# Tasks — network-plugin-audit-mesh

> Blocked on: `network-core`, `network-plugin-crypto-messages`.

## 1. Scaffold

- [x] 1.1 `packages/network/network-plugin-audit-mesh/` with `package.json`, `tsconfig.json`, `vitest.config.ts`, `README.md`.
- [x] 1.2 Workspace deps: `@suaveplan/network`, `@suaveplan/error`, `@suaveplan/types`, `@suaveplan/events`, `@suaveplan/crypto-hash`, `@suaveplan/timing`, `@opentelemetry/api`, `zod`.
- [x] 1.3 `sideEffects: false`.

## 2. Types

- [x] 2.1 `src/types/log.types.ts` — `LogEntry`, `LogEventType`, `LogCheckpoint`.
- [x] 2.2 `src/types/replication.types.ts` — `ReplicationTarget`, `ReplicationMode`.
- [x] 2.3 `src/types/conflict.types.ts` — `ConflictResolution`, `DivergentChain`.
- [x] 2.4 `src/error-codes.ts` — `defineCodes("NET_AUDIT", [...])`.

## 3. Signed log

- [x] 3.1 `src/log/signed-log.ts` — `SignedLog`.
- [x] 3.2 Append-only with monotonic `seq`.
- [x] 3.3 Each entry: `seq, timestamp, eventType, payload, prevHash, hostId, hostSignature`.

## 4. Log replicator

- [x] 4.1 `src/replicator/log-replicator.ts` — `LogReplicator`.
- [x] 4.2 Replicates to `R` sibling hosts (default 2).
- [x] 4.3 Tier-aware target selection.
- [x] 4.4 Synchronous for CRITICAL, async for NORMAL.

## 5. Log retriever

- [x] 5.1 `src/retriever/log-retriever.ts` — `LogRetriever`.
- [x] 5.2 Range queries: `getLogs(meshId, fromSeq, toSeq)`.
- [x] 5.3 Pagination for large ranges.

## 6. Integrity checker

- [x] 6.1 `src/integrity/integrity-checker.ts` — `IntegrityChecker`.
- [x] 6.2 Verifies hash chain on retrieval.
- [x] 6.3 Detects gaps, forks, tampered entries.
- [x] 6.4 Emits `audit:corruption-detected`.

## 7. Conflict resolver

- [x] 7.1 `src/conflict/conflict-resolver.ts` — `ConflictResolver`.
- [x] 7.2 Longest chain wins.
- [x] 7.3 Equal length: lexicographically smallest last-hash wins.

## 8. Log compaction

- [x] 8.1 `src/compaction/log-compaction.ts` — `LogCompaction`.
- [x] 8.2 Periodic checkpoint creation.
- [x] 8.3 Checkpoint = signed state snapshot at sequence number.

## 9. Plugin wrapper

- [x] 9.1 `src/plugin/audit-mesh-plugin.ts` — `AuditMeshPlugin` implements `NetworkPlugin`.

## 10. Spec

- [x] 10.1 Update `openspec/specs/network/spec.md` with `NET-AUDIT` requirements.

## 11. Conformance tests

- [x] 11.1 `src/log/signed-log.spec-conformance.test.ts` — append, chain, signature.
- [x] 11.2 `src/replicator/log-replicator.spec-conformance.test.ts` — R-copy, target selection.
- [x] 11.3 `src/integrity/integrity-checker.spec-conformance.test.ts` — gap, fork, tamper.
- [x] 11.4 `src/conflict/conflict-resolver.spec-conformance.test.ts` — longest, tiebreak.
- [x] 11.5 `src/compaction/log-compaction.spec-conformance.test.ts` — checkpoint, snapshot.
- [x] 11.6 `src/retriever/log-retriever.spec-conformance.test.ts` — range, pagination.
- [x] 11.7 `src/error-codes.spec-conformance.test.ts` — frozen registry.

## 12. Verify

- [x] 12.1 `bunx turbo lint typecheck test --filter=@suaveplan/network-plugin-audit-mesh` green.
- [x] 12.2 `bunx turbo test:coverage --filter=@suaveplan/network-plugin-audit-mesh` 100/100/100/100.
- [x] 12.3 `bun scripts/openspec-conformance.ts @suaveplan/network-plugin-audit-mesh` PASS.

## Audit (2026-05-05)

Shipped at 100/100/100/100 statement/branch/function/line coverage across 9 spec-conformance test files (85 tests). Documentation coverage: 11/11 files (100%). OpenSpec conformance: PASS. All eight `NETWORK_AUDIT_CODES` are wired — five are thrown (`REPLICATION_FAILED`, `CHECKPOINT_INVALID`, `CONFLICT_UNRESOLVED`, `INVALID_SEQ`, `RANGE_INVALID`) and three are report-only (`LOG_GAP`, `CHAIN_TAMPERED`, `SIGNATURE_INVALID`) carried on `CorruptionReport.code` via the `CORRUPTION_KIND_TO_CODE` map exported from `integrity-checker.ts`. Subsystems wired: `SignedLog`, `LogReplicator`, `LogRetriever`, `IntegrityChecker`, `ConflictResolver`, `LogCompaction`, plus the `AuditMeshPlugin` facade.