Bo 81c9f305ac feat(ci): witness Dolt->JSONL re-derive + hash-compare (ag-lmdx.3 #witness-crosscheck) (#656) ...

## What

The **watcher that watches the watcher** (ag-lmdx.3). A blocking CI gate
that re-derives the hash-chained JSONL witness **from the Dolt
projection** and hash-compares it against the git-committed witness
ledger — proving Dolt is a *faithful projection* of the canonical event
log.

This is the **inverse** of drrebuild (#646): drrebuild rebuilds the Dolt
context graph FROM the witness (JSONL + git blobs); this rebuilds the
witness FROM Dolt rows. Together they pin both ends of the projection.
Dolt history is rewritable (reset/--force/root) so it is NOT
tamper-evidence; the git-anchored JSONL witness is. A Dolt rewrite that
did not also rewrite the committed witness is caught here, and nowhere
else.

## How

- `cli/internal/drwitness/` — re-derive + cross-check core. Reuses
drrebuild's exact hash discipline (`ComputeEventHashes`: payload_hash =
sha256(canonical-JSON), hash = sha256(payload_hash + "\n" + prev_hash))
and canonical edge ordering. Re-derivation is order-independent
(canonical sort then re-seal), which is what makes the hash-compare
meaningful.
- `cli/cmd/witness-crosscheck/` — standalone helper main (like
`cmd/skill-frontmatter-json`), **NOT** an `ao` subcommand (no CLI
surface added).
- `scripts/witness-dolt-jsonl-crosscheck.sh` — hermetic CI gate. CI has
no live Dolt, so it drives committed fixtures through the helper and
asserts the gate fires correctly.
- `tests/scripts/` + `tests/fixtures/witness/` — bats behavioral proof.

## Scenarios (acceptance)

- **Clean state passes** — the faithful Dolt projection re-derives to
the committed witness; gate exits 0.
- **Tampered Dolt fails** — a rewritten Dolt row no longer matches the
committed witness head; helper reports `DIVERGED`, gate exits non-zero.

## Verification

- `go build ./... && go vet ./... && go test ./...` (full suite: 11948
passed / 71 pkgs; drwitness: 7/7)
- `bats tests/scripts/witness-dolt-jsonl-crosscheck.bats` — 6/6
- `shellcheck -S warning` — clean
- `scripts/validate-ci-policy-parity.sh` — PASS
- diff is scope-only (10 files, additions); the sibling wave-pregate
(#655) is present and untouched.

Closes-scenario: ag-lmdx.3#witness-crosscheck
Bounded-context: BC4-Factory
Evidence: scripts/witness-dolt-jsonl-crosscheck.sh

2026-05-31 14:39:13 -04:00

..

main.go

feat(ci): witness Dolt->JSONL re-derive + hash-compare (ag-lmdx.3 #witness-crosscheck) (#656)

2026-05-31 14:39:13 -04:00