Extract PRISM audit artifact ownership

[kiwidream]

Position in the stack

PR 3 of 9. Base: prism-coordinator-core-owners. Depends on PR 74. Next: PR 76.

Review this PR against its configured base. See the stack guide for the complete order.

Why this slice exists

Audit evidence needs one filesystem authority and one durable ordering authority. Process order, height, filename, and mtime cannot safely choose current evidence across restart, same-height replacement, replay, or reorg. This slice moves filesystem publication into audit_artifacts and makes the PostgreSQL ledger assign the durable publication ordinal at block confirmation.

What changes

• Make audit_artifacts own descriptor-relative filesystem access, canonical verification, atomic publication, replay/repair, retention, and current-evidence selection.
• Keep canonical bundle subprocess work in bundle_compiler and database authorization in the ledger.
• Add audit_publication_sequence to qbit_pool_blocks, deterministic historical backfill, uniqueness/state constraints, and confirmation/reactivation semantics.
• Preserve an ordinal on exact replay and inactive-to-confirmed reactivation.
• Add fresh, legacy, partial, malformed, concurrent, cross-process, and bigint-boundary migration gates.
• Add canonicalization parity tests between the Rust CLI and library representation.

Why the diff is large

GitHub reports about 17,000 additions, but most of that is the correctness proof around a sensitive persistence boundary:

• about 4,400 lines establish the filesystem owner;
• about 3,600 lines directly test that owner;
• about 5,800 lines are PostgreSQL parity, migration, and process-race gates;
• the remainder is SQL, ledger integration, coordinator delegation, and focused regressions.

This is not primarily coordinator line reduction. The additional code makes filesystem identity, cross-process publication, migration failure modes, and replay ordering explicit and testable. Review the SQL transition first, then the filesystem invariants, then coordinator/ledger wiring, and finally the process gates.

Behavior and risk

This is a high-risk durability and upgrade slice. The intentional behavior change is durable audit publication ordering. Confirmation allocates an ordinal; exact confirmation replay and later reactivation retain it. Audit sequence, not process timing or height, selects current evidence.

Required existing-database migration

Deployments with PRISM_POSTGRES_INIT_SCHEMA=0 must apply crates/qbit-prism/sql/001_share_ledger.sql before starting the upgraded coordinator.

The cumulative script is idempotent, but the migration is read- and write-impacting: ALTER TABLE takes ACCESS EXCLUSIVE; a later serialized phase takes a transaction advisory lock plus SHARE ROW EXCLUSIVE on qbit_pool_blocks; and the unique index is built non-concurrently. Stop the old coordinator or use a reviewed maintenance window, take the normal backup, and apply with ON_ERROR_STOP using the PRISM database role and schema search path.

Validation

• 339 focused audit, ledger, candidate, and refresh tests passed at this boundary.
• PostgreSQL 16.14 base, A1 parity, migration, and cross-process gates passed.
• Rust qbit-prism: 182 passed on the final tree.
• The cumulative final evidence is recorded in final validation.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

High Risk
Changes block-confirmation persistence, live-database migration locking, and audit ordering invariants; upgrades need a maintenance window and correct schema application before rollout.

Overview
Introduces audit_publication_sequence on qbit_pool_blocks as the ledger-owned ordering key for audit evidence, allocated when a block moves prepared → confirmed via nextval in qbit_confirm_pool_block. Inactive → confirmed reactivation keeps the existing ordinal; idempotent confirmation replay does not mint a new one.

The cumulative SQL adds qbit_audit_publication_sequence_seq, a large idempotent upgrade (advisory lock, backfill for confirmed/inactive rows by found_at/block_hash, unique index, check that confirmed rows always have a positive sequence), and pins search_path on qbit_confirm_pool_block / qbit_reactivate_pool_block so sequence and table resolution cannot be hijacked.

Rust audit_cli tests add a shared canonicalize_cli_value helper and assert the qbit-prism-audit-canonicalize CLI matches library canonical_audit_bundle_bytes for reordered JSON, explicit null optionals, Unicode miner IDs, and large testnet-scale bundles.

^{Reviewed by Cursor Bugbot for commit 6426c85. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dbbe0242a8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a0f1f78920

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 290a444. Configure here.}