security(core/R-15): Gate 3 — durable protected-record adapter and crash-durability proof

[qnbs]

TERMINAL CLOSURE — 2026-10-02

• GATE_3 = TERMINAL
• CLOSURE_PR = feat(core): close R-15 Gate 3 with its evidence matrix and residual owners (#445) #949
• FINAL_HEAD = d813427
• RESULTING_MAIN = 4f119e2
• CI/CD 36981985445 = SUCCESS
• CodeQL 36981985385 = SUCCESS
• Vercel Production dpl_2r1QiNXDpGw1YdG52eUbuRc3p6fx = READY exact SHA
• Desktop atomic writes: fsync temp file + parent directory before/after rename for true crash durability #357 = CLOSED
• R15_GATE3 = IMPLEMENTED_HEADLESS
• PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Gate 3's defined headless durability evidence is complete for ordinary protected records. Residual ownership is explicit: Gate 4 owns serialization/admission/journal/rekey and the key-epoch crash window; Gate 5 owns asset-pair commit semantics; Gate 6 owns packaged physical power-loss proof; #948 owns protected deletion before Gate 7; the legacy TS/Tauri authority is replaced only at Gate 7.

HISTORICAL / SUPERSEDED — CURRENT EXECUTION — 2026-10-01 23:12 CEST — 3C PART 2 ACTIVE — superseded by terminal closure 2026-10-02

GATE_3 = ACTIVE
SLICE_3A = TERMINAL via #930
SLICE_3B_PART_1 = TERMINAL via #937
SLICE_3B_PART_2 = TERMINAL via #940
SLICE_3C_PART_1 = TERMINAL via #941 → main 03a24786f1c9fda76656dbbd2a635e324331ec81
CURRENT_MAIN = 03a24786f1c9fda76656dbbd2a635e324331ec81
RESULTING_MAIN_VERIFICATION = TERMINAL
CI / CODEQL / SECURITY / SIGNATURES = SUCCESS
VERCEL_PRODUCTION = READY on exact CURRENT_MAIN

SLICE_3C_PART_2 = PR #942 ACTIVE
PR_942_HEAD = 48525c99ed20c88774df161b8d8c0d474a785302
PR_942_MERGE_READY = NO
SLICE_3C_PART_3 = NEXT — two-phase root/anchor commit + write integration + list_records + retention
THEN = terminal Gate 3 + #357/QNB-10 reconciliation
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

#941 is terminal and production-proven. #942 is now the sole active Gate 3 engineering owner. Current exact-head review/CI is not terminal. Codex returned four P2s on 48525c99...: reversible identity recovery for hashed bindings, non-ordinary-class rejection, shard-bound enforcement in catalog_set_digest, and redacted catalog Debug. CodeRabbit independently confirms the non-ordinary-class issue as Major. CodeAnt adds the same class-admission concern plus decoded binding/template/project-scope validation and a shard-bound API nitpick. CodeScene has argument-count health findings; DeepSource has one minor range-style finding. Node 22/24 and Cubic are still running; Sourcery is quota-limited. Validate the full epoch first and converge in one correction wave where practical.

The Gate 3 closure must still cover the asset-pair marker/catalog boundary identified during #941 before claiming complete committed authority.

HISTORICAL / SUPERSEDED — CURRENT EXECUTION — 2026-10-01 — 3B TERMINAL / 3C PART 1 ACTIVE — superseded 2026-10-01 23:12 CEST

GATE_3 = ACTIVE
SLICE_3A = TERMINAL via #930 → main 01230de4758208f7b682ef9548720b0fd39ce801
SLICE_3B_PART_1 = TERMINAL via #937 → main 90ae5c4c44596b423a502dc4ce2d2213886092ca
SLICE_3B_PART_2 = TERMINAL via #940 → main e43559b9bd6c5a8b6f5ba06ed9a2da42079551e1
CURRENT_MAIN = e43559b9bd6c5a8b6f5ba06ed9a2da42079551e1
RESULTING_MAIN_VERIFICATION = TERMINAL
CI / CODEQL / SECURITY / SIGNATURES = SUCCESS
VERCEL_PRODUCTION = READY on exact CURRENT_MAIN

SLICE_3C_PART_1 = PR #941 ACTIVE
PR_941_HEAD = 7a1edcf1527947e7b75cc8e8c6fbe6e1ea11a701
PR_941_MERGE_READY = NO
SLICE_3C_PART_2 = NEXT — catalog descriptors/pages + shard assignment
SLICE_3C_PART_3 = THEN — two-phase root/anchor commit + write integration + list_records + retention
THEN = Gate 3 closure + #357/QNB-10 reconciliation
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

#940's resulting main is fully green and production-proven; Gate 3B is no longer active work.

