审计日志哈希链「一条都没改过」却报 11 条断链：prev 写的是哈希，校验方却拿序号去比

CHAIN_PREV_MODE=chain_digest     # 一条记录的 prev = 上一条记录的**哈希**
CHAIN_GENESIS_PREV=GENESIS       # 首条记录的 prev
CHAIN_ALGO=sha256
CHAIN_SEAL_EVERY_LEDGER=1

$ bash ops/repro.sh
== 1. 跑一轮审计（12 条事件，4 个账本，每本 3 条）==
round OK 记录=12 账本=4
verify ok=False 记录=12 断链=11
  demo.py 退出码 = 1

== 3. 写入方自述 ==
  report.json = {"ok": true, "self_consistent": true, "records_written": 12,
                 "records_failed": 0, "ledgers_written": 4}      ← 全绿

== 4. 校验方按契约逐条重算 ==
    断链：账本=ledger-000.ndjson seq=1 实测 prev=27142258baeb68a3 期望 prev=0
    断链：账本=ledger-000.ndjson seq=2 实测 prev=... 期望 prev=1
    断链：账本=ledger-001.ndjson seq=3 实测 prev=... 期望 prev=GENESIS
    …（共 11 条）

== 5. 健康检查 ==
{"degraded": false, "issues": [], "self_consistent": true, "records_written": 12}
  health 退出码 = 0                    ← 判据表为空 + 恒 0

== 6. 外部独立探针（只读契约 + 账本 + 封存）==
账本记录合计 = 12（契约应得 12）
断链 / 不一致 = 0
RESULT: OK                             ← 账本其实是完好的

cd scenario/2026-10-06-0000

# 方式 A：本机直接跑
bash ops/repro.sh      # 一键复现：跑链路 → 自述 → 校验 → 健康检查 → 外部探针
bash ops/verify.sh     # 验收：问题态 PASS=6 FAIL=2 / RESULT: BAD

# 方式 B：docker 一键（服务名是 auditd，不是 app）
docker compose up -d --build
docker compose exec -T auditd bash ops/repro.sh
docker compose exec -T auditd bash ops/verify.sh

== C. 校验方不得把完好的账本判成篡改 ==
  [FAIL] 校验结论 ok(True=账本完好) (期望=True 实际=False)
  [FAIL] 校验方报出的断链数(0=没有误报) (期望=0 实际=11)
== F. 真实篡改必须被抓到（写坏一条记录的 prev） ==
  [PASS] 真实篡改会被校验方抓到 (断链=11)
PASS=6 FAIL=2
RESULT: BAD

python3 -c "
import sys; sys.path.insert(0,'.')
from app import chain, contract, ledger
policy=contract.load_chain_policy()
recs=ledger.read_ledger('ledger/ledger-000.ndjson')
print('seq=1 真实 prev      =', recs[1]['prev'])
print('上一条(seq=0)的哈希  =', chain.prev_reference(recs[0], policy))
print('校验方当前期望值     =', str(recs[0]['seq']))
"

seq=1 真实 prev      = 27142258baeb68a3
上一条(seq=0)的哈希  = 27142258baeb68a3     ← 完全一致，账本没被改
校验方当前期望值     = 0                     ← 拿的是「序号」

for index, record in enumerate(records):
    if index == 0:
        expected = policy["genesis_prev"]
    else:
        expected = str(records[index - 1].get("seq"))   # ← 拿「上一条的序号」

prev = chain.prev_reference(self.current[-1] if self.current else self._carry(), self.policy)

seq=3 的真实 prev  = c9ec60e8444fe354
上一本最后一条哈希 = c9ec60e8444fe354     ← 链跨账本延续
校验方期望值       = GENESIS              ← 校验方把每本当成独立链头

def main(argv=None) -> int:
    ...
    issues = []                      # ← 判据表压根不存在
    print(json.dumps({"degraded": False, "issues": issues, ...}))
    return EXIT_OK                   # ← 恒定 0

def verify_ledger(path, name, policy, carry=None):
    """carry = 上一个账本的最后一条记录；链是跨账本延续的。"""
    result = VerifyResult(policy)
    records = ledger.read_ledger(path)
    result.records = len(records)
    result.by_ledger[name] = len(records)
    prev = carry                                   # ← 上一本的尾巴带进来
    for index, record in enumerate(records):
        expected = chain.prev_reference(prev, policy)   # ← 唯一来源，不许另算
        got = record.get("prev")
        if got != expected:
            result.chain_broken.append({
                "ledger": name, "seq": record.get("seq"), "index": index,
                "prev": got, "expected_prev": expected,   # ← 可外部独立复核的证据
            })
        prev = record
    result.last = prev
    return result

def verify_all(ledger_dir, prefix, count):
    ...
    carry = None
    for i in range(count):
        result = verify_ledger(..., carry)
        total.chain_broken.extend(result.chain_broken)
        carry = result.last                        # ← 交给下一个账本续链
    return total

# 判据表：字段 → 期望值，None = 只要求字段存在。空表等于关掉整个健康检查。
BAD_FIELDS = (
    ("ok", True),
    ("records", None),
)

if not os.path.exists(verify_path):  return EXIT_BAD      # 拿不到数据 → 2（fail-closed）
except (OSError, ValueError):        return EXIT_BAD
except contract.ContractError:       return EXIT_CONTRACT # 契约不可用 → 3
...
return EXIT_BAD if degraded else EXIT_OK                  # 不再无条件 0

docker compose exec -T auditd bash ops/verify.sh

[PASS] 契约口径下断链的记录数(0=账本完好) (期望=0 实际=0)
[PASS] 账本记录合计 (期望=12 实际=12)
[PASS] 校验结论 ok(True=账本完好) (期望=True 实际=True)
[PASS] 校验方报出的断链数(0=没有误报) (期望=0 实际=0)
[PASS] 账本完好时 health 仍应放行(0=放行) (期望=0 实际=0)
[PASS] 完好账本下 health 退出码(0=正常) (期望=0 实际=0)
[PASS] 真实篡改会被校验方抓到 (断链=2)
[PASS] 外部探针判定 (期望=OK 实际=OK)
PASS=8 FAIL=0
RESULT: OK

docker compose exec -T auditd python3 - <<'PY'
import sys,os; sys.path.insert(0,'.')
from app import chain, contract, ledger
policy=contract.load_chain_policy(); conf=contract.load_auditd()
prev=None; bad=0
for i in range(conf['ledger_count']):
    for r in ledger.read_ledger(os.path.join(os.environ['LEDGER_DIR'],
                                  '%s-%03d.ndjson'%(conf['ledger_prefix'],i))):
        if r['prev']!=chain.prev_reference(prev,policy): bad+=1
        prev=r
print('独立重算（带 carry）断链 =',bad)
PY
# → 独立重算（带 carry）断链 = 0

docker compose exec -T auditd bash ops/negative.sh

{"degraded": true, "issues": [
  "判据字段 ok 期望 True 实际 False",
  "哈希链校验不通过：断链 2 条",
  "断链：账本=ledger-001.ndjson seq=4 prev=TAMPERED00000000 期望=d556f740c8a5d66a",
  "断链：账本=ledger-001.ndjson seq=5 prev=528bb2a7ec927371 期望=16bc71b17814b2d5"],
 "self_consistent": false, "records": 12}
  exit=2

cd scenario/2026-10-06-0000
docker compose up -d --build

# ① 看问题态
docker compose exec -T auditd bash ops/apply_fix.sh --restore
docker compose exec -T auditd bash ops/verify.sh    # PASS=6 FAIL=2 / RESULT: BAD
docker compose exec -T auditd bash ops/repro.sh     # 11 条断链 + health 退出码 0

# ② 按第四节改 app/verifier.py 与 app/health.py，清缓存再验
docker compose exec -T auditd bash -c "rm -rf app/__pycache__ && bash ops/verify.sh"
# → PASS=8 FAIL=0 / RESULT: OK

# ③ 负向验证（跑完记得把自研版本写回 app/）
docker compose exec -T auditd bash ops/negative.sh

docker compose down