{"record":{"id":"8d84a3067a3c20eb","repo":"affaan-m/ECC","slug":"harness-health-evidence-integrity-verification-fai","errorCode":null,"errorMessage":"harness health evidence integrity verification failed","messagePattern":"harness health evidence integrity verification failed","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"ecc2/src/session/store.rs","lineNumber":5609,"sourceCode":"                return Ok(());\n            }\n            anyhow::bail!(\"missing harness health evidence integrity metadata\");\n        }\n        let (Some(json), Some(digest), Some(asserted), Some(status)) = fields else {\n            anyhow::bail!(\"incomplete harness health evidence integrity metadata\");\n        };\n        if json.len() > 8192 {\n            anyhow::bail!(\"harness health evidence exceeds integrity verification bound\");\n        }\n        let snapshot: HealthEvidenceSnapshot = serde_json::from_str(json)?;\n        let snapshot_candidate_id =\n            Self::resolve_harness_candidate_id(&self.conn, &snapshot.candidate_id)?;\n        if snapshot.canonical_json()? != *json\n            || snapshot.digest()? != *digest\n            || snapshot.asserted_healthy != asserted\n            || snapshot_candidate_id != entry.candidate_id\n        {\n            anyhow::bail!(\"harness health evidence integrity verification failed\");\n        }\n        let event_consistent = match entry.event_type.as_str() {\n            \"promoted\" => status == \"healthy\" && asserted,\n            \"promotion_rolled_back\" => status == \"unhealthy\" && !asserted,\n            \"health_check_error_rolled_back\" => status == \"error\",\n            _ => false,\n        };\n        if !event_consistent {\n            anyhow::bail!(\"harness health evidence is inconsistent with audit outcome\");\n        }\n        if let Some(evaluation_id) = entry.evaluation_id {\n            let evaluation: (Option<String>, Option<String>, Option<bool>, Option<String>, bool) = self.conn.query_row(\n                \"SELECT health_evidence_json, health_evidence_sha256, asserted_health, health_check_status, legacy_unverifiable FROM harness_evaluations WHERE id = ?1\",\n                [evaluation_id],\n                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?, row.get(4)?)),\n            )?;\n            if evaluation\n                != (","sourceCodeStart":5591,"sourceCodeEnd":5627,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/ecc2/src/session/store.rs#L5591-L5627","documentation":"Round-trip verification of stored health evidence failed: re-parsing health_evidence_json into a HealthEvidenceSnapshot and recomputing canonical_json() and digest() does not reproduce the stored digest, or snapshot.asserted_healthy != stored asserted, or the resolved snapshot candidate_id != entry.candidate_id. This is the tamper/corruption detector.","triggerScenarios":"Any of: health_evidence_json was edited after writing; health_evidence_sha256 is stale; asserted_health was flipped; the snapshot's candidate_id (after alias resolution) differs from the audit entry's candidate_id.","commonSituations":"Manual DB edits to any of the four columns; a serialization/hash algorithm change between write and verify; bit rot; a malicious or buggy write that did not compute the digest canonically.","solutions":["Recompute and rewrite the health evidence (json, sha256, asserted, status) from the authoritative source so the round-trip holds.","Never edit health_evidence_json / health_evidence_sha256 / asserted_health columns directly.","Pin the canonical_json + digest algorithm to a versioned implementation so writes and verifies agree."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Proactive round-trip check at write time so verification can never fail later.\nlet json = health_evidence.canonical_json()?;\nlet digest = health_evidence.digest()?;\nlet round_trip: HealthEvidenceSnapshot = serde_json::from_str(&json)?;\nassert_eq!(round_trip.canonical_json()?, json, \"canonical_json not stable\");\nassert_eq!(round_trip.digest()?, digest, \"digest not stable\");\nassert_eq!(round_trip.asserted_healthy, health_evidence.asserted_healthy);\nassert_eq!(round_trip.candidate_id, health_evidence.candidate_id);","typeGuard":"fn health_evidence_round_trips(he: &HealthEvidenceSnapshot) -> bool {\n    let Ok(json) = he.canonical_json() else { return false; };\n    let Ok(digest) = he.digest() else { return false; };\n    let Ok(rt) = serde_json::from_str::<HealthEvidenceSnapshot>(&json) else { return false; };\n    rt.canonical_json().ok().as_deref() == Some(json.as_str())\n        && rt.digest().ok().as_deref() == Some(digest.as_str())\n        && rt.asserted_healthy == he.asserted_healthy\n        && rt.candidate_id == he.candidate_id\n}","tryCatchPattern":"match verify_audit_entry(&store, &entry) {\n    Ok(()) => { /* ok */ }\n    Err(e) if e.to_string().contains(\"integrity verification failed\") => {\n        // tamper/corruption detected. Quarantine the row, recompute from the authoritative\n        // source, and alert — do not silently overwrite.\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Never edit health_evidence_json, health_evidence_sha256, or asserted_health directly.","Pin the canonical_json/digest algorithm to a versioned implementation shared by writers and verifiers.","Write a round-trip unit test and run it on every release that touches serialization."],"tags":["rust","sqlite","harness","integrity","tamper-detection"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}