plugin-audit redaction writer: admit and open each checkpoint once per run, not once per row

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Follow-up of #31908 (PR #32630, slice S9 + P3), from its contract re-review at 150cac4b (record on PR #32630, nit N2). Filed under the maintainer's rule of 2026-11-12 09:41Z: simple review findings get their own card, not another PR round. It does not block #32630; it should land before P4 makes sealing a default.

Blocked-by: #31908

维护者速读

改什么：审计脱敏迁移改写已封存的行时，每一行都重新校验一次检查点签名、重建一次根、打开一次签名密钥。应改成每次运行每个检查点只做一次。
为什么：成本随窗口内行数平方增长；用 KMS 时每行一次远程调用。
风险：只改迁移内部缓存，不改判定规则与输出。
先看：packages/plugins/plugin-audit/src/audit-seal/amendment-writer.ts 的检查点准入与开钥路径。
验证：一次运行内同一检查点只验签一次、只开钥一次，有计数 pin；判定与现有 pin 全部不变。
需要你做的：无，p3。

Do

Admit (verify the signature under a trusted key, rebuild the root from leaf_hashes) and open the signing seed once per checkpoint per migration run, and reuse the result for every row that checkpoint lists. Keep the admission rule exactly as it is (one D6 rule, shared with the verifier).
Pin it: a run over N rows of one checkpoint verifies that checkpoint once and calls the crypto provider's open once (count spy), and every existing redaction pin in audit-seal-redaction-live.integration.test.ts stays as it is.

Clause-②: no (internal). Metadata-protocol: none.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: first-touch audit (pre-labeled card) · `p3` confirmed · state → `pm:blocked` · 2026-11-13T08:26Z

⛔ Not a claim; the claim (if any) is unchanged.

Line: operators running audit redaction with sealing · amendment writer · per migration run, sealing not default yet · read
Why: Performance of a non-default sealing migration; p3 kept; its Blocked-by plugin-audit + objectql lifecycle: build the audit tamper-evidence ADR — sealer, signed checkpoints, redaction and expiry amendments, os audit verify #31908 is still open.
Rule: the card was filed already carrying a grade and state and had no triage audit; this is that audit, under the adopted grading rules (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997). The state moves because an edge in Blocked-by: is still open.

Generated by Claude Code

domain:server#5 · os-elon-musk · session_016WV4cz2MxDkQYCC4U8indM

Claim: area-lease pilot #33059 · area A2 · 2026-11-14T21:35Z · rides #31908 slice P4a (seat 5 approved)
Session: session_016WV4cz2MxDkQYCC4U8indM
Account: os-elon-musk
Branch: claude/area-A2-31908-p4a
Domain: domain:server
Seat: domain:server#5 (area A2, lease:A2)
File surface: packages/plugins/plugin-audit/src/audit-seal/amendment-writer.ts and its tests. Admit and open each checkpoint once per run.

Navigation Menu

Repository navigation

plugin-audit redaction writer: admit and open each checkpoint once per run, not once per row #32737

维护者速读

Do

Triage: first-touch audit (pre-labeled card) · `p3` confirmed · state → `pm:blocked` · 2026-11-13T08:26Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

plugin-audit redaction writer: admit and open each checkpoint once per run, not once per row #32737

Description

维护者速读

Do

Activity

objectstack-fleet commented on Nov 13, 2026

Triage: first-touch audit (pre-labeled card) · p3 confirmed · state → pm:blocked · 2026-11-13T08:26Z

objectstack-fleet commented on Nov 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first-touch audit (pre-labeled card) · `p3` confirmed · state → `pm:blocked` · 2026-11-13T08:26Z