suaveplan/openspec/archive/2026-05-05-network-plugin-audit-mesh/tasks.md

Tasks — network-plugin-audit-mesh

Blocked on: network-core, network-plugin-crypto-messages.

1. Scaffold

• 1.1 packages/network/network-plugin-audit-mesh/ with package.json, tsconfig.json, vitest.config.ts, README.md.
• 1.2 Workspace deps: @suaveplan/network, @suaveplan/error, @suaveplan/types, @suaveplan/events, @suaveplan/crypto-hash, @suaveplan/timing, @opentelemetry/api, zod.
• 1.3 sideEffects: false.

2. Types

• 2.1 src/types/log.types.ts — LogEntry, LogEventType, LogCheckpoint.
• 2.2 src/types/replication.types.ts — ReplicationTarget, ReplicationMode.
• 2.3 src/types/conflict.types.ts — ConflictResolution, DivergentChain.
• 2.4 src/error-codes.ts — defineCodes("NET_AUDIT", [...]).

3. Signed log

• 3.1 src/log/signed-log.ts — SignedLog.
• 3.2 Append-only with monotonic seq.
• 3.3 Each entry: seq, timestamp, eventType, payload, prevHash, hostId, hostSignature.

4. Log replicator

• 4.1 src/replicator/log-replicator.ts — LogReplicator.
• 4.2 Replicates to R sibling hosts (default 2).
• 4.3 Tier-aware target selection.
• 4.4 Synchronous for CRITICAL, async for NORMAL.

5. Log retriever

• 5.1 src/retriever/log-retriever.ts — LogRetriever.
• 5.2 Range queries: getLogs(meshId, fromSeq, toSeq).
• 5.3 Pagination for large ranges.

6. Integrity checker

• 6.1 src/integrity/integrity-checker.ts — IntegrityChecker.
• 6.2 Verifies hash chain on retrieval.
• 6.3 Detects gaps, forks, tampered entries.
• 6.4 Emits audit:corruption-detected.

7. Conflict resolver

• 7.1 src/conflict/conflict-resolver.ts — ConflictResolver.
• 7.2 Longest chain wins.
• 7.3 Equal length: lexicographically smallest last-hash wins.

8. Log compaction

• 8.1 src/compaction/log-compaction.ts — LogCompaction.
• 8.2 Periodic checkpoint creation.
• 8.3 Checkpoint = signed state snapshot at sequence number.

9. Plugin wrapper

• 9.1 src/plugin/audit-mesh-plugin.ts — AuditMeshPlugin implements NetworkPlugin.

10. Spec

• 10.1 Update openspec/specs/network/spec.md with NET-AUDIT requirements.

11. Conformance tests

• 11.1 src/log/signed-log.spec-conformance.test.ts — append, chain, signature.
• 11.2 src/replicator/log-replicator.spec-conformance.test.ts — R-copy, target selection.
• 11.3 src/integrity/integrity-checker.spec-conformance.test.ts — gap, fork, tamper.
• 11.4 src/conflict/conflict-resolver.spec-conformance.test.ts — longest, tiebreak.
• 11.5 src/compaction/log-compaction.spec-conformance.test.ts — checkpoint, snapshot.
• 11.6 src/retriever/log-retriever.spec-conformance.test.ts — range, pagination.
• 11.7 src/error-codes.spec-conformance.test.ts — frozen registry.

12. Verify

• 12.1 bunx turbo lint typecheck test --filter=@suaveplan/network-plugin-audit-mesh green.
• 12.2 bunx turbo test:coverage --filter=@suaveplan/network-plugin-audit-mesh 100/100/100/100.
• 12.3 bun scripts/openspec-conformance.ts @suaveplan/network-plugin-audit-mesh PASS.

Audit (2026-05-05)

Shipped at 100/100/100/100 statement/branch/function/line coverage across 9 spec-conformance test files (85 tests). Documentation coverage: 11/11 files (100%). OpenSpec conformance: PASS. All eight NETWORK_AUDIT_CODES are wired — five are thrown (REPLICATION_FAILED, CHECKPOINT_INVALID, CONFLICT_UNRESOLVED, INVALID_SEQ, RANGE_INVALID) and three are report-only (LOG_GAP, CHAIN_TAMPERED, SIGNATURE_INVALID) carried on CorruptionReport.code via the CORRUPTION_KIND_TO_CODE map exported from integrity-checker.ts. Subsystems wired: SignedLog, LogReplicator, LogRetriever, IntegrityChecker, ConflictResolver, LogCompaction, plus the AuditMeshPlugin facade.