Module chain 

Local exochain manager for kernel event logging.

Provides an append-only event chain with SHAKE-256 hash linking (via weftos_rvf_crypto). Each event references the hash of the previous event and a content hash of its payload, forming an immutable, tamper-evident audit trail suitable for cross-service and cross-node verification.

Hash scheme

Every event carries three hashes:

• prev_hash — SHAKE-256 of the preceding event (chain link)
• payload_hash — SHAKE-256 of the canonical JSON payload bytes (content commitment; zeroed when payload is None)
• hash — SHAKE-256 of (sequence ‖ chain_id ‖ prev_hash ‖ source ‖ 0x00 ‖ kind ‖ 0x00 ‖ timestamp ‖ payload_hash)

Together these enable two-way verification: given an event you can verify the chain link backward and the payload content independently.

K0 Scope

Local chain only: genesis, append, checkpoint.

K1+ Scope (not implemented)

Global root chain, BridgeEvent anchoring, ruvector-raft consensus.

Structs

AnchorReceipt

Receipt returned by a successful ChainAnchor::anchor call.

ChainCheckpoint

A checkpoint snapshot of the chain state.

ChainEvent

A chain event – one entry in the append-only log.

ChainManager

Thread-safe chain manager.

ChainStatus

Chain status summary.

ChainVerifyResult

Result of chain integrity verification.

CustodyAttestation

A single signed proof of system state.

DualSignature

A dual signature (Ed25519 + optional ML-DSA-65).

DualSigningConfig

Configuration for dual Ed25519 + ML-DSA-65 signing.

GovernanceDecisionEvent

A governance decision event suitable for chain logging.

IpcDeadLetterEvent

An IPC dead-letter event suitable for chain logging.

MockAnchor

A mock anchor that always succeeds (for testing).

RestartEvent

A restart event suitable for chain logging.

Enums

AppendSignedError

Errors from ChainManager::append_signed (WEFT-105 / K6.4 replay).

Constants

EVENT_KIND_AGENT_HIERARCHY_ADD

Agent hierarchy: child added.

EVENT_KIND_AGENT_HIERARCHY_REMOVE

Agent hierarchy: child removed.

EVENT_KIND_API_CONTRACT_REGISTERED

API contract registration event (k2:D8).

EVENT_KIND_APP_INSTALL

Application installed event.

EVENT_KIND_APP_REMOVE

Application removed event.

EVENT_KIND_APP_START

Application started event.

EVENT_KIND_APP_STOP

Application stopped event.

EVENT_KIND_APP_TRANSITION

Application state transition event.

EVENT_KIND_ARTIFACT_EVICT

An artifact was evicted from the node’s cache (reason = lru | revoked | manual).

EVENT_KIND_ARTIFACT_FETCH

A completed or failed artifact fetch (result = verified | failed).

EVENT_KIND_ARTIFACT_PEER_BAN

A peer was banned for serving corrupt pieces.

EVENT_KIND_ARTIFACT_PIECE_REJECTED

A piece whose hash did not match, and the peer that sent it.

EVENT_KIND_ARTIFACT_REMOVE

Artifact removed event.

EVENT_KIND_ARTIFACT_REVOKE

A revocation was applied to what the node holds and seeds.

EVENT_KIND_ARTIFACT_SEED

A node began seeding a verified artifact (once per artifact).

EVENT_KIND_ARTIFACT_SERVE

First time an artifact is served to a given peer.

EVENT_KIND_ARTIFACT_STORE

Artifact stored event.

EVENT_KIND_AUTH_ATTEMPT

Auth authentication attempt event.

EVENT_KIND_AUTH_CREDENTIAL_REGISTER

Auth credential registration event.

EVENT_KIND_AUTH_CREDENTIAL_ROTATE

Auth credential rotation event.

EVENT_KIND_AUTH_TOKEN_ISSUE

Auth token issuance event.

EVENT_KIND_AUTH_TOKEN_REVOKE

Auth token revocation event.

