{"record":{"id":"ad62133ba536a657","repo":"affaan-m/ECC","slug":"audit-health-evidence-does-not-match-its-evaluatio","errorCode":null,"errorMessage":"audit health evidence does not match its evaluation","messagePattern":"audit health evidence does not match its evaluation","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"ecc2/src/session/store.rs","lineNumber":5635,"sourceCode":"        if !event_consistent {\n            anyhow::bail!(\"harness health evidence is inconsistent with audit outcome\");\n        }\n        if let Some(evaluation_id) = entry.evaluation_id {\n            let evaluation: (Option<String>, Option<String>, Option<bool>, Option<String>, bool) = self.conn.query_row(\n                \"SELECT health_evidence_json, health_evidence_sha256, asserted_health, health_check_status, legacy_unverifiable FROM harness_evaluations WHERE id = ?1\",\n                [evaluation_id],\n                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?, row.get(4)?)),\n            )?;\n            if evaluation\n                != (\n                    Some(json.clone()),\n                    Some(digest.clone()),\n                    Some(asserted),\n                    Some(status.clone()),\n                    false,\n                )\n            {\n                anyhow::bail!(\"audit health evidence does not match its evaluation\");\n            }\n        }\n        Ok(())\n    }\n\n    #[cfg(test)]\n    fn connection_for_test(&self) -> &Connection {\n        &self.conn\n    }\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use chrono::{Duration as ChronoDuration, Utc};\n    use std::fs;\n\n    struct TestDir {","sourceCodeStart":5617,"sourceCodeEnd":5653,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/ecc2/src/session/store.rs#L5617-L5653","documentation":"If an audit entry references an evaluation_id, the store cross-checks that the referenced harness_evaluations row has identical health fields (health_evidence_json, health_evidence_sha256, asserted_health, health_check_status, legacy_unverifiable=false) to the audit entry. A mismatch breaks cross-table consistency.","triggerScenarios":"An audit row with evaluation_id pointing at a harness_evaluations row whose health columns differ from the audit's, or whose legacy_unverifiable is not false.","commonSituations":"An evaluation was updated without updating its audit row (or vice versa); a partial migration; a code path that wrote the evaluation and its audit in separate transactions, one of which partially failed.","solutions":["Always insert the harness_evaluations row and its harness_eval_audit row in the same transaction with identical health values.","If repairing, update both rows to the same authoritative values in one transaction.","Add a trigger or application-layer invariant so an evaluation and its audit cannot diverge."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Before verifying, confirm the referenced evaluation matches the audit row.\nif let Some(eid) = entry.evaluation_id {\n    let eval: (Option<String>, Option<String>, Option<bool>, Option<String>, bool) = conn.query_row(\n        \"SELECT health_evidence_json, health_evidence_sha256, asserted_health, health_check_status, legacy_unverifiable\n         FROM harness_evaluations WHERE id = ?1\", [eid],\n        |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?, r.get(4)?)))?;\n    let want = (entry.health_evidence_json.clone(), entry.health_evidence_sha256.clone(),\n                entry.asserted_health, entry.health_check_status.clone(), false);\n    if eval != want {\n        return Err(anyhow::anyhow!(\"audit row {eid} diverges from its evaluation\"));\n    }\n}","typeGuard":"fn audit_matches_evaluation(audit: &AuditFields, eval: &EvalFields) -> bool {\n    audit.health_evidence_json == eval.health_evidence_json\n        && audit.health_evidence_sha256 == eval.health_evidence_sha256\n        && audit.asserted_health == eval.asserted_health\n        && audit.health_check_status == eval.health_check_status\n        && !eval.legacy_unverifiable\n}","tryCatchPattern":"match verify_audit_entry(&store, &entry) {\n    Ok(()) => { /* ok */ }\n    Err(e) if e.to_string().contains(\"audit health evidence does not match its evaluation\") => {\n        // reconcile both rows to the same authoritative values in one transaction\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Always insert the harness_evaluations row and its harness_eval_audit row in the same transaction with identical health values.","Add a trigger that rejects an audit row whose fields diverge from its referenced evaluation.","Never UPDATE one of the two tables without the other."],"tags":["rust","sqlite","harness","audit","integrity"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}