1. 1#![allow(clippy::unwrap_used, clippy::expect_used)]
2. 2
3. 3//! The ledger is the product's evidence. These assert it is durable on write
4. 4//! and tamper-evident on read.
5. 5
6. 6use std::path::PathBuf;
7. 7
8. 8use vak_session::types::{Entry, EntryPayload, FrozenContract, SessionHeader};
9. 9use vak_session::{ActivityKind, ActivityRecord, ActivityStatus, SessionLog};
10. 10
11. 11fn header() -> SessionHeader {
12. 12 SessionHeader {
13. 13 agent: None,
14. 14 session_id: "s-chain".into(),
15. 15 created_at: chrono::Utc::now(),
16. 16 cwd: PathBuf::from("/tmp/proj"),
17. 17 parent_session_id: None,
18. 18 contract_id: None,
19. 19 work_item_id: None,
20. 20 conversation: None,
21. 21 contract: FrozenContract {
22. 22 app_version: "0.1.0".into(),
23. 23 provider: "anthropic".into(),
24. 24 model: "claude-sonnet-4-5".into(),
25. 25 route_ladder: Vec::new(),
26. 26 route_objective: String::new(),
27. 27 route_annotations: Vec::new(),
28. 28 system_prompt: "system prompt v1".into(),
29. 29 permission_mode: "workspace-write".into(),
30. 30 capabilities: Vec::new(),
31. 31 prompt_layers: Vec::new(),
32. 32 },
33. 33 }
34. 34}
35. 35
36. 36fn activity(label: &str) -> ActivityRecord {
37. 37 ActivityRecord {
38. 38 activity_id: format!("a-{label}"),
39. 39 turn: Some(1),
40. 40 kind: ActivityKind::Diagnostic,
41. 41 status: ActivityStatus::Succeeded,
42. 42 label: label.into(),
43. 43 detail: None,
44. 44 data: Default::default(),
45. 45 }
46. 46}
47. 47
48. 48fn seeded(path: &std::path::Path) -> SessionLog {
49. 49 let mut log = SessionLog::create(path.to_path_buf(), header()).unwrap();
50. 50 for label in ["first", "second", "third"] {
51. 51 log.append_activity(activity(label)).unwrap();
52. 52 }
53. 53 log
54. 54}
55. 55
56. 56#[test]
57. 57fn every_appended_entry_links_to_its_predecessor() {
58. 58 let dir = tempfile::tempdir().unwrap();
59. 59 let path = dir.path().join("s.jsonl");
60. 60 let log = seeded(&path);
61. 61 let entries = log.chain_to_root();
62. 62
63. 63 assert!(
64. 64 entries[0].prev_hash.is_none(),
65. 65 "the first entry has no predecessor"
66. 66 );
67. 67 for entry in &entries[1..] {
68. 68 assert!(
69. 69 entry.prev_hash.is_some(),
70. 70 "every later entry must carry a chain link"
71. 71 );
72. 72 }
73. 73 drop(log);
74. 74
75. 75 let reopened = SessionLog::open(path).unwrap();
76. 76 assert!(
77. 77 reopened.warnings().is_empty(),
78. 78 "an untouched ledger must verify clean: {:?}",
79. 79 reopened.warnings()
80. 80 );
81. 81}
82. 82
83. 83/// The point of the chain: an interior edit that re-links `parent_id`
84. 84/// correctly is still caught.
85. 85#[test]
86. 86fn an_interior_edit_is_detected_on_reopen() {
87. 87 let dir = tempfile::tempdir().unwrap();
88. 88 let path = dir.path().join("s.jsonl");
89. 89 drop(seeded(&path));
90. 90
91. 91 let text = std::fs::read_to_string(&path).unwrap();
92. 92 let mut lines: Vec<String> = text.lines().map(String::from).collect();
93. 93 assert!(lines.len() >= 3);
94. 94 lines[1] = lines[1].replace("first", "tampered");
95. 95 std::fs::write(&path, lines.join("\n") + "\n").unwrap();
96. 96
97. 97 let reopened = SessionLog::open(path).unwrap();
98. 98 assert!(
99. 99 reopened
100. 100 .warnings()
101. 101 .iter()
102. 102 .any(|w| w.contains("broken hash chain")),
103. 103 "a rewritten entry must be reported: {:?}",
104. 104 reopened.warnings()
105. 105 );
106. 106}
107. 107
108. 108/// Ledgers are a frozen, append-only contract. A file written before chaining
109. 109/// existed must still open, with the gap reported rather than raised.
