Struct EventLog 

pub struct EventLog { /* private fields */ }

Handle to the append-only event log.

Implementations

impl EventLog

pub fn open(path: impl AsRef<Path>) -> Result<Self, LogError>

Open (creating if needed) a log at path.

pub fn open_in_memory() -> Result<Self, LogError>

Open an ephemeral in-memory log (used in tests).

pub fn enqueue_pending( &self, cmd: &ProposedCommand, class: Class, reason: &str, ) -> Result<(), LogError>

Add a held command to the approval queue (idempotent on its id).

pub fn pending_status(&self, id: &str) -> Result<Option<String>, LogError>

The current status of a queued command, if it is in the queue.

pub fn set_pending_status(&self, id: &str, status: &str) -> Result<(), LogError>

Set a queued command’s status (approved | denied).

pub fn cas_pending_status( &self, id: &str, from: &str, to: &str, ) -> Result<bool, LogError>

Atomically move a queued command from status from to to. Returns true iff this call performed the transition (the row existed and was from).

This is the exactly-once guard: a held command must resolve/run once even if two kintsugi approve/kintsugi run invocations race — only the winner of the compare-and-swap proceeds; the loser sees false and does nothing.

pub fn pending_command( &self, id: &str, ) -> Result<Option<ProposedCommand>, LogError>

The stored command for a queued id (for resolve/re-run).

pub fn list_pending(&self) -> Result<Vec<PendingItem>, LogError>

List the still-pending queued commands, oldest first.

pub fn record_snapshot(&self, manifest: &Manifest) -> Result<(), LogError>

Record a snapshot taken before a destructive command.

pub fn unreverted_snapshots(&self) -> Result<Vec<Manifest>, LogError>

Load all snapshots not yet reverted, newest first.

pub fn latest_unreverted_snapshot(&self) -> Result<Option<Manifest>, LogError>

The most recent not-yet-reverted snapshot, if any.

pub fn mark_reverted(&self, id: &str) -> Result<(), LogError>

Mark a snapshot as reverted (it has been undone).

pub fn remember( &self, repo: &str, command_hash: &str, action: Decision, ) -> Result<(), LogError>

Remember a per-repo decision for an exact command (always-allow / -deny).

Only Allow and Deny are meaningful; Hold is rejected.

pub fn memory_lookup( &self, repo: &str, command_hash: &str, ) -> Result<Option<Decision>, LogError>

Look up a remembered decision for an exact command in a repo.

pub fn log_event( &self, cmd: &ProposedCommand, verdict: &Verdict, snapshot_id: Option<&str>, ) -> Result<LoggedEvent, LogError>

Append one event built from a proposal and its verdict.

pub fn tail(&self, n: usize) -> Result<Vec<LoggedEvent>, LogError>

Return the most recent n non-redacted events, oldest first.

pub fn query(&self, filter: &Filter) -> Result<Vec<LoggedEvent>, LogError>

Return events matching filter, oldest first (capped by filter.limit, skipping filter.offset of the newest matches first for pagination).

pub fn count_matching(&self, filter: &Filter) -> Result<i64, LogError>

Count events matching filter (ignores limit).

pub fn redact(&self, event_id: &str, reason: &str) -> Result<bool, LogError>

Redact a single event by id (append-only; idempotent). Returns whether a matching, not-already-redacted event existed.

pub fn redact_matching( &self, filter: &Filter, reason: &str, ) -> Result<usize, LogError>

Redact every event matching filter (newest-first, no limit applied). Returns the number newly redacted.

pub fn purge_matching( &self, filter: &Filter, reason: &str, ) -> Result<usize, LogError>

Hard erasure — physically delete events matching filter, rebuild the hash chain over the survivors, and append a marker event recording the purge. Deliberately rewrites history for the purged span; never automatic. Returns the number of events removed.

include_redacted/limit on the filter are ignored: purge always targets every matching row. Catastrophic-or-not is irrelevant — this is the user’s explicit erasure of their own local data.

pub fn count(&self) -> Result<i64, LogError>

Total number of events.

pub fn verify_chain(&self) -> Result<ChainStatus, LogError>

Walk the chain from genesis and confirm every link.

Recomputes each row’s hash from its stored fields and verifies it both matches the stored hash and links to the previous row’s hash.