EVENT_KIND_BVH_DERIVE

BVH branch derived (COW / clone).

EVENT_KIND_BVH_INSERT

BVH leaf inserted (ADR-056 / WEFT-718).

EVENT_KIND_BVH_REBALANCE_SEAL

BVH rebalance / determinism-phase seal.

EVENT_KIND_BVH_REMOVE

BVH leaf removed.

EVENT_KIND_CAPABILITY_ELEVATE

Capability elevation requested event.

EVENT_KIND_CAPABILITY_REVOKED

Capability revocation event (k3:D8 — informational revocation).

EVENT_KIND_CAUSAL_CLEAR

Causal graph cleared event.

EVENT_KIND_CAUSAL_EDGE_ADD

Causal graph edge added event.

EVENT_KIND_CAUSAL_EDGE_REMOVE

Causal graph edge removed event.

EVENT_KIND_CAUSAL_NODE_ADD

Causal graph node added event.

EVENT_KIND_CAUSAL_NODE_REMOVE

Causal graph node removed event.

EVENT_KIND_CAUSAL_NODE_STATE

Causal graph node lifecycle-state transition event (ADR-067 P1-graph / WEFT-629).

EVENT_KIND_CLUSTER_PEER_ADD

Cluster peer added event.

EVENT_KIND_CLUSTER_PEER_REMOVE

Cluster peer removed event.

EVENT_KIND_CLUSTER_PEER_STATE

Cluster peer state changed event.

EVENT_KIND_CONFIG_DELETE

Configuration delete event.

EVENT_KIND_CONFIG_SECRET_SET

Secret set event.

EVENT_KIND_CONFIG_SET

Configuration set event.

EVENT_KIND_CONTAINER_CONFIGURE

Container configured (registered) event.

EVENT_KIND_CONTAINER_START

Container started event.

EVENT_KIND_CONTAINER_STOP

Container stopped event.

EVENT_KIND_CRON_ADD

Cron job added event.

EVENT_KIND_CRON_EXECUTE

Cron job executed (fired) event.

EVENT_KIND_CRON_REMOVE

Cron job removed event.

EVENT_KIND_EML_DRIFT

EML model drift detected event.

EVENT_KIND_EML_LOADED

EML model loaded event.

EVENT_KIND_EML_SAVED

EML model saved event.

EVENT_KIND_EML_TRAINED

EML model trained event.

EVENT_KIND_ENV_REGISTER

Environment registered event.

EVENT_KIND_ENV_REMOVE

Environment removed event.

EVENT_KIND_ENV_SWITCH

Environment switched (set active) event.

EVENT_KIND_GATE_DEFER

TileZero gate deferred an action for review (WEFT-152).

EVENT_KIND_GATE_DENY

TileZero gate denied an action (WEFT-152).

EVENT_KIND_GATE_PERMIT

TileZero gate permitted an action (WEFT-152).

EVENT_KIND_GRAPHIFY_BUILD

Graphify knowledge graph built.

EVENT_KIND_GRAPHIFY_HOOK

Graphify git hook installed or uninstalled.

EVENT_KIND_GRAPHIFY_INGEST

Graphify URL ingested.

EVENT_KIND_GRAPHIFY_PIPELINE

Graphify pipeline executed.

EVENT_KIND_GRAPHIFY_QUERY_RESULT

Graphify Q&A query result saved for re-extraction (WEFT-153).

EVENT_KIND_HNSW_CLEAR

HNSW store cleared event (governance gated – bulk destruction).

EVENT_KIND_HNSW_EML_OBSERVE

HNSW EML search observation event.

EVENT_KIND_HNSW_EML_RECALL

HNSW EML recall measurement event.

EVENT_KIND_HNSW_EML_TRAINED

HNSW EML model trained event.

EVENT_KIND_HNSW_EML_TRIAGE

HNSW EML triage decision event.

EVENT_KIND_HNSW_INSERT

HNSW vector inserted event.

