feat(audit): add optional Base anchoring and admin configuration

[VirtualAdam]

Latest Azure qualification status (2026-09-16)

Current source: b0e0768e75cfa410ad73975aede5f7444e54435c. 65 local Rust/Foundry cases passed, plus the standalone local Anvil transport harness; live qualification remains blocked. Registry follow-up and superseded Anvil limitation: #293 (comment). Azure gateway signer prerequisite: #295 (Project #5 / Todo). Detailed results, provider genesis-pruning finding, evidence limitations and cleanup: #287 (comment).

The dedicated Base Sepolia wallet is funded, but the product gateway remains AWS-only. BSP-01/02 are blocked; BSP-03 through BSP-10 are not executed. Native #292 remains stopped/incomplete. No product transactions were signed or broadcast in this preflight. This remains a draft stacked on #283. Earlier source-specific evidence below is historical and is not a live-acceptance claim.

---

Current deadlock-fix integration: b0e0768

This draft now includes foundation 32a7772d13f59561fa205b37a6ea5575283af3aa, which reuses PR #290 at its original authored commit 35b76f162e3fbf7f80ae2819ac639fab906de8de to address #223. Run-before-agent locking, destination revalidation and the ten concurrency/authority regressions are retained unchanged. Both development-dependency additions were kept when resolving the additive Cargo.toml conflict. The combined Base source passed 25 real PostgreSQL steering/audit regressions, store all-target Clippy, formatting and49 immutable migrations. Complete hosted integration at this exact new head passed on attempt1, including Codex, the100-scenario lane and downstream chaos evidence. Five hosted jobs passed, but Windows runner tests failed in two unchanged native connection fixtures with "native setup operation timed out" at integration_tests.rs:143. The original failed job104887183796 and its log are retained. The single bounded Windows-only rerun passed as job104891894932; the source-bound run now reports all six jobs successful. GitHub issued new attempt2 job IDs for inherited green jobs, but their original start times are unchanged. No integration rerun, timeout increase or test suppression was used. Current run: https://github.com/All-The-Vibes/ecorp/actions/runs/35123617139. This remains a draft stacked on #283. Native #292 qualification is still incomplete and BSP-01 through BSP-10 remain NOT_EXECUTED; no budget reset, new mission, acceptance closure, live-testnet action or merge was performed.

---

Earlier audit review-correction record

Summary

Reuse the existing State Audit Base implementation rather than rebuilding it. Add optional, explicitly enabled Base anchoring, administrative configuration, durable worker reconciliation, and an isolated signing gateway. Unconfigured deployments retain the existing unanchored/default-disabled behavior.

The contribution process exposed and corrected two clean-checkout portability defects: migration manifest entries now describe the unchanged committed LF SQL bytes, and Git preserves LF for the deterministic compiled registry artifact.

Draft only: factory qualification is incomplete. The contributor explicitly authorized opening this draft using retained local evidence, with incomplete factory qualification and known failures disclosed. This is an operator-published review draft, not a factory-accepted artifact or approval of the implementation. Merge remains gated on independent review and applicable acceptance. Auto-merge, deployment, and native outcome approval are not implied by publication authorization.

Tracking and stack

• Refs [State Audit V2] Optional Base anchoring with admin configuration and explicit enablement #287; it remains open until BSP-01 through BSP-10 live Base Sepolia qualification and authorized outcome review are complete, even if this code PR merges first.
• Related evidence-only native task: [State Audit] Validate corrected Base checkpoint for #287 (evidence only) #292, explicitly parented under [State Audit V2] Optional Base anchoring with admin configuration and explicit enablement #287 on All-The-Vibes Project Implement resumable browser event streams with sequence cursors #5. It remains open because factory qualification is incomplete.
• Umbrella: [Feature] Add versioned state audit with GitHub checkpoints and Ethereum anchoring #281, referenced but not closed by this contribution.
• Foundation: PR Implement State Audit Protocol V1 #283, branch feature/281-state-audit-v1, commit 6b72eebcf2bd5c990a52b715f45f1876b3240df4, incorporated by explicit ancestry-preserving merges.
• Separate runner prerequisite and inherited fixture failures: Native GitHub setup: empty core.hooksPath is incompatible with Git 2.55 #289. Its implementation is not included here.

Keep the feature review stacked on #283 while that foundation remains unmerged. After the foundation lands, reconcile against its actual merge commit and merge strategy before retargeting this PR to main.

Tracking is GitHub-only: the contributor clarified that the workspace's ADO work-item requirement applies to PRs hosted in ADO, not this GitHub contribution. No ADO work item is represented or required here.

