## Problem Three HMACs protect a segment: identity, archive content, and lifecycle. The verifier validates the first two in one place and the third **nowhere**. `lifecycle_hmac` occurs in `src/AuditTrailVerifier.php` only inside a docblock, at around line 1022. That matters because a segment row is what legitimizes missing data. `verifyTransientColumn()` accepts a NULLed `context_transient` when a covering segment has `transient_purged_at <> 0` **or** `archived_at <> 0`. The check is a bare `countQuery()` on `audit_trail_segment` with no signature validation at all. ## What happens An attacker with DB write access NULLs `context_transient` across a range, erasing who acted, from where, and the before/after values. The canonical form excludes that column, so the public hash and the payload HMAC both still verify. They then `INSERT` one fabricated `audit_trail_segment` row with garbage in every HMAC column, and the walk accepts the erasure as a legitimate purge. The entry-detail page renders the emptied rows as "Row #N verifies fully" and labels the bucket "Payload purged. Hash on the row keeps verification intact." A second, slower path stays open even if the count is signed: every lifecycle transition re-signs the eight stamps **from the row as found**, so a stamp forged by hand is laundered into a valid signature by the next ordinary cron tick. ## Findings in this issue - **H29** `src/AuditTrailVerifier.php:1290-1322`: the verifier accepts an unsigned, fabricated segment row as proof that a NULLed forensic bucket was purged legitimately. `lifecycle_hmac` is never validated anywhere in the verifier. - finding `src/Archive/ChainArchiver.php`: every lifecycle transition re-signs the eight stamps from the row as found, so a forged stamp becomes a valid signature at the next transition. - finding `src/Archive/ChainArchiver.php`: the archive and transient stages sign from a pre-lock snapshot, so a row that changed under them keeps a **permanent false tamper verdict**. It is the same defect pointed the other way. - finding `src/AuditTrailVerifier.php:1290-1322`: the `archived_at <> 0` half of the legitimization test is justified by a docblock claiming the NDJSON "deliberately stripped the raw transient bytes". The writer copies them verbatim, so that clause has no mechanism behind it and only widens the hole. ## Proposed fix 1. **Validate `lifecycle_hmac`** wherever a segment is used as evidence, starting with `verifyTransientColumn()`, which must load the covering segment and check its signature rather than counting rows. 2. **Validate before re-signing.** A transition should verify the stamps it inherited before computing a new signature over them, and refuse the transition (loudly) on mismatch. 3. **Sign inside the lock**, from the row as re-read under the lock, so a concurrent change cannot strand a permanent false verdict. 4. Fix the `archived_at` docblock and drop that clause, or make the writer actually strip the transient bytes. The prose and the writer must agree. Tests to be seen failing first: a fabricated segment row must not legitimize a NULLed bucket, and a forged stamp must not survive a transition. --- Found by a full-tree audit of `1.x` pinned at `7bae553` (tag `1.0.0-alpha9`), reading all 271 tracked files. Every claim above was checked against the source, and where a claim could only be settled by running something, the issue says so. AI-Generated: Yes (Claude Code was used to help draft this issue summary. I reviewed it before posting; there is no merge request on this issue yet.)