## Problem/Motivation Found by an external review of 1.x at `5a4e685`, each attack reproduced as a kernel test by somebody with database write access and no signing secret. A segment row names its secrets in plain columns (`secret_id`, `archive_secret_id`, `lifecycle_secret_id`). Where that secret does not resolve, several checks were skipped, and the row was then trusted or signed under the live secret. Setting the column to an id no secret has switched the check off. ### Security 1. **Compaction signs forged segments.** `ChainArchiver::assertRunIsSigned()` skipped a segment whose identity secret does not resolve. Two fabricated segments over rows deleted from the middle of a chain were folded and signed, and the walk then read `Chain "webdav" verified: 8 entries intact.` 2. **Compaction never checked the lifecycle signature.** It reads the mark saying rows were purged while they did not verify straight from its column. One `UPDATE` cleared it, and the fold signed the cleared mark. 3. **A strict walk crossed a segment it could only take as read.** With the mark cleared and the lifecycle secret pointed at a missing id, `verifyChain()` at `Strict` returned `ok => TRUE`, so cron raised nothing. `Strict` is documented to treat a secret that will not resolve as a finding. 4. **The next retention step signed the doctored segment.** `SegmentReader::loadSegmentRowForTransition()` returned such a row unchecked, and the transition re-signed its stamps under the live secret: the walk then read the purged-while-broken rows as intact, authenticated. 5. **A signed outbox row could be replayed once retention removed the row it became**, because the copy check only reads the live table. ### False texts 6. The threat model's "Nothing unsigned is signed later" was false because of 1, 2 and 4, and the docblocks justifying the skip said a used secret may be deleted, which the delete form refuses. ## Proposed resolution A secret id is computed from the secret's bytes, a secret that signed anything cannot be deleted, and retiring one keeps it. So a segment naming an id no secret has was written by hand. 1. `SecretRepositoryInterface::hasSecret()` says whether a secret was ever registered under an id. 2. Every retention step and compaction refuse a segment whose lifecycle or identity secret id names no secret. Compaction checks each segment's lifecycle signature before folding. Restoring an archive imported from another site still works: the operator's `--allow-missing-secret` is passed through, and only that. 3. A strict walk does not cross a segment it could only take as read. `Tolerant` still does, and says so. 4. Cron's backlog refuses a staged row timed at or before the end of the history retention already purged on its chain (one query per batch). 5. The texts say what happens. Tests (each fails on 1.x): - Compaction refuses two segments naming a secret no secret has, and a segment whose purge mark was cleared by hand. - A strict walk reports the gap behind a segment whose mark was cleared and whose lifecycle secret names no secret; `Tolerant` reads it as read. - The next retention step refuses that segment. - A copy of a staged row replayed after retention purged its original is not chained. Performance: a full strict walk over 2,000 rows with 10 purged segments takes 14.2 ms on 1.x and 14.0 to 14.2 ms with this change. Compaction checks each run segment's lifecycle signature on the rows it already read (20 segments: 1.2 ms on 1.x, 1.2-1.7 ms here), and cron's backlog reads purged history once per batch (500 leftover rows within run-to-run noise); nothing on the recording path changes. ## Remaining tasks None. ## User interface changes - `drush audit_trail:compact` refuses a run holding a segment whose signatures do not hold or name no secret. - `drush audit_trail:retry-abandoned`: an entry written at or before the end of the history retention already purged from its chain is refused, since it cannot be told from a copy. Retry abandoned entries well inside the live-purge window. ## API changes - `SecretRepositoryInterface::hasSecret()`. - `SegmentReader::loadSegmentRowForTransition()` takes `$allow_missing_secret`. AI-Generated: Yes (Claude Code was used to help draft this issue summary. I reviewed it.)