fix(reliability): rebuild artifact ledger integrity on current main

[seonghobae]

Objective

Reconstruct the bounded fail-closed artifact-link ledger integrity slice directly on current protected main, replacing stale #435 without importing its ancestry.

Exact current-main reconstruction

• protected base: eb0a32e87e7470469c8fa0f8c67d9583654bef57;
• exact current head: edbe7752530a925f3be3a0de73d11fa906735d41;
• branch is exactly one commit ahead and zero behind protected main;
• changed paths are exactly five files;
• the protected-main input blobs for both modified existing files were byte-identical to fix(reliability): reconcile artifact ledger on current main #435's construction inputs;
• all five output blobs are byte-identical to the reviewed fix(reliability): reconcile artifact ledger on current main #435 result.

Integrity contract

• token identifiers are immutable authorization identities and cannot be rebound at runtime or during replay;
• ISSUE, REVOKE, and READ publication occurs only after the configured durable append returns successfully;
• append uses FileChannel, writes every remaining byte, and forces the channel before acknowledging authority;
• failed append cannot leave process-local issuance, revocation, or read-audit state absent from durable evidence;
• persisted duplicate issuance and malformed/truncated ledger state fail closed through the controlled invalid-line boundary;
• repeated revocation of an already revoked token remains idempotent without rewriting terminal authority.

Test-first lineage

The predecessor regressions prove duplicate token identity cannot be rebound, durable acknowledgement failure cannot publish authority, configured ledger-write failure cannot publish local issuance/revocation/read state, and service mismatch tests use a separately constructed verification ledger rather than attempting to overwrite a live token identity. Predecessor checks and approvals do not transfer to this exact head.

Scope boundary

This is a single-process append-only file-ledger hardening slice. It does not provide cross-process locking, distributed consensus, database/object-store transactions, status-code validation, revocation-transition replay validation, read-event identity binding, credential rotation, or a complete audit platform. The ordered children must be rebuilt after this parent reaches protected main.

Merge gate

Keep Draft until exact-head CI, Security Scan, SAST Semgrep, fuzz, zero valid unresolved findings, and a qualifying independent non-author approval are present. Any head movement requires complete exact-head revalidation.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 30adce88-941e-4439-b9cf-8b457302d8e1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}