubValue(v, depth + 1));
+    return value.map((v) => scrubValue(v, depth + 1));
+  }
+  if (typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    const keys = Object.keys(value as object).slice(0, 64);
+    for (const key of keys) {
+      if (FORBIDDEN_KEY.test(key)) {
+        out[key] = "[redacted]";
+        continue;
+      }
+      out[key] = scrubValue((value as Record<string, unknown>)[key], depth + 1);
+    }
+    return out;
+  }
+  return "[unsupported]";
+}
+
+function scrubString(value: string): string {
+  let s = redactSecretString(value);
+  s = s.replace(SECRETISH_GLOBAL, "[REDACTED]");
+  // Strip absolute filesystem paths (coarse)
+  s = s.replace(/(?:[A-Za-z]:\\|\/(?:home|Users|tmp|var|etc|root|mnt)\/)[^\s"']+/g, "[path]");
+  // Strip URL userinfo / private hosts roughly
+  s = s.replace(/https?:\/\/[^\s"']+/gi, (url) => {
+    try {
+      const u = new URL(url);
+      if (u.username || u.password) return "[redacted-url]";
+      if (/^(localhost|127\.|10\.|192\.168\.|172\.(1[6-9]|2\d|3[0-1])\.)/i.test(u.hostname)) {
+        return `${u.protocol}//[private-host]${u.pathname}`;
+      }
+      return `${u.protocol}//[host]${u.pathname}`;
+    } catch {
+      return "[redacted-url]";
+    }
+  });
+  const bytes = new TextEncoder().encode(s);
+  if (bytes.byteLength > MAX_SANITIZED_STRING_FIELD) {
+    return new TextDecoder().decode(bytes.slice(0, MAX_SANITIZED_STRING_FIELD));
+  }
+  return s;
+}
+
+/** Stable privacy boundary for diagnostic text that may be persisted. */
+export function sanitizeDiagnostic(value: unknown): string {
+  return scrubString(value instanceof Error ? value.message : String(value));
+}
+
+export function sanitizedJsonBytes(value: unknown): Uint8Array {
+  return new TextEncoder().encode(jcsStringify(scrubValue(value, 0)));
+}