P2 F6.1a: persist PEP decisions in a tenant-scoped audit chain

[gnanirahulnutakki]

Goal

Persist the existing privacy-minimized PEP decision events as a tenant-scoped, append-only, hash-chained PostgreSQL journal, so current reads and typed proposals no longer rely only on process logs for audit durability.

Parent: #24 (E6 F6.1/F6.3 foundation)
Depends on: #230 / PR #231

Scope

• Add a versioned canonical audit-entry envelope for the current PEP decision event only.
• Store one strictly ordered sequence and SHA-256 chain per workspace.
• Serialize concurrent appends by locking a per-workspace chain head in the same transaction as entry insertion and head advancement.
• Enforce workspace RLS and transaction-local scope on entries and heads.
• Deny the application role UPDATE/DELETE privileges on immutable entries.
• Verify sequence continuity, previous hashes, canonical entry hashes, and retained-head agreement.
• Wire the durable sink into the hub PEP so append failure continues to fail closed before an operation runs.
• Preserve the existing secret-minimizing boundary: no credentials, tokens, raw arguments, selectors, targets, result data, database URLs, or binding digests in journal entries.

Acceptance criteria

• Every current PEP decision that returns from the hub enforcement path is durably appended before an allowed operation can proceed.
• Concurrent appends in one workspace cannot fork or reuse a sequence number.
• Different workspaces remain independently ordered and RLS-isolated.
• The application role can insert/select required rows but cannot update or delete immutable audit entries.
• Verification detects mutation, deletion, reordering, a broken previous-hash link, a forged entry hash, and head mismatch.
• An unavailable or rejected audit write fails the PEP closed.
• PostgreSQL integration tests prove append, concurrency, RLS, privilege, and tamper-detection behavior.
• Unit/race/fuzz tests and the repository CI/release snapshot pass.
• README is reviewed and updated only if the operator-facing contract changes.

Non-goals / honest claim boundary

This slice does not complete F6.1 or F6.3. It does not add action lifecycle phases, intent-id correlation, the Ardur decision ledger, query/export APIs, retention, WORM media, external timestamping, or externally signed checkpoints. A database owner could still replace the entire chain and head; externally anchored integrity is a later F6.3 slice.

It grants no write/action authority, credential access, network connector, shell, filesystem, dispatch, approval, or execution capability.

Security and reliability design

• OWASP recommends separate audit records, restrictive database command permissions, sensitive-data minimization, interaction identifiers, and tamper detection.
• PostgreSQL row locks serialize writers to the same head until transaction end; append and head advancement must be atomic.
• RLS is defense in depth, not a substitute for table privileges; immutable-entry UPDATE/DELETE must be revoked from the application role.
• The per-workspace head is mutable coordination state; the event history is immutable.

Cost / operability

Each policy decision adds one short database transaction and serializes within its workspace. This can become a hot-workspace bottleneck at high decision volume. Storage grows linearly; retention, archival, integrity-check metrics, and anchored checkpoints are deliberately deferred and must be designed before production-scale rollout.

Primary sources

• OWASP Logging Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html
• PostgreSQL explicit row locking: https://www.postgresql.org/docs/current/explicit-locking.html#LOCKING-ROWS
• PostgreSQL row security: https://www.postgresql.org/docs/current/ddl-rowsecurity.html
• PostgreSQL REVOKE: https://www.postgresql.org/docs/current/sql-revoke.html

[gnanirahulnutakki]

Local packaging checkpoint (2026-07-17): the installed Go toolchain fails go mod verify with “go.mod file not found” in every Sith worktree, including direct toolchain invocation and a fresh module cache, while go env GOMOD, go list -m, go mod download, all builds, and all tests resolve the same module correctly. This is recorded as a machine-level tooling blocker; no repository workaround or gate weakening was added.

All remaining release-check stages passed manually: two clean GoReleaser snapshots, distribution verification, SPDX SBOMs, Homebrew formula generation, multi-arch OCI layout verification from the release archives, and digest comparison. The PR's clean GitHub reproducible archives · SPDX SBOM · Homebrew formula job remains mandatory before merge and will provide the definitive go mod verify proof in a clean runner.

[gnanirahulnutakki]

Pre-commit implementation checkpoint for #232:

Implemented:

• migration 0009 with per-workspace chain heads and immutable policy-audit entries
• forced RLS on both tables
• application role SELECT/INSERT only for entries and SELECT/INSERT/UPDATE only for heads; DELETE denied
• versioned, length-framed, domain-separated SHA-256 entry envelope
• atomic same-workspace serialization with SELECT FOR UPDATE
• repeatable-read full-chain verification
• production sink ordering: durable append before structured process log; either failure blocks the PEP
• README availability, privacy, and integrity-limit contract

Verification:

• full make ci green (format, vet, lint, govulncheck, race tests, scripts, perf, binary e2e, build)
• real PostgreSQL 18.4 RLS/concurrency/privilege/tamper integration green
• complete e2e-isolation suite green, including both 50k workspace fuzzers
• policy hash framing fuzz: >4.3M executions in 30s plus 10k confirmation
• two clean snapshot builds, distribution/SBOM/formula/OCI verification, and digest comparison green
• CodeRabbit local review: 10 files, no findings
• README reviewed and updated

Local machine exception remains documented in the prior comment: only local go mod verify is broken across all worktrees; the clean-runner release archive job remains mandatory before merge.

[gnanirahulnutakki]

Completed via PR #233 and dev merge 0e476f5.

The landed F6.1a foundation provides tenant-scoped, append-only, hash-chained PEP audit entries; forced RLS and least-privilege isolation; repeatable-read verification; and fail-closed ordered delivery to the durable database before the structured process log. CodeRabbit findings on surviving column-level grants and swallowed slog handler failures were fixed and both threads resolved.

Exact post-merge evidence:

• CI: https://github.com/ArdurAI/sith/actions/runs/29614053092
• CodeQL: https://github.com/ArdurAI/sith/actions/runs/29614052923
• GitHub security queues: Dependabot 0, code scanning 0, secret scanning 0.

This closes only F6.1a. Full F6.1 decision-ledger semantics and F6.3 replay remain dependent on the real Ardur PDP and typed intent/action contracts.