#941 is the current Gate 3 owner. Its latest head already incorporates the bootstrap journal_revision = 0 fix, shared tagged-binding implementation and root-field coverage fixes. At the latest readback, Node 22/24 are still running and the current review epoch still has a Codex P2 requiring asset-pair entries to be representable in marker_set_digest, plus a Cubic P3 to align RootError::InvalidCounter documentation with the valid bootstrap sentinel. Do not merge until this exact-head remainder is resolved/dispositioned and the resulting head converges.

After #941 terminal proof, continue directly to 3C parts 2 and 3 without a chat handoff.

HISTORICAL / SUPERSEDED — pre-3B checkpoint — 2026-10-01

GATE_3 = ACTIVE
SLICE_3A = TERMINAL via #930
3A_RESULTING_MAIN = 01230de4758208f7b682ef9548720b0fd39ce801
#933/#934 = TERMINAL
#935/#936 = MERGED
CURRENT_MAIN = cd12c1041fc5e6e7197484bd81c88597f6974fa6
RESULTING_MAIN_VERIFICATION = IN PROGRESS
CODEQL / SECURITY / SIGNATURES = SUCCESS
VERCEL_PRODUCTION = READY on exact CURRENT_MAIN
NODE_22 / NODE_24 = RUNNING at latest readback
NEXT_SLICE = 3B commit markers + startup reconciliation
THEN = 3C authority-root/catalog commit + Gate 3 closure/#357 reconciliation
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

#936 has merged and #935 is closed. Do not keep the support lane active or reopen it without new material evidence.

Finish resulting-main proof on cd12c104..., then proceed directly to 3B. Claude is already continuing the Gate 3 lane; no chat handoff or additional governance detour is required.

---

Program position

Child owner of #445 for R-15 Gate 3.

TARGET_RELEASE = v1.30.0
PREDECESSOR = Gate 2 terminal
PRIMARY_LEGACY_OWNER = #357
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Objective

Implement the first renderer-neutral durable protected-record adapter with real crash-durability semantics, not merely atomic rename.

Binding sequence: encrypted staging generation → file content sync → atomic replacement/promotion → parent-directory metadata durability where required → generation reconciliation → only then durable success.

Required scope

• choose one representative protected record class;
• implement Core/native durable read/write around the admitted R-15 envelope + KeyProvider;
• file and directory sync semantics by platform;
• generation and commit-marker reconciliation;
• orphan staging recovery/cleanup;
• exact failure classification, never torn authoritative state;
• deterministic fault injection around each meaningful durability boundary;
• prove plaintext staging is not left behind beyond admitted mechanisms.

#357 reconciliation

#357 is no longer a separate Tauri-only destination. Its crash-durability requirement must be satisfied by this renderer-neutral/native Core path wherever practical. Close #357 only with concrete R-15 evidence or retain a bounded legacy residual that must disappear before Gate 7.

Acceptance

• representative protected record survives the crash/fault matrix;
• sync and directory-durability semantics explicit;
• rollback/substitution cannot masquerade as latest committed state;
• no authority switch;
• exact-head/resulting-main proof complete;
• packaged evidence that cannot be proven in source CI is explicitly carried to Gate 6, never silently called PASS.

Non-goals

• full all-class migration;
• journal/rekey state machine;
• production cutover;
• unrelated filesystem refactors.

[qnbs]

Linear control-plane mirror

• Linear: QNB-167
• Project: v1.30.0 — Complete Desktop At-Rest Encryption
• Project URL: https://linear.app/qnbs/project/v1300-complete-desktop-at-rest-encryption-1ea741fa2ae5

GitHub remains the implementation/evidence source of truth; Linear tracks sequencing, priority, dependencies and milestone progress.

