Module checkpoint_sink 

External anchor sinks for signed audit checkpoints.

A Checkpoint commits (seq, chain_tip, timestamp) with an Ed25519 signature. Anchoring those checkpoints to an independent, append-only store is what makes tail-truncation and rewrite of the local chain detectable by a host attacker who controls the primary database: they cannot reproduce a previously anchored signed tip (see verify_checkpoints).

This module defines a small CheckpointSink interface with two backends:

• PostgresCheckpointSink — writes checkpoints to an append-only audit_checkpoints table on a separate Postgres database. INSERT-only by construction (this code never issues UPDATE/DELETE). Operators should additionally grant the SysKnife role only INSERT/SELECT on the table and REVOKE UPDATE, DELETE so a stolen daemon credential cannot rewrite the anchor either. Append-only permissions alone do not stop a DB superuser; the signature is what makes tampering detectable.
• InMemoryCheckpointSink — for tests and dry runs.

Additional verifiable backends (immudb, WORM object storage, an RFC 3161 timestamp authority) can implement the same trait.

Structs

InMemoryCheckpointSink

In-memory checkpoint sink for tests and dry runs. Append-only.

PostgresCheckpointSink

Postgres append-only checkpoint sink. Anchors signed checkpoints to a separate database so a host attacker cannot silently rewrite or truncate the local chain without being detected on the next verify.

Enums

AnchorOutcome

Result of one anchoring attempt.

CheckpointSinkError

Constants

DEFAULT_ANCHOR_INTERVAL

How often the daemon anchors a checkpoint when a sink is configured.

Traits

CheckpointSink

An append-only sink that stores signed checkpoints and hands them back for verification. Implementations must never mutate or delete a stored checkpoint.

Functions

anchor_once

Sign the current chain tip and anchor it to sink, then prove the anchor landed and still agrees with the local chain.

spawn_periodic_anchor

Periodically anchor the chain tip to sink for as long as the daemon runs.