EVENT_KIND_HNSW_LOAD

HNSW store loaded from file event.

EVENT_KIND_HNSW_SAVE

HNSW store saved to file event.

EVENT_KIND_KERNEL_LOAD

Kernel state loaded from disk.

EVENT_KIND_KERNEL_SAVE

Kernel state saved to disk.

EVENT_KIND_LEWM_FRAME_ATTESTATION

LeWM per-frame observational tuple attestation (WEFT-533).

EVENT_KIND_MESH_ARTIFACT_FETCH

Mesh artifact fetch request created.

EVENT_KIND_MESH_ARTIFACT_STORE

Mesh artifact remote provider registered.

EVENT_KIND_MESH_IPC_SEND

Mesh IPC envelope sent.

EVENT_KIND_MESH_PEER_ADD

Mesh peer added (via announcement / catalog update).

EVENT_KIND_MESH_PEER_REMOVE

Mesh peer removed.

EVENT_KIND_MESH_SENSOR_FRAME

LeWM mesh sensor topic frame index (WEFT-526).

EVENT_KIND_MESH_SERVICE_DEREGISTER

Mesh service resolution removed / negative-cached.

EVENT_KIND_MESH_SERVICE_REGISTER

Mesh service resolution cached.

EVENT_KIND_NODE_FACTS_REFRESH

An operator-forced node-facts probe ran (cluster.facts with refresh). Payload: node, seq.

EVENT_KIND_PROCESS_DEREGISTER

Process deregistered (removed) from the process table.

EVENT_KIND_PROCESS_REGISTER

Process registered in the process table.

EVENT_KIND_PROCESS_STATE

Process state changed.

EVENT_KIND_PROFILE_CREATE

Profile created event.

EVENT_KIND_PROFILE_DELETE

Profile deleted event.

EVENT_KIND_PROFILE_SWITCH

Active profile switched event.

EVENT_KIND_PROFILE_VECTOR_INSERT

Vector inserted into a profile backend.

EVENT_KIND_PROJECT_INIT

Project initialised.

EVENT_KIND_RECONCILER_ACTION

Reconciler corrective action recorded.

EVENT_KIND_RECONCILER_DESIRED_REMOVE

Reconciler desired state removed.

EVENT_KIND_RECONCILER_DESIRED_SET

Reconciler desired state set.

EVENT_KIND_RECONCILER_TICK

Reconciler tick completed.

EVENT_KIND_SANDBOX_EXECUTE

Sandbox command execution event.

EVENT_KIND_SANDBOX_SUDO_OVERRIDE

Sandbox sudo override event (k3:D12).

EVENT_KIND_SESSION_APPEND

Session created event.

EVENT_KIND_SESSION_CREATE

EVENT_KIND_SESSION_DESTROY

Session destroyed event.

EVENT_KIND_SHELL_EXEC

Shell command execution event (k3:D10).

EVENT_KIND_SIGREG_HEALTH

LeWM SIGReg health snapshot / rollback gate (WEFT-528).

EVENT_KIND_TOOL_DEPLOYED

Tool version deployment event.

EVENT_KIND_TOOL_REGISTER

Tool registered in the registry.

EVENT_KIND_TOOL_REGISTER_METADATA

Tool registered with explicit metadata (WEFT-153).

EVENT_KIND_TOOL_SIGNED

Tool signed event (k3:D9).

EVENT_KIND_TOOL_VERSION_REVOKED

Tool version revocation event.

EVENT_KIND_WASM_EXECUTE

WASM module executed.

EVENT_KIND_WASM_FS_COPY

WASM filesystem: file copied.

EVENT_KIND_WASM_FS_CREATE_DIR

WASM filesystem: directory created.

EVENT_KIND_WASM_FS_MOVE

WASM filesystem: file moved.

EVENT_KIND_WASM_FS_REMOVE

WASM filesystem: file or directory removed.