[qnbs]

Admission 2026-10-01 (agent-executed, after Gate 2 TERMINAL at main 91582bbd)

Contract §20 item 3 defines Gate 3 as "file sync, atomic replacement, directory sync, generation reconciliation, and fault-injection tests for one record class". §9 spans much more than that: commit-intent markers (§5.4), staging under the final AAD, file and directory sync, promotion, the fenced root/marker/catalog commit (§5.3.1, §5.5) and startup reconciliation. Nothing of the marker, catalog or root-commit machinery exists in the crate yet; only the Gate 1b anchor transitions do. Gate 3 is therefore cut along proof boundaries:

Slice	Scope (§9)	Proof boundary
3A — durable staging and promotion	platform durability primitive (file sync_all; directory sync where the platform provides it, otherwise reported as a capability gap, never as durable), with Core-owned ordering for steps 3–8: ciphertext-only staging under the final AAD with the <target>.tmp-<operation-id>-<generation> suffix, byte-count check, file sync, validation via open_record, promotion to an immutable generation-addressed file without touching the old generation, directory sync	deterministic fault injection at every boundary; old generation always intact; no plaintext ever written; result never claims commit
3B — commit marker and reconciliation	§5.4 marker body for the representative class (PENDING/ACTIVE generations), §9 step 11 startup reconciliation, and §9.2's fault table (adopt only the exact suffix-matched candidate; preserve unrecognized debris)	every §9.2 row has a test; rollback or substitution cannot pose as the latest generation
3C — commit boundary	steps 9–10 against the authority root/catalog, with the DURABLE_COMMIT_SUCCESS vs COMMITTED_NOT_CONFIRMED_DURABLE result model	re-admitted on the 3B result; whatever needs §11 admission or root_commit_mutex stays with Gate 4 (#922)

Representative class: settings:global. It is a single global MIGRATE_TO_R15 record with no project scope, so the proof stays about durability, not identity. #357 reconciles at the end of Gate 3. Anything that needs packaged or real-filesystem evidence beyond source CI is carried to Gate 6 (#924) explicitly, never called PASS. No authority switch. Starting Slice 3A.

[qnbs]

Slice 3A TERMINAL: PR #930 (durable staging and promotion)

squash-merged, exact-head bound to 826d25c45efcaac26e563a016792507a283faf64
RESULTING_MAIN = 01230de4758208f7b682ef9548720b0fd39ce801
GITHUB_ACTIONS_CI = SUCCESS (36851087992; Security Audit SUCCESS; Secure Store Platform Evidence
                    on ubuntu/macos/windows SUCCESS, incl. the durable-staging step on macOS and Windows)
CODEQL = SUCCESS (36851087972)
PRODUCTION = dpl_22NWZ9WarxrRNBFmiPGwcG6ZMGAC READY on 01230de4; canonical alias → it; HTTP 200
DEEPSOURCE on main = Docker/Python/Rust/Shell SUCCESS. This is the first legitimate main run since the
                    91582bbd dashboard incident, so the baseline is reconfirmed (QNB-15 open item closed).

Delivered: stage_and_promote covers §9 steps 3–8 through the generic identity-bound codec, proven on settings:global.

• Write path: ciphertext-only staging at <target>.tmp-<op>-<gen>, file sync, read-back authentication, no-replace hard-link promotion, promoted-name read-back verification, directory sync.
• Platform behaviour: Windows reports the directory entry as NotConfirmed.
• Preserve-first rules:
  • the previous generation is never touched;
  • only never-validated write/sync staging is removed;
  • validated candidates, validation failures and pre-existing staging files are kept;
  • operation IDs come from the CSPRNG only.

Evidence maturity: headless fault injection runs on Linux, macOS and Windows CI runners (CI_ONLY). Power-loss evidence remains with Gate 6.

Review convergence:

• Wave 1: 17 threads.
• Wave 2: 6 P3/code-health threads.
• Wave 3: 2 Codex threads (P1 keep a validated candidate on promotion failure; P2 CSPRNG-only operation IDs).
• Invalid: Codex's macOS F_FULLFSYNC P1, disproven from the rust-lang/rust 1.77.2 std source.
• Final head: Codex, cubic, Sourcery, CodeScene and DeepSource clean; CodeRabbit RATE_LIMITED for the last increment.

Housekeeping: branch deleted; 4 superseded previews removed (--safe); the aliased latest is retained.

