opschain governance evidence re-anchor
packs:security-governance
opschain governance evidence re-anchor --justification "<the incident story>"
Re-anchors the evidence ledger after a database incident with sustained
data loss (GovernanceService.ReAnchorEvidenceLedger). A re-anchor is not
an untaint: it never rewrites or recomputes a stored row — if the ledger
could be silently repaired, so could an attacker's edit. It appends a
re_anchor ledger row that records the break as a permanent, governed
fact (the last row as observed, where verification failed, the stored
head hash, and the justification), after which new entries chain off the
anchor and verify again. Every later verify lists the acknowledged
discontinuity, forever.
The primary recovery from a broken chain is restoring the real data from a database backup. Re-anchor only when the loss is sustained and the data cannot be recovered.
The verb requires updatable on /governance/evidence, the
packs:security-governance entitlement, and a stepped-up session (an
unelevated call answers the typed step-up refusal). The act is audited
with a warn-class warn:governance:ledger_re_anchored