110. 110#[test]
111. 111fn pre_chain_ledgers_still_open_and_say_so() {
112. 112 let dir = tempfile::tempdir().unwrap();
113. 113 let path = dir.path().join("s.jsonl");
114. 114 drop(seeded(&path));
115. 115
116. 116 let text = std::fs::read_to_string(&path).unwrap();
117. 117 let stripped: Vec<String> = text
118. 118 .lines()
119. 119 .map(|line| {
120. 120 let value: serde_json::Value = serde_json::from_str(line).unwrap();
121. 121 let mut map = value.as_object().unwrap().clone();
122. 122 map.remove("prev_hash");
123. 123 serde_json::to_string(&map).unwrap()
124. 124 })
125. 125 .collect();
126. 126 std::fs::write(&path, stripped.join("\n") + "\n").unwrap();
127. 127
128. 128 let reopened = SessionLog::open(path).unwrap();
129. 129 assert_eq!(
130. 130 reopened.len(),
131. 131 stripped.len(),
132. 132 "an unchained ledger must still be fully readable"
133. 133 );
134. 134 assert!(
135. 135 reopened
136. 136 .warnings()
137. 137 .iter()
138. 138 .any(|w| w.contains("before hash chaining")),
139. 139 "the unverifiable gap must be reported: {:?}",
140. 140 reopened.warnings()
141. 141 );
142. 142 assert!(
143. 143 !reopened
144. 144 .warnings()
145. 145 .iter()
146. 146 .any(|w| w.contains("broken hash chain")),
147. 147 "absent links are not evidence of tampering"
148. 148 );
149. 149}
150. 150
151. 151/// Appending onto a legacy ledger must start chaining from that point rather
152. 152/// than leaving the rest unverifiable forever.
153. 153#[test]
154. 154fn appending_to_a_legacy_ledger_starts_the_chain() {
155. 155 let dir = tempfile::tempdir().unwrap();
156. 156 let path = dir.path().join("s.jsonl");
157. 157 drop(seeded(&path));
158. 158 let text = std::fs::read_to_string(&path).unwrap();
159. 159 let stripped: Vec<String> = text
160. 160 .lines()
161. 161 .map(|line| {
162. 162 let value: serde_json::Value = serde_json::from_str(line).unwrap();
163. 163 let mut map = value.as_object().unwrap().clone();
164. 164 map.remove("prev_hash");
165. 165 serde_json::to_string(&map).unwrap()
166. 166 })
167. 167 .collect();
168. 168 std::fs::write(&path, stripped.join("\n") + "\n").unwrap();
169. 169
170. 170 let mut log = SessionLog::open(path.clone()).unwrap();
171. 171 let appended = log.append_activity(activity("after")).unwrap();
172. 172 assert!(
173. 173 appended.prev_hash.is_some(),
174. 174 "a new append links to the last line it actually saw"
175. 175 );
176. 176 drop(log);
177. 177
178. 178 let reopened = SessionLog::open(path).unwrap();
179. 179 assert!(
180. 180 !reopened
181. 181 .warnings()
182. 182 .iter()
183. 183 .any(|w| w.contains("broken hash chain")),
184. 184 "chaining onto a legacy tail is not a break: {:?}",
185. 185 reopened.warnings()
186. 186 );
187. 187}
188. 188
189. 189/// A torn final line (crash mid-append) must stay recoverable.
190. 190#[test]
191. 191fn a_torn_tail_does_not_make_the_session_unreadable() {
192. 192 let dir = tempfile::tempdir().unwrap();
193. 193 let path = dir.path().join("s.jsonl");
194. 194 drop(seeded(&path));
195. 195
196. 196 let mut text = std::fs::read_to_string(&path).unwrap();
197. 197 text.push_str("{\"id\":\"partial\",\"ts\":\"2026");
198. 198 std::fs::write(&path, text).unwrap();
199. 199
200. 200 let reopened = SessionLog::open(path).unwrap();
201. 201 assert!(reopened.len() >= 3);
202. 202 assert!(
203. 203 reopened
204. 204 .warnings()
205. 205 .iter()
206. 206 .any(|w| w.contains("unparseable")),
207. 207 "the torn line must be reported: {:?}",
208. 208 reopened.warnings()
209. 209 );
210. 210}
211. 211
212. 212#[test]
213. 213fn an_absent_link_is_omitted_rather_than_serialized_as_null() {
214. 214 let entry = Entry::new(None, EntryPayload::Header(header()));
215. 215 let json = serde_json::to_string(&entry).unwrap();
216. 216 assert!(
217. 217 !json.contains("prev_hash"),
218. 218 "an absent link must not be serialized as null: {json}"
219. 219 );
220. 220}
221. 221