Next: #933 / PR #934 (R-15 gate-status drift guard), then slice 3B (commit markers and startup reconciliation).

[qnbs]

Gate 3 progress, 2026-10-01

3B part 1 — #937 (marker codec): terminal

• Merged as 90ae5c4c.
• Resulting-main proof: CI/CD run 36895695984 success, CodeQL success, Vercel production READY on the exact SHA, HTTP 200.
• Housekeeping is done.

Side fix — #938 / #939: terminal

• A fresh OSV advisory, GHSA-c475-qrg2-pj4r on basic-ftp, blocked every PR's Security Audit. The override floor was raised to 6.2.1.
• Merged as ad89d4ff; resulting main is green.

3B part 2 — #940 (commit protocol + startup reconciliation): in review

• Head is bba20214.
• The first correction wave fixed four P1 durability/provenance findings:
  • verify the committed generation before writing;
  • adopt a candidate only through the operation's own staging provenance (§9.2);
  • sync the record directory before ACTIVE;
  • sync the marker directory before trusting the chain;
  • bind each marker to its file's generation;
  • relocate with durable link-before-unlink and a digest tag.
• Status token: R15_GATE3=SLICE_3B_COMMIT_RECONCILIATION.

Next: #940 terminal, then 3C (authority-root/catalog commit), then Gate 3 closure with #357 reconciliation.

PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.

[qnbs]

Gate 3 slice 3B: terminal (2026-10-01)

#940 (commit protocol + startup reconciliation) is merged as e43559b9.

Resulting-main proof:

• CI/CD run 36909211349: success.
• CodeQL: success.
• Vercel production: READY on the exact SHA, HTTP 200.
• Housekeeping is done.

The review history is three correction waves, and the protocol now:

• requires staging provenance for adoption (§9.2);
• syncs the record directory before ACTIVE;
• syncs the marker directory before trusting the chain;
• binds each marker to its file's generation;
• verifies before writing and before rollback;
• fails closed on unexpected marker entries;
• relocates rejected bytes durably (link before unlink).

Codex was quota-limited on the final heads; that is recorded as unavailable, not clean. All other reviewers and checks converged.

R15_GATE3=SLICE_3B_COMMIT_RECONCILIATION is now on main.

Next: 3C, the authority-root/catalog commit, then Gate 3 closure with #357 reconciliation. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.

[qnbs]

Tracked scope boundary from the #941 review: the asset-pair marker body (§8.4.1) and its marker_set_digest entry constructor are not implemented yet. Asset pairs cannot be committed until both land, and both must land before any asset-pair record is migrated (Gate 5) or the Gate 7 switch.

[qnbs]

Live Gate 3C Part 2 checkpoint — PR #942 @ 351b03ddeb28c87fbef612a136b60dae4f5c6683

PR #942 remains open and not merge-ready. Exact-head Vercel Preview dpl_HZYcYU7LtQrvX4FimRNtMskfxEZc is READY. CI/CD is still running: Node 24 is SUCCESS and Node 22 remains in progress; Core/Tauri/Security/Signatures/3-OS platform evidence are green.

New exact-head reviewer remainder after the prior correction wave:

• Codex P2: encoded catalog-page size can exceed the WSR1 64 MiB seal bound; page/paging rules must fail before authority changes.
• Codex P2: a reconciled rolled-back first write (Absent authority with retained PENDING(none->1) marker) must not be emitted as a catalog descriptor.
• Cubic P2: Debug-redaction page test currently passes through Err(WrongShard), so it does not actually exercise CatalogPage::Debug.
• Cubic P3: identity component comment must account for literal-only templates such as settings.

Independent source inspection reproduced the semantic basis of both Codex P2s. Hold merge; after Node 22 becomes terminal, batch these into one correction wave and restart exact-head verification. main remains 03a24786f1c9fda76656dbbd2a635e324331ec81. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.

[qnbs]

3C part 3 acceptance item (from the #942 review): the root commit must consume the reconciliation outcome. A first write rolled back to ABSENT (Resolution::RolledBack { restored: None }) is dropped from its catalog shard in the same root transition, because describe_record alone still reads it as PENDING(none -> 1) (version 1 has no ABSENT marker body).

[qnbs]

3C part 3c acceptance item (from the #944 review): bind active_key_epoch to the root's key route through the authenticated key-epoch set (cold-start step 5). This needs persisted key-epoch records. It must not use list_epochs, which §5.3.1 rules out as a trust input.

[qnbs]

3C part 3c-2a terminal. #946 merged into main cfefa185. Resulting main: CI/CD 36969128752 and CodeQL 36969128739 passed; Vercel Production dpl_G6xrPULv5obXCoh1VtdY3EXe8eJT is READY on the exact SHA; HTTP 200.

What landed:

• the persisted, root-verified record catalog (load_catalog, list_records, commit_catalog_change);
• a page's generation is the root generation that publishes it (contract §5.5.1);
• emptied shards keep a zero-descriptor page;
• a change that would rotate the key route or epoch is refused until Gate 5.

R15_GATE3=SLICE_3C_CATALOG_COMMIT.

Open items:

• the key-epoch record crash window, assigned to the Gate 4 journal;
• the asset-pair boundary and Desktop atomic writes: fsync temp file + parent directory before/after rename for true crash durability #357, at Gate 3 closure.

Next: 3c-2b, which wires §9 steps 2 and 9 (PENDING and ACTIVE root commits) into the write protocol, drops a rolled-back first write, verifies reads against the catalog, and adds retention.

[qnbs]

3C part 3c-2b terminal. #947 merged into main 173bc14a. Resulting main: CI/CD 36975991602 and CodeQL 36975991632 passed; Vercel Production dpl_EAiRPDHCU3Xd6KkSKGktoACp35VW is READY on the exact SHA; HTTP 200.

What landed:

• protected writes commit the root at PENDING and at ACTIVE (§9 steps 2 and 9);
• reads serve only the root-named generation;
• startup resolution verifies against the full chain, refuses unrooted chains, and drops a rolled-back first write from the catalog.

R15_GATE3=SLICE_3C_PROTECTED_WRITE.

Next: Gate 3 closure PR, with the evidence matrix and residual ownership, then the #357 reconciliation.

[qnbs]

Gate 3 terminal — 2026-10-02

#949 merged into main 4f119e20d472a571c96ef9c43f479f68e3c47115 with R15_GATE3=IMPLEMENTED_HEADLESS. Resulting main: CI/CD 36981985445 and CodeQL 36981985385 passed; Vercel Production dpl_2r1QiNXDpGw1YdG52eUbuRc3p6fx is READY on the exact SHA; HTTP 200.

Delivered:

• 3A: feat(core): add Gate 3 slice 3A durable staging and promotion (#445) #930
• 3B: feat(core): add the Gate 3 slice 3B record-commit marker codec (#445) #937, feat(core): add the Gate 3 slice 3B commit protocol and startup reconciliation (#445) #940
• 3C: feat(core): add the Gate 3 slice 3C authority-root digests (#445) #941, feat(core): add the Gate 3 slice 3C record-catalog descriptors and pages (#445) #942, feat(core): add the Gate 3 slice 3C root slot, pointer and key-epoch record encodings (#445) #943, feat(core): add the Gate 3 slice 3C two-phase root commit, crash recovery and trusted cold start (#445) #944, feat(core): persist key-epoch records and enforce the cold-start key-epoch check (#445) #945, feat(core): persist the record catalog and commit catalog changes through the root (#445) #946, feat(core): commit every protected write transition through the authority root (#445) #947
• closure: feat(core): close R-15 Gate 3 with its evidence matrix and residual owners (#445) #949

The evidence matrix covers file sync, atomic replacement, directory sync, generation reconciliation and fault injection; see contract §20 Gate 3 closure. #357 is closed with its narrow legacy residual assigned to Gate 7.

Residual owners:

• Gate 5: the asset-pair marker body and member commit, before asset-pair migration. The protected path refuses non-ordinary records now.
• Gate 4 (security(core/R-15): Gate 4 — journal, admission, rekey/recovery and cross-process serialization #922): the key-epoch crash window, root_commit_mutex, admission, reader pins and reclamation.
• Gate 6 (security(core/R-15): Gate 6 — packaged shadow/compatibility qualification on Linux, Windows and macOS #924): power loss.
• R-15: record deletion transitions (DELETE_PENDING / TOMBSTONED) in the protected write path #948: deletion transitions, before Gate 7.

PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO. Next: Gate 4 (#922).