Raven Scott
8a6c1e7b09
- Docs: kernel-program truth, PLACEHOLDER_BASELINE, POSIX_DECLARED_PROFILE, env appendix (BARE_OS_SHELL_PIPEFAIL, BARE_OS_WASM_KERNEL), package-bare-os-booter - Booter: syscalls.json fd model, process_table exitStatusModel, shell pipeline exit status + kernel-runner script-error path, mirror mounts test + handbook - Seeder: corestore_snapshot proc alignment test; hyperswarm ^4.17.0; kernel mirror sync - Vault: vault_save audit after saveVaultToDrive; split bare-os-vault-rotation-audit.js - Contract: protomux/hyperswarm lock fixture + test; IPC stats ipcBackpressure test - Coreutils: XCU tests, bare-cron man seed, ACL/xattr metadata path test - Tooling: kernel-microbench + release-gate fixture doc; ADR 002 WASM compile hook - Changelog/ctx d.ts and dependency/lockfile updates as needed
35 lines
1.0 KiB
JavaScript
35 lines
1.0 KiB
JavaScript
/**
|
|
* Plaintext NDJSON audit on the personal drive (no sealed vault material).
|
|
*/
|
|
|
|
import b4a from 'b4a'
|
|
|
|
/**
|
|
* Append a non-secret rotation / handoff checkpoint to the personal drive (plaintext NDJSON audit).
|
|
* Signing keys stay in the vault; this records operator metadata only.
|
|
* Rows may include **`kind`**: **`vault_save`** (after vault snapshot) or rotation handoff fields from callers.
|
|
* @param {Record<string, unknown>} ctx
|
|
* @param {Record<string, unknown>} row
|
|
*/
|
|
export async function bareOsAppendVaultRotationCheckpoint(ctx, row) {
|
|
const drive = ctx.personalDrive
|
|
if (!drive || typeof drive.put !== 'function') {
|
|
throw new Error('bareOsAppendVaultRotationCheckpoint: personal drive unavailable')
|
|
}
|
|
const line =
|
|
JSON.stringify({
|
|
schema: 1,
|
|
ts: Date.now(),
|
|
...row
|
|
}) + '\n'
|
|
const path = '/.bare/vault-rotation-audit.ndjson'
|
|
let prev = ''
|
|
try {
|
|
const b = await drive.get(path, { follow: false })
|
|
if (b) prev = b4a.toString(b)
|
|
} catch {
|
|
/* new */
|
|
}
|
|
await drive.put(path, b4a.from(prev + line))
|
|
}
|