affaan-m/ECC · error · anyhow::Error

missing harness health evidence integrity metadata

Error message

missing harness health evidence integrity metadata

What it means

When verifying an audit entry, all four health-evidence fields (json, digest, asserted, status) are None. This is permitted only when legacy_unverifiable is set or the event_type is initial_activation or promotion_rejected; for any other event (promoted, rolled back, etc.) health evidence is mandatory.

Source

Thrown at ecc2/src/session/store.rs:5593

    }

    fn verify_harness_audit_entry(&self, entry: &HarnessAuditEntry) -> Result<()> {
        let fields = (
            &entry.health_evidence_json,
            &entry.health_evidence_sha256,
            entry.asserted_health,
            &entry.health_check_status,
        );
        if matches!(fields, (None, None, None, None)) {
            if entry.legacy_unverifiable
                || matches!(
                    entry.event_type.as_str(),
                    "initial_activation" | "promotion_rejected"
                )
            {
                return Ok(());
            }
            anyhow::bail!("missing harness health evidence integrity metadata");
        }
        let (Some(json), Some(digest), Some(asserted), Some(status)) = fields else {
            anyhow::bail!("incomplete harness health evidence integrity metadata");
        };
        if json.len() > 8192 {
            anyhow::bail!("harness health evidence exceeds integrity verification bound");
        }
        let snapshot: HealthEvidenceSnapshot = serde_json::from_str(json)?;
        let snapshot_candidate_id =
            Self::resolve_harness_candidate_id(&self.conn, &snapshot.candidate_id)?;
        if snapshot.canonical_json()? != *json
            || snapshot.digest()? != *digest
            || snapshot.asserted_healthy != asserted
            || snapshot_candidate_id != entry.candidate_id
        {
            anyhow::bail!("harness health evidence integrity verification failed");
        }
        let event_consistent = match entry.event_type.as_str() {

View on GitHub (pinned to 01e15490f0)

Solutions

Backfill health evidence for existing promoted/rolled_back rows from the authoritative source.
Ensure every promotion code path persists health_evidence_json, health_evidence_sha256, asserted_health, and health_check_status as a group.
Mark genuinely unverifiable historical rows with legacy_unverifiable = 1 so the verifier skips them.

Defensive patterns

Strategy: validation

Validate before calling

// Before verifying, confirm the row is either exempt or fully populated.
let (json, digest, asserted, status, legacy, event): (Option<String>, Option<String>, Option<bool>, Option<String>, bool, String) =
    conn.query_row(
        "SELECT health_evidence_json, health_evidence_sha256, asserted_health, health_check_status, legacy_unverifiable, event_type
         FROM harness_eval_audit WHERE id = ?1", [id],
        |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?, r.get(4)?, r.get(5)?)))?;
let exempt = legacy || matches!(event.as_str(), "initial_activation" | "promotion_rejected");
if matches!((json, digest, asserted, status), (None, None, None, None)) && !exempt {
    return Err(anyhow::anyhow!("audit row {id} missing required health evidence"));
}

Type guard

fn audit_has_required_health(json: Option<&str>, legacy: bool, event: &str) -> bool {
    legacy || matches!(event, "initial_activation" | "promotion_rejected") || json.is_some()
}

Try / catch

match verify_audit_entry(&store, &entry) {
    Ok(()) => { /* ok */ }
    Err(e) if e.to_string().contains("missing harness health evidence integrity metadata") => {
        // backfill the four fields, or mark the row legacy_unverifiable=1 if unverifiable
    }
    Err(e) => return Err(e),
}

Prevention

Ensure every promotion write populates all four health-evidence columns.
Mark historical, pre-health-evidence rows with legacy_unverifiable=1 during migration.
Add a NOT NULL constraint on those columns for non-exempt event types.

When it happens

Trigger: An audit row whose event_type is promoted/promotion_rolled_back/health_check_error_rolled_back, legacy_unverifiable is false, and all four health-evidence columns are NULL.

Common situations: A DB migrated from an older schema that lacked health-evidence columns; a code path that wrote a promotion audit row without populating health metadata; a partial migration that left rows half-populated.

Related errors

AI-assisted analysis of affaan-m/ECC@01e15490f0 (2026-08-13). Data as JSON: /api/errors/cfd2bd7e383b5c4a. Report an issue: GitHub.