Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

src/secrets_engine/evidence.py

@@ -10,6 +10,7 @@ import json
 import os
 import urllib.error
 import urllib.request
+import uuid
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
@@ -55,6 +56,12 @@ class EvidenceWriter:
         day = datetime.now(timezone.utc).strftime("%Y-%m-%d")
         return self.evidence_dir / f"evidence-{day}.jsonl"
 
+    def _append_local(self, record: dict[str, Any]) -> None:
+        """Append one record before any best-effort external delivery."""
+        path = self._log_path()
+        with path.open("a", encoding="utf-8") as fh:
+            fh.write(json.dumps(record, sort_keys=True) + "\n")
+
     def record(
         self,
         action: str,
@@ -67,7 +74,10 @@ class EvidenceWriter:
         hub: bool = True,
     ) -> dict[str, Any]:
         """Append one non-secret evidence record. Returns the stored record."""
+        record_id = str(uuid.uuid4())
+        hub_requested = bool(hub and self.hub_url)
         record = {
+            "record_id": record_id,
             "ts": datetime.now(timezone.utc).isoformat(),
             "action": action,
             "result": result,
@@ -76,20 +86,38 @@ class EvidenceWriter:
             "stage": stage,
             "decision_id": decision_id,
             "detail": _scrub(detail or {}),
+            "hub_delivery_requested": hub_requested,
         }
-        path = self._log_path()
-        with path.open("a", encoding="utf-8") as fh:
-            fh.write(json.dumps(record, sort_keys=True) + "\n")
-        if hub and self.hub_url:
-            self._post_hub(action, result, catalog_id, stage, decision_id)
+        self._append_local(record)
+        if hub_requested:
+            delivery_result = self._post_hub(
+                action, result, catalog_id, stage, decision_id
+            )
+            # Append-only companion evidence makes an unavailable State Hub
+            # visible without rewriting or delaying the primary local record.
+            self._append_local(
+                {
+                    "record_id": str(uuid.uuid4()),
+                    "related_record_id": record_id,
+                    "ts": datetime.now(timezone.utc).isoformat(),
+                    "action": "evidence-delivery",
+                    "result": delivery_result,
+                    "actor": self.actor,
+                    "catalog_id": catalog_id,
+                    "stage": stage,
+                    "decision_id": decision_id,
+                    "detail": {},
+                    "hub_delivery_requested": False,
+                }
+            )
         return record
 
     def _post_hub(
         self, action: str, result: str, catalog_id: str, stage: str, decision_id: str
-    ) -> None:
-        """Best-effort progress note to State Hub. Never raises; never sends values."""
+    ) -> str:
+        """Best-effort progress note; return a non-secret delivery outcome."""
         if not self.topic_id:
-            return
+            return "skipped-no-topic"
         summary = f"secrets-engine {action}: {result}"
         if catalog_id:
             summary += f" [{catalog_id}{'/' + stage if stage else ''}]"
@@ -111,6 +139,7 @@ class EvidenceWriter:
                 method="POST",
             )
             urllib.request.urlopen(req, timeout=3).read()
+            return "delivered"
         except (urllib.error.URLError, OSError, ValueError):
             # Hub being offline must never block secret work or leak anything.
-            pass
+            return "failed"