Module store 

On-disk risk register: the append protocol, id allocation, log loading, and the derived index.json build/rebuild.

Writes mirror the evidence runner: every mutation takes the root lock (crate::evidence::lock::RootLock), reads the tail for seq + prev_sha256, validates the event, appends exactly one line with O_APPEND semantics, and refreshes that risk’s index entry. Lines are never rewritten or deleted. SHA-256 reuses crate::evidence::hasher::sha256_bytes.

Structs

AppendOutcome

Result of append: the event written and the new chain head sha.

IndexExternal

External tracker mirror as projected into the index ({system, id, url}).

OpenOutcome

Result of open: the allocated id plus the opened event written.

Register

The register, leniently loaded: events for every member risk that parses, plus (risk_id, error) for every log that could not be read or failed chain validation. The single degradation rule for register consumers — a broken log never silently disappears and never takes the other risks with it.

RiskIndex

risks/index.json — the derived register cache, same role as state.json. Regenerable from the logs with rebuild.

RiskIndexEntry

One projected risk in the index — its fold flattened for fast list/dashboard reads.

Functions

append

Append exactly one event to risk_id’s log under the root lock, then refresh its index entry.

build_index

Build the full index in memory by folding every risk log under risks/. Pure-ish: reads the logs but writes nothing. rebuild wraps this with the lock and an atomic write.

build_index_lenient

build_index, but a broken log degrades instead of failing: the index covers every readable risk and the broken ones come back as (risk_id, error) pairs the caller must surface. Read surfaces (risks list, the GUI, report assembly) use this so one corrupt log doesn’t take every register view down; rebuild stays strict — regenerating the canonical cache from a broken register must fail.

load_events

Read and parse a risk’s events.jsonl in seq order.

load_register

open

Allocate the next R-NNNN id under the root lock and write the opened event. The fingerprint is <control_id>:<finding_id> carried in finding_ref.

rebuild

Regenerate risks/index.json from all logs and write it atomically under the root lock — the state.json rebuild analogue for the register.

risk_ids

Every risk id in the register: a risks/<R-NNNN>/ directory whose name passes [parse_risk_id] and that has an events.jsonl. Sorted. This is the register’s single membership rule — index builds and report assembly go through it so they can never disagree about what counts as a risk (stray dirs, backups, and scratch copies are ignored by both).

verify_finding_ref

Verify a finding_ref resolves to a real sealed manifest whose recomputed sha matches manifest_sha256. Used by risks open --from <run-dir> so a risk cannot be bound to absent or fabricated evidence.