[sinkog]

Refs #165

What

Setx logged a recording failure and returned a normal response with Warnings: nil, so a caller could not tell "execution succeeded" from "the proof was persisted".

• SetResponse.Proof (persisted, commit, error_code) is returned on every successful execution. The error_code is a fixed value (record_failed, recorder_not_configured); the recorder error text (which may name Vault paths) stays in the log.
• ExecutionRecorder is unchanged. A new optional CommitRecorder lets Setx return the persisted commit hash; WorkflowRecorder implements it (it used to discard the hash from RecordState).
• cabinet.WithEvidenceRequired / CIC_EVIDENCE_REQUIRED=true: an execution whose proof was not persisted (recording failed, or no recorder is configured) fails with ErrEvidenceRequired, mapped to HTTP 503 evidence_required. The workflow has already run at that point, so the error carries the chain_hash. CIC_EVIDENCE_REQUIRED accepts only true/false; any other value is a start-up error.
• Default is unchanged in status: HTTP 200, proof.persisted=false, trace kept.
• context/SYMBOLS.md regenerated (6 new exported symbols).

Claim check against the issue

All three acceptance points are covered. One addition the issue did not mention: returning the commit hash needed the new CommitRecorder, because ExecutionRecorder.Record returns only an error and WorkflowRecorder dropped the hash.

Tests

With the old behaviour restored under the new types (temporarily), these fail: all seven TestSetx_Proof_* cabinet tests and TestSetHandler_EvidenceRequired.

Characterization only, they do not fail without the change: TestSetHandler_ProofInResponse (serialises the mock's response), TestEvidenceRequiredFromEnv (new function), the RecordCommit unit tests. var _ cabinet.CommitRecorder = (*WorkflowRecorder)(nil) breaks the build if RecordCommit is removed, and TestWorkflowRecorder_RecordCommit_RealGitRecorder_ReturnsHead checks the hash against the real git HEAD.

Local gates (Docker golang:1.26.11): gofmt -s -l empty, go vet ./... clean, staticcheck (cabinet, recorder, cmd/relay) clean, go test -count=1 ./... all ok, no new entry in deadcode ./....

Reachability

cmd/relay/main.go setHandler -> cabinet.NewAPI(...).Set -> Setx -> recordProof -> WorkflowRecorder.RecordCommit -> GitStateRecorder.RecordState. Switch: main.go evidenceRequiredFromEnv -> cabinet.WithEvidenceRequired in the NewCabinetService call.

Not covered / notes

• main() was not run; the switch wiring is verified by reading and deadcode, not by a test.
• In required mode the workflow's side effects have already happened before the 503; the 503 does not undo them.
• Not done: a start-up failure when CIC_EVIDENCE_REQUIRED=true and no recorder is configured (it is a per-call 503 today), and a per-workflow declaration (needs a workflow-format change).
• Docs: the CIC_EVIDENCE_REQUIRED row is not added to docs/{hu,en}/pipeline/relay-container.md, because fix(relay): require an explicit CIC_TRUST_MODE and guard prod against an unloaded trust store #176 edits the adjacent CIC_TRUST_MODE row; follow-up after both merge.
• The response mixes key styles (Results/Trace capitalised, new proof lowercase) because SetResponse has no JSON tags; proof follows the issue text.
• The commit carries the developer's Vault signing metadata, added by a global commit hook. No workflow or CI files are touched.

🤖 Generated with Claude Code