test(hash): assert T2.8 parity at the canonical hash input, not just the digest

[oabolade]

Folds the T2.8 audit check into test_cross_backend_hash.py.

What was missing

The file's docstring already claimed both backends "feed the same canonical fields to the same frozen formula" — but nothing asserted it. The existing tests compare digests and verify verdicts, which mostly re-proves that SHA-256 is deterministic. What actually drifts is which fields are canonical, in what order, and how each value is normalized. None of that was covered.

1. Byte-identity of the SHA-256 pre-image

_CapturePreimages intercepts hashlib inside rootsign.hashing and records the exact byte string handed to sha256. The canonical form is never reconstructed in the test — a test-local copy would agree with itself while the store quietly diverged, which is the failure ADR-001's never re-implement rule exists to prevent.

Same scripted session through both backends; field sets compared first (a legible failure), then full byte-identity per record.

[1] IDENTICAL  (394B vs 394B)
[2] IDENTICAL  (456B vs 456B)
[3] IDENTICAL  (458B vs 458B)

The pre-image, identical on both sides:

{"action_id": "…", "input_hash": "0e1c4bf0…", "output_hash": "bbbb…",
 "prev_action_hash": "02b1351e…", "sequence_number": 2, "session_id": "…",
 "timestamp": "2026-08-18T19:57:33.473234+00:00", "tool_name": "query_db"}

2. Identity pinned, so the comparison isolates canonicalization

action_id is store-assigned (uuid4() in jsonl_client and crud.action), not a property of the logical action — so an unpinned run differs there, and via the chain in prev_action_hash too. The docstring already noted this as a caveat; _pin_action_ids holds it constant so any remaining difference is a genuine divergence. The caveat becomes an assertion.

Verified non-vacuous — with pinning disabled the test fails, printing both pre-images side by side:

jsonl: {"action_id": "288ea189-…", "input_hash": "eb775ee5…", …}
pg   : {"action_id": "b26856b8-…", "input_hash": "eb775ee5…", …}

action_id is the sole difference; every other field identical. That's both proof the assertion has teeth and independent confirmation of the caveat.

3. Cross-backend tamper-detection parity

input_redacted sits outside self_hash (ADR-001) but is re-bound to input_hash, which is canonical. That binding is implemented twice — crud.action._payload_binding_error and sdk.chain — so the two can drift. A store where the DB path catches a rewritten payload and the offline path does not would be a silent hole in the audit story.

Now asserted on both, same verdict and same sequence:

JSONL: valid=False seq=2  payload_hash mismatch: input_redacted does not match input_hash
PG   : valid=False        payload_hash mismatch at sequence_number=2: …

The Postgres row is tampered directly via the hypertable-safe (action_id, timestamp) form. Note: the previous tamper test only ever touched the JSONL copy — the Postgres verifier had no tamper coverage in this file at all.

Also

Parametrizes the existing tamper test over input_hash and tool_name — both canonical, so either must surface at the sequence it was altered.

Verification

• 6 passed in this file (was 3).
• Full suite: 500 passed, 6 skipped.
• ruff check clean apart from the 2 pre-existing E402s.

🤖 Generated with Claude Code