Audit foundation: append-only Finding Evidence Ledger with deterministic state reduction

[PhysShell]

Classification

• Change type: enhancement / audit infrastructure
• Priority: P0
• Expected value: very high — central spine for lifecycle, corroboration, review outcomes and future calibration
• Implementation risk: medium-high — provenance and reducer correctness are product truth
• Canonical owner: Own.NET/audit/ until the planned audit lift-out
• Depends on: Audit foundation: finding identity v2 (pattern, occurrence, lineage) with provenance #266
• Related foundation: Audit taxonomy: introduce rule-level risk lanes and separate CodeStyle from actionable findings #267

Problem

The audit ecosystem already emits useful evidence from several independent paths:

• normalized static findings and cross-tool clusters;
• FP-judge overlays;
• runtime correlation;
• LeakFixMine/SZZ historical verdicts;
• future 007 action and gate outcomes.

Today these artifacts are consumed as snapshots. A finding can be fixed, suppressed, runtime-confirmed, reopened or made obsolete, but a single mutable status cannot explain how that state was reached or allow later evidence to revise it honestly.

Goal

Add an append-only Finding Evidence Ledger and a deterministic state reducer.

The ledger stores observations and decisions. Current state is derived from events; it is not edited in place as unexplained truth.

Event model

Initial event vocabulary should cover at least:

FindingEmitted
FindingPersisted
FindingMoved
FindingDisappeared
FindingReappeared
ReviewerConfirmed
ReviewerRejected
JudgeVerdictRecorded
SuppressionAdded
SuppressionRemoved
AnalyzerConfigChanged
AnalyzerVersionChanged
CodeChangedNearby
FixCommitLinked
TestAdded
RuntimeConfirmed
HistoricalFixConfirmed
FindingReopened
ArtifactProvenanceRejected

Names may change during design review, but the semantic distinctions must survive. In particular:

• disappearance is not automatically a fix;
• suppression is not disappearance;
• file deletion is not proof of a true positive;
• config/tool changes are not code fixes;
• stale or digest-mismatched evidence is rejected visibly.

Storage contract

Use one stdlib-only SQLite store for the ledger spine unless measurement proves otherwise.

Suggested logical tables:

finding_patterns
finding_occurrences
finding_lineages
evidence_events
dispositions
actions
artifact_provenance
reducer_snapshots   # optional cache, always reproducible from events

Requirements:

• foreign keys enabled on every connection;
• append-only event identity and idempotent ingestion;
• schema versioning and explicit migrations;
• stable artifact digests;
• deterministic ordering/reduction;
• no INSERT OR REPLACE behavior that deletes parent identity and dependent evidence;
• resumable ingestion.

Provenance

Every event must identify:

event_id
schema_version
source_kind
source_artifact
source_digest
observed_at
producer/tool + version
source_commit/run identity
pattern_id / occurrence_id / lineage_id as applicable

A parser successfully reading JSON is not proof that the evidence is current or authentic. Digest mismatch, unknown schema or broken provenance must become explicit rejected-evidence records/coverage output.

Deterministic reducer

The reducer derives a state vocabulary such as:

Candidate
Corroborated
Verified
Rejected
Suppressed
FixCandidate
FixedCorroborated
Obsolete
Reopened
Inconclusive

Exact names are reviewable. Required behavior:

• reducer is pure over ordered events;
• rerunning it produces byte-stable normalized state;
• late evidence may legitimately change a derived state;
• conflicting evidence remains represented, not overwritten;
• manual disposition remains distinguishable from machine observation;
• unknown/inconclusive is a first-class result.

Initial adapters

Build thin adapters for artifacts that already exist; do not build new detectors here:

1. normalized findings.json;
2. fp-verdicts.json with generated_from verification;
3. existing runtime findings/correlation artifact;
4. LeakFixMine verdict export or a documented placeholder seam if the cross-repo adapter lands in OwnAudit separately.

Adapters normalize evidence into the ledger. They do not invent a parallel report pipeline.

Required controls

1. Same artifact ingested twice → no duplicate events.
2. Stale FP overlay digest → rejected, never merged.
3. Static candidate + independent runtime confirmation → derived corroborated/verified state.
4. Finding disappears only after analyzer configuration changes → not Fixed.
5. Finding disappears after targeted code change but no corroboration → FixCandidate, not verified truth.
6. Later regression/reappearance → Reopened while preserving prior history.
7. Conflicting human and judge verdicts → both evidence records retained; disposition policy is explicit.
8. Broken provenance → visible finding/coverage result.
9. Full replay from events matches any cached reducer snapshot.

Acceptance

• Versioned ledger/event contract is documented.
• SQLite schema and append-only ingestion are implemented with idempotency.
• Deterministic reducer is covered by transition and replay tests.
• Existing finding/FP/runtime evidence can be ingested without changing analyzer semantics.
• Stale or invalid provenance fails loudly and remains reportable.
• No state transition depends solely on a finding disappearing.
• Existing audit report can consume derived state behind an opt-in path.
• Lift-out discipline is preserved: no parallel implementation in OwnAudit.

Non-goals

• No ML ranker, probability or conformal prediction.
• No automatic suppression, deletion or merge blocking.
• No new analyzer rules.
• No 007 enforcement behavior.
• No audit lift-out in the same PR.
• No attempt to absorb LeakFixMine's specialized corpus database into this schema.

[PhysShell]

Cross-repo execution map

Downstream issues created from this foundation:

• PhysShell/OwnAudit#40 — Git lifecycle/SZZ evidence adapter (P0)
• PhysShell/007#42 — action-level records, costs and verifier outcomes (P1)
• PhysShell/OwnAudit#41 — deterministic evidence-aware triage (P1)
• PhysShell/OwnAudit#42 — calibration/conformal research gate (P2, deferred)

Recommended order:

Own.NET #266 + #267
        ↓
Own.NET #268
        ↓
OwnAudit #40  ||  007 #42
        ↓
OwnAudit #41
        ↓
OwnAudit #42

The final stage is intentionally gated on real labels/outcomes; it is not permission to start ML while the ledger contract is still wet cement.

[PhysShell]

Downstream remediation artifact: PhysShell/OwnAudit#43 now tracks fix-proof.json.

Boundary to keep sharp:

• this issue remains the canonical append-only evidence ledger and deterministic lifecycle reducer;
• OwnAudit#43 emits one proof packet per fix attempt and may ingest/link its result as evidence;
• the proof packet must not create a second mutable finding-status store or duplicate lifecycle reduction.