Source and change boundary

Original implementation input: faf703e33b22264fb4a0fef2c1b645098671500c.

Earlier manifest-qualified input: 8f31c8860ca7673cf2fe13223a993adb18e6060e, branch contrib/287-manifest-checkpoint, tree 3d75b1f5b0878f34a82df7c72226ded3e242be7d.

The original feature diff at the earlier manifest-qualified input contains 86 files (+23862/-70). It covers crates/crony-base, crates/crony-base-gateway, registry contract/artifact/fixtures under contracts, directly affected CLI/server/store audit modules, additive migrations47-49 and checksum metadata, pinned toolchain scripts, and feature/operator documentation. Exact changed-file diff. The two portability corrections change only .gitattributes and db/migrations/manifest.json. Existing SQL and compiled registry artifact Git blobs remain unchanged.

The original development worktree, index, remotes, and unrelated documentation work remain preserved. The native validation task was restricted to docs/evidence/issue287-base-validation.md; it could not change implementation source. That report was not completed and is not included in this PR. Operator helper corrections and the separate #289 runner change are also not included.

Authorized review closeout

Current head: 3ff5e622413a9270af9522581d0dd172a86b0576, still on contrib/287-manifest-checkpoint. Foundation ancestor: 6b72eebcf2bd5c990a52b715f45f1876b3240df4. Current feature diff: 86 files (+23857/-64), with no duplicated foundation patch.

1e0be38 corrects the Rust 1.98 chunks_exact_to_as_chunks warning in the registry REVM test while preserving complete ABI-word decoding. Explicit merges incorporate #283's durable missing-witness failure and LF compiler/source binding. The small manifest and attributes merge conflicts retained all 49 qualified migration entries and both contracts' checkout rules. The Base registry source/artifact and all SQL blobs remain unchanged. Only the foundation reference contract's compiler metadata was regenerated; its ABI/executable code are unchanged. No feature was rebuilt from scratch.

Fresh operator-local evidence (Rust 1.97.1, not a claim of local Rust 1.98 parity):

• At 1e0be38: targeted registry Clippy/REVM, migration/compatibility, formatting and pnpm build:web / pnpm lint:web passed.
• At combined source f665b78: cargo clippy --locked --workspace --all-targets -- -D warnings passed; cargo test --locked --workspace --exclude crony-runner -- --test-threads=1 passed (418 passed, 368 ignored); cargo test --locked -p crony-server -p crony-store issue281_ -- --ignored --test-threads=1 passed (2 publisher-loop and 15 store cases) against owned disposable PostgreSQL.
• At final source 3ff5e62, after the foundation artifact correction: cargo test --locked -p crony-audit, cargo clippy --locked -p crony-audit --all-targets -- -D warnings, migration/compatibility checks and cargo fmt --check passed. Both actual in-process contract targets are included; no public-chain transaction occurred.

The excluding-runner result is not a full-workspace pass. The two unchanged #289 failures reproduced in the current foundation's full-workspace run; they have not been removed or folded into this contribution. Exact local logs are retained under the isolated Base worktree's ignored output/issue293-*.log; current hosted results must be read from this PR's checks.

This is additional operator-local review evidence, not a completed native #292 report or authorized outcome approval. The stopped native lineage, accounting and missing checkpoint proof are unchanged. BSP-01 through BSP-10 remain NOT_EXECUTED: no real KMS/gateway provisioning, independent RPC qualification, test-ETH funding, deployment or live Base Sepolia transactions have been authorized or performed. Issues #287, #292 and umbrella #281 stay open. This PR remains draft.

Existing local qualification

These are actual earlier local qualification results, not fresh runs performed for draft publication or native acceptance. The initial batch ran against faf703e plus the corrected migration manifest; the final .gitattributes change then fixed registry checkout EOL behavior. The retained final record identifies 8f31c88, the successful registry rerun, excluding-runner suite and fresh-checkout checks. Native results against the exact published input are distinguished below.

Command or gate	Observed local result
node tools/check_migrations.mjs	Passed;49 immutable migrations
node tools/check_state_audit_compatibility.mjs	Passed
cargo fmt --check	Passed
cargo clippy --locked --workspace --all-targets -- -D warnings	Passed
pnpm build:web / pnpm lint:web	Passed
cargo test --locked -p crony-base -p crony-base-gateway -p crony-audit	Passed; ignored cases are not counted as executed
cargo test --locked -p crony-store base_v2_ -- --ignored --test-threads=1	21 explicitly enabled cases passed
cargo test --locked -p crony-base --test gateway_journal -- --ignored --test-threads=1	Passed
cargo test --locked -p crony-base-gateway --lib -- --ignored --test-threads=1	Passed
cargo test --locked -p crony-server --bin crony-server base_v2_api_http_disconnected_preserves_v1_and_authorization -- --ignored --nocapture	Passed
cargo test --locked -p crony-server --bin crony-base-worker base_worker_observation_paging_http -- --ignored --nocapture	Passed
cargo test --locked -p crony-server --bin crony-base-worker base_worker_http_gateway_restart_and_finality -- --ignored --nocapture	Passed;267.47 seconds in the actual worker/gateway/Anvil restart, reorg and finality case
pwsh -NoProfile -File tools/test_base_registry.ps1	Passed;24.106 seconds for the complete pinned registry gate
cargo test --locked --workspace	Failed with the two unchanged runner fixtures below
cargo test --locked --workspace --exclude crony-runner	418 passed,366 ignored; not a full-workspace pass
Fresh checkouts with core.autocrlf=true and false	Deterministic artifact retains the original committed LF bytes

The two full-workspace failures are:

connections::integration_tests::native_fixture_personal_github_profiles_and_login_replay_survive_restart
connections::integration_tests::native_fixture_ready_ack_refresh_rejection_and_old_run_pins_survive_restart

Both are tracked separately in #289: Git2.55 rejects their unchanged empty core.hooksPath configuration. Do not hide them, remove the tests, or describe the excluding-runner result as a full-suite pass.

Reproduction uses the repository-pinned package manager with canonical npm registry metadata, frozen lockfiles, and retained integrity/TLS checks. Database and chain cases require owned disposable PostgreSQL and pinned local Anvil fixtures; they must not be directed at the contributor application database.

Native factory provenance and remaining review

Latest result: factory qualification is incomplete. The corrected native batch passed structure, Clippy, web, Base units, store and both gateway groups; full workspace retained the two #289 failures. Admin HTTP has no completion receipt, and paging, registry and the long-worker case were not executed in that batch. No final native report, artifact, verifier result or human outcome approval exists. Detailed issue292 outcome.

The native-capability review used the existing controller, native Copilot adapter, contract revisions, and same-session resume. Specific gaps encountered were host PowerShell result/command resolution and the inability to recover a token-stop run after checkpoint capture timed out. This contribution does not introduce another orchestrator, reset factory accounting, or change those native safeguards.

Retained native execution history and recovery evidence

The original mission c574ea22-d228-477d-9525-5006e5c4c93d and task 4a29633c-5eab-4cf2-9b23-8ea8bfe6e5bf retain both cancelled runs:

b4597ebf-d6cb-4d4e-b23b-496dace03a29
6e19a547-c51f-4721-a3c6-c6579cf247b9

Their cumulative940915 recorded tokens and failures are not reset or replaced. The latest run ended at constrain, so the native budget-revision API's preserved-suspend prerequisite is not satisfied. No native recovery guard or database state was patched.

Issue #292 is a separate evidence-only task against the corrected immutable input. It uses the existing ECorp controller and native Copilot adapter, not an alternative agent runtime. Its command launcher invokes existing repository checks and retains fresh outputs. The owner/admin human-review requirement remains enabled.

Its run 147d86b4-b8ef-416d-91d0-196c3196c0b1 passed only the migration checker before the frozen PowerShell harness failed: two asynchronous copy calls emitted extra result objects, preventing access to the captured command's exit status. The failed receipt 58b29d82-49f6-4d09-8e5a-cdd00705667d is retained. The run was explicitly interrupted and is cancelled, with 107802 recorded tokens; combined recorded usage is 1048717 tokens. No report, native artifact, verification outcome, or human acceptance was produced.

A versioned host-only correction suppresses the extra values and correctly serializes the cache-use Boolean. Its isolated child-process regression passed; that is not product qualification. The original frozen helpers, policy, receipts, and claim remain unchanged. The documented factory verification-recovery endpoint rejects the cancelled task because it requires exactly one failed task. No replacement mission, attempt reset, or policy bypass was used; the supported pre-verification continuation is recorded next.

Subsequent native admission established a different supported path: this task had not entered verification, its verification status remained pending, and its factory item remained running. The native API accepted narrow resume contract revision 007bd3cd-5724-4066-b59e-638d62415252, binding both producer and all twelve verifiers to the corrected bundle without changing check selections, timeouts, scope, budget, or manual gate. Same-session resume produced run 7dce410f-4953-4f62-9d6d-99fde53899b2 with the existing provider session and physical worktree. The existing task attempt and all accounting remain intact.

That continuation passed migration/compatibility/format checks, Clippy, web build/lint, and the Base unit group. It also executed the workspace suite, retaining exactly the two inherited runner failures above. The batch then failed before database setup because host application discovery returned both docker.exe and extensionless docker as one executable value. Receipt 4403eb75-448c-48b0-aefe-014805726737 and its full command logs are retained. No database, registry, or long-worker native result was produced.

The continuation was explicitly interrupted and is cancelled, with 114631 recorded tokens. At that point issue292 cumulative usage was222433 of300000 tokens, leaving77567; combined original and evidence-task usage was1163348 tokens. Recorded cost was0microusd, which is not a claim about actual billing. No native artifact, outcome approval, or PR existed at that stage.

A second versioned host-only correction selects the first application in existing PATH order for Docker, Git, Cargo, and Node. Actual host command-resolution and prior capture/guard regressions passed; these are helper tests, not product qualification. ECorp confirmed source-run preservation in event 98cb2121-befe-47b4-9a48-999399eda0a3, sequence1024, after fingerprinting the complete retained physical worktree, including ignored build files. No cache deletion or checkpoint-state override occurred.

Native contract revision df972963-21bf-43da-a96e-217a0ebd4bae, version3, then bound the second correction to the producer and all twelve matching verifiers. Same-session continuation 9e2cc872-da2a-4ecc-8b35-9ff0c1cbfc20 was admitted with the remaining77567-token allowance. It actually reran the batch with the retained warm target; earlier results were not substituted as fresh execution. Scope, immutable product input, existing attempt, budgets, check selections/timeouts, and the human gate remained unchanged.

Latest native outcome: blocked by the automatic token stop. At03:37:20UTC the native circuit breaker cancelled that continuation after86639 recorded tokens against its77567 allowance. Issue292 cumulative usage is309072/300000, an overshoot of9072, with no remaining allowance. Combined original287 and292 usage is1249987 recorded tokens; reported cost remains0microusd and is not a billing assertion.

The fresh partial batch passed migrations, compatibility, formatting, Clippy, web build/lint, Base units, store, and both gateway groups. The full workspace suite again failed with precisely the two inherited runner failures. Admin HTTP started but has no completion/exit receipt; paging, registry and the actual long-worker acceptance case did not run. Partial command logs are retained under receipt directory e0ebcd17-0baf-4ea4-95a4-a7c496a826a6; no final receipt.json or generated report exists.

Native event1118 reports physical retention without checkpoint proof, because hard-boundary capture timed out; the workspace fingerprint is null. The disposition string preserved alone must not be treated as a resumable checkpoint. No native artifact, verifier outcome or human acceptance exists. Further execution is blocked pending an explicitly authorized, supported recovery path; no budget reset, replacement task, checkpoint override, or manual execution around the stop is authorized.

The native60-second per-check limit does not independently cover the approximately five-minute worker case or the full workspace suite. Separate fresh execution receipts and genuine outcome review remain necessary. Successful short checks alone do not approve the implementation.

Dedicated PostgreSQL and Anvil test fixtures were stopped after cancellation; their data, source workspaces, caches, claims and partial evidence remain retained. The contributor stack was left running. Draft publication does not resume the stopped factory job or change its outcome.

Risk and assurance boundaries

Base activation remains explicit and disabled by default. Configuration/preview do not deploy, fund, register, or authorize public-chain transactions. Do not infer customer activation from a merged PR.

Local evidence uses a fixture signer, synthetic fee/archive data, and RPC endpoints backed by one disposable chain. It does not establish production KMS permissions, provider independence, customer restore readiness, public-chain behavior, or enterprise compliance. The standalone registry Anvil transport script was not executed in the earlier local qualification or the incomplete native batch; no result is claimed for it.

Provider-observed Base finality is not independently verified Ethereum consensus. Anchors support tamper evidence and prior-existence evidence, not automatic authorship, ownership, legal notarization, or SOX compliance. Private complete-history retention and backups remain necessary.

Hosted Actions passed at the exact current head as recorded below. Merge, auto-merge, customer activation/access, product transaction signing and deployment remain disabled. Separately authorized testnet wallet funding and non-transaction key proof are described in the latest qualification update above; neither qualifies live anchoring.

Historical hosted closeout status (superseded)

Hosted CI passed all six jobs at exact head 3ff5e622413a9270af9522581d0dd172a86b0576: quality (including full workspace), integration, Ubuntu/Windows/macOS runner jobs, and Windows desktop. Run: https://github.com/All-The-Vibes/ecorp/actions/runs/35115202355 . This does not replace incomplete native #292 evidence or BSP-01 through BSP-10 live Base Sepolia acceptance. The PR remains draft and stacked on #283; no merge, activation, funding, deployment, or issue closure occurred.

[VirtualAdam]

Hosted CI passed all six jobs at exact head 3ff5e622413a9270af9522581d0dd172a86b0576: quality (including full workspace), integration, Ubuntu/Windows/macOS runner jobs, and Windows desktop. Run: https://github.com/All-The-Vibes/ecorp/actions/runs/35115202355 . This does not replace incomplete native #292 evidence or BSP-01 through BSP-10 live Base Sepolia acceptance. The PR remains draft and stacked on #283; no merge, activation, funding, deployment, or issue closure occurred.

[VirtualAdam]

Published #223 integration at b0e0768, preserving #290's original authored commit through the corrected foundation32a7772. Combined real-PostgreSQL regressions passed25/25, including observed contention. Full new hosted integration is pending. Draft, native-stop and live-Sepolia acceptance boundaries remain unchanged.

[VirtualAdam]

Full integration passes atb0e0768e75cfa410ad73975aede5f7444e54435c, including the originally failing Codex step and all downstream scenarios. Attempt1 failed only Windows runner: two native connection fixture setup timeouts at connection_setup/integration_tests.rs:143 (211 passed,2 failed,1 already ignored). crony-runner is unchanged from both previous Base3ff5e62 and green foundation32a7772; these fixtures use separate embedded fake-gh/fake-codex scripts, not the changed steering fixture. Retained failed job104887183796 and original logs. Requested exactly one Windows-only rerun, with no source changes, timeout changes, ignored tests, or rerun of green integration. A repeated timeout will remain a visible separate blocker rather than retrying until green.

[VirtualAdam]

Final result atb0e0768e75cfa410ad73975aede5f7444e54435c: all six hosted jobs now pass. https://github.com/All-The-Vibes/ecorp/actions/runs/35123617139. Complete integration passed on attempt1. The only rerun was the failed Windows job, and its unchanged native fixtures pass on that single rerun; original failure evidence remains retained. Reused #290/#223 through foundation32a7772. This PR remains draft, with no main merge or feature acceptance; native #292 and BSP-01 through BSP-10 remain incomplete.

[VirtualAdam]

Current-source preflight recorded: 45 local cases passed; live qualification is still blocked. Azure signer work is tracked in #295, not implemented or factory-ready. Full report: #287 (comment).

Draft/stack and native #292 stop remain unchanged. No live BSP acceptance is claimed.

[VirtualAdam]

Local registry qualification follow-up

Source remains b0e0768e75cfa410ad73975aede5f7444e54435c. The late test inventory identified additional local checks, now executed:

Existing command	Result
pwsh -NoProfile -File tools\test_base_registry.ps1	9 Foundry and 10 REVM cases passed; pinned artifact reproducibility passed; native Foundry and solc-js creation/runtime bytecode matched exactly
node tools\test_base_registry_anvil.mjs 18545	Standalone local JSON-RPC registry transport harness passed; transaction receipts and evidence retained
cargo test --locked -p crony-base --features test-support --test rpc -- --ignored --nocapture	1 explicitly selected local Anvil RPC case passed, 3 filtered out

The final RPC case was checked for a silent skip: there is no internal early-return or environment-variable opt-out. It uses loopback 127.0.0.1:18545, asserts chain 84532, and checks the deployed registry code hash. Evidence: crates/crony-base/tests/rpc.rs:81-107. The preceding Anvil run deployed the expected fixture registry before this case ran.

Combined with the earlier 45 cases: 65 local Rust/Foundry cases passed, plus the standalone Anvil transport harness. The transport harness is reported separately rather than inventing a unit-test count for its assertions.

An initial Anvil startup failed because its pinned binary was absent. That failure is retained; the repository's existing tools\setup_base_registry.ps1 restored the toolchain, after which the local runs succeeded. No product source changes were made.

The identity-recorded, loopback-only Anvil process is stopped. Its evidence and the stopped PostgreSQL fixture data remain retained. This used local synthetic accounts only: no Azure key signing, public testnet transaction, funded-wallet spending, or mainnet operation occurred.

These results supersede the earlier "standalone Anvil not executed" limitation for this source. They do not qualify public Base behavior, production custody, independent RPC providers or live BSP-01 through BSP-10. Azure signer prerequisite #295 and the live environment/provider prerequisites remain open. Native #292's stop and incomplete acceptance remain unchanged; #293 remains draft and stacked on #283.