## Problem The NDJSON archive is the artefact operators are told to keep on WORM media as the authoritative copy of purged rows. Its footer carries eight fields. The identity HMAC covers five of them: ``` implode('|', [$chain_id, $from_id, $to_id, $created, $secret_id]) ``` `row_count`, `anchor_before` and `anchor_after` are **not** signed. `archiveContentHmac()` does cover them, but it is stored on the `audit_trail_segment` row rather than in the file, so a file separated from its database row carries no binding to those three values at all. ## What happens Truncate a contiguous run of `row` lines, decrement `row_count`, and set `anchor_after` to the hash of the new last row: the footer's identity HMAC still validates, because none of the three edited fields is inside it. Importing that file then launders it. `importFromFile()` computes `hash_file()` over the file under test, so the recorded digest authenticates nothing, and re-signs the footer's own unverified count and anchors with the live secret. Afterwards the segment reports "identity HMAC OK, archive-content HMAC OK, lifecycle HMAC OK, file SHA-256 OK", because every digest was computed from the tampered bytes. Worse than a bad archive: `findArchiveBridging()` hands the forged `anchor_after` to the chain walker, so rows deleted from the live table chain cleanly across the gap and the chain reports "verified: N entries intact. Bridged purged ranges via 1 WORM archive." ## Findings in this issue - **H5** `src/Archive/SegmentSignature.php:60-122`: the footer leaves `row_count` and both anchors unsigned, and `importFromFile()` re-signs whatever the file claims. Verified by reading. - **H9** `src/Archive/SegmentRestorer.php:838-853`: `--allow-missing-secret` waives an HMAC **mismatch**, not only an unresolvable secret: the `!$secret_resolved` throw and the `!$identity_hmac_valid` throw sit under one `if (!$allow_missing_secret)`. Rows from a file that failed its own identity check land fully signed. - **H22** `src/Archive/AuditTrailSegmentListBuilder.php`: `valid_archive_signature` is computed on every segments-list row and read nowhere, so a tampered footer renders as OK on the one page built to show it. - **H26** `tests/src/Kernel`: the suite uses the unsigned-footer property as a *setup convenience*, editing counts to build fixtures, and never turns it into the forgery it enables. - finding `src/Archive/SegmentRestorer.php`: the restore shape guard omits `action` and `resource`; import silently skips the file copy when the destination path is already occupied. ## Proposed fix 1. **Sign the whole footer.** Add `row_count`, `anchor_before` and `anchor_after` to the identity HMAC payload. Pre-1.0 there is no compatibility burden: no update hook, and existing archives are re-signed on the next verification pass or declared unreadable, whichever the maintainer prefers. 2. **Verify before re-signing.** `importFromFile()` must validate the incoming footer against the resolved secret and refuse the file on mismatch, rather than minting a fresh signature over unverified values. 3. **Separate the two waivers.** `--allow-missing-secret` should skip only the secret-resolution throw. A verified-and-mismatched footer is never importable. 4. **Read `valid_archive_signature`** on the segments list, or stop computing it. 5. Turn the fixture convenience into the forgery test it enables. --- Found by a full-tree audit of `1.x` pinned at `7bae553` (tag `1.0.0-alpha9`), reading all 271 tracked files. Every claim above was checked against the source, and where a claim could only be settled by running something, the issue says so. AI-Generated: Yes (Claude Code was used to help draft this issue summary. I reviewed it before posting; there is no merge request on this issue yet.)