EVENT_KIND_WASM_FS_WRITE

WASM filesystem: file written.

EVENT_KIND_WORKLOAD_INSTALL

Workload package install decision / event.

EVENT_KIND_WORKLOAD_LIFECYCLE

An instance changed lifecycle state (health, restart, loss, reschedule).

EVENT_KIND_WORKLOAD_LOAD

Workload load decision / event.

EVENT_KIND_WORKLOAD_MIGRATE

Workload migration decision / event.

EVENT_KIND_WORKLOAD_NODE_BIND

Fleet identity bound to a mesh node.

EVENT_KIND_WORKLOAD_NODE_UNBIND

Fleet identity binding withdrawn (operator-signed unbound record).

EVENT_KIND_WORKLOAD_PLACE

Workload placement decision / event.

EVENT_KIND_WORKLOAD_REFUSE

Workload refusal (node admission refusal or unknown workload action).

EVENT_KIND_WORKLOAD_REVOKE

Package / signer key / artifact hash revocation.

EVENT_KIND_WORKLOAD_START

Workload start decision / event.

EVENT_KIND_WORKLOAD_STOP

Workload stop decision / event.

EVENT_KIND_WORKLOAD_UNLOAD

Workload unload decision / event.

EVENT_KIND_WORKLOAD_UNREVOKE

A revocation lifted again (unrevoke), chained like the revocation.

EVENT_KIND_WORKSPACE_CONFIG

Workspace config updated event.

EVENT_KIND_WORKSPACE_CREATE

Workspace created event.

IDEMPOTENCY_LOOKBACK

Number of recent events scanned for idempotency-key collisions in ChainManager::append_idempotent.

KERNEL_SOURCES

Sources the kernel’s own code appends under and that a project kernel trusts when it reads its chain back (review M3): governance (the rollback floor reads governance.overlay.applied), project (genesis) and project.supervisor. Refused, with RESERVED_SOURCES, from the two caller doors (the chain.append RPC and chain_bridge). Not refused from replication (ChainManager::append_signed): every chain carries governance events and a peer’s must sync; a project kernel replicates nothing (its mesh is off).

PROJECT_DOMAIN_PREFIX

Domain-tag prefix of every project-key signed format (weftos-project-cert-v1, -anchor-v1, -anchor-record-v1, forward header, …). A signer that takes caller-chosen bytes under a key it does not tag (the chain’s dual_sign, the tree manager’s sign_bytes, the mesh handshake) must never sign bytes that start with it, or its signature could be replayed as one of those statements (ADR-103 A7 note).

RESERVED_KINDS

Event kinds a project kernel folds as authority regardless of the source they carry (the overlay rollback floor and user_pin_used read governance.overlay.applied). Refused from replication under any source: a forged replicated one with parent_version = u64::MAX would brick boot and reload.

RESERVED_SOURCES

Chain sources only the daemon’s own code may append under: the user chain’s identity events (user.projects), project anchors (project.anchor, on both the user and the project chain) and token issue/revoke records (auth.token, folded by TokenAuthority). Refused from the chain.append RPC and chain_bridge, and from replicated events (ChainManager::append_signed): a forged one would feed the identity view, fake an anchor or mint/revoke a bearer token. This is the ONE list: every authority-owned source a kernel component folds belongs here (the literals are pinned to the owning modules’ constants by a test).

Traits

ChainAnchor

Trait for anchoring chain state to an external ledger or store.

ChainLoggable

Trait for types that can be logged to the ExoChain audit trail.

Functions

is_caller_reserved_source

May a caller (an RPC or a tracing emitter) NOT append under source?

is_reserved_kind

Is kind an authority-folded kind that replication must never carry?

is_reserved_source

Is source reserved for the daemon’s own events?

signs_project_domain

True when an untagged signer would be signing a project-domain-tagged message. Callers refuse (return None/Err) in release builds too.

Type Aliases

RuleHashProvider

Supplies the rule hash stamped on each append (ADR-103 A7).