{"record":{"id":"24786abceb69304a","repo":"affaan-m/ECC","slug":"harness-health-evidence-exceeds-integrity-verifica","errorCode":null,"errorMessage":"harness health evidence exceeds integrity verification bound","messagePattern":"harness health evidence exceeds integrity verification bound","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"ecc2/src/session/store.rs","lineNumber":5599,"sourceCode":"            entry.asserted_health,\n            &entry.health_check_status,\n        );\n        if matches!(fields, (None, None, None, None)) {\n            if entry.legacy_unverifiable\n                || matches!(\n                    entry.event_type.as_str(),\n                    \"initial_activation\" | \"promotion_rejected\"\n                )\n            {\n                return Ok(());\n            }\n            anyhow::bail!(\"missing harness health evidence integrity metadata\");\n        }\n        let (Some(json), Some(digest), Some(asserted), Some(status)) = fields else {\n            anyhow::bail!(\"incomplete harness health evidence integrity metadata\");\n        };\n        if json.len() > 8192 {\n            anyhow::bail!(\"harness health evidence exceeds integrity verification bound\");\n        }\n        let snapshot: HealthEvidenceSnapshot = serde_json::from_str(json)?;\n        let snapshot_candidate_id =\n            Self::resolve_harness_candidate_id(&self.conn, &snapshot.candidate_id)?;\n        if snapshot.canonical_json()? != *json\n            || snapshot.digest()? != *digest\n            || snapshot.asserted_healthy != asserted\n            || snapshot_candidate_id != entry.candidate_id\n        {\n            anyhow::bail!(\"harness health evidence integrity verification failed\");\n        }\n        let event_consistent = match entry.event_type.as_str() {\n            \"promoted\" => status == \"healthy\" && asserted,\n            \"promotion_rolled_back\" => status == \"unhealthy\" && !asserted,\n            \"health_check_error_rolled_back\" => status == \"error\",\n            _ => false,\n        };\n        if !event_consistent {","sourceCodeStart":5581,"sourceCodeEnd":5617,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/ecc2/src/session/store.rs#L5581-L5617","documentation":"The serialized health evidence JSON in an audit row exceeds the 8192-byte integrity-verification bound, so the store refuses to verify it (a bound this large suggests untrimmed payload rather than legitimate evidence).","triggerScenarios":"Verifying an audit entry where health_evidence_json.len() > 8192.","commonSituations":"The HealthEvidenceSnapshot was built with large/unbounded payloads (full metric arrays, complete traces, raw logs); verbose JSON serialization; a snapshot that embedded an entire evaluation report.","solutions":["Trim the HealthEvidenceSnapshot to essential, bounded fields before serializing.","Store large evidence externally (object store / file) and embed only a reference plus its digest in the snapshot.","Compress or summarize metrics so the canonical JSON stays well under 8192 bytes."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"let health_json = health_evidence.canonical_json()?;\nif health_json.len() > 8192 {\n    return Err(anyhow::anyhow!(\n        \"health evidence JSON is {} bytes; trim the snapshot to stay under 8192\", health_json.len()\n    ));\n}","typeGuard":"fn health_evidence_within_bound(he: &HealthEvidenceSnapshot) -> bool {\n    he.canonical_json().map(|j| j.len() <= 8192).unwrap_or(false)\n}","tryCatchPattern":"match verify_audit_entry(&store, &entry) {\n    Ok(()) => { /* ok */ }\n    Err(e) if e.to_string().contains(\"exceeds integrity verification bound\") => {\n        // rebuild the snapshot with trimmed/referenced payloads and rewrite the row\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Build HealthEvidenceSnapshot from a small, fixed set of fields; never embed raw traces.","Reference large evidence by digest+URI instead of inlining it.","Add a unit test asserting canonical_json().len() stays well under 8192 for realistic inputs."],"tags":["rust","harness","health-evidence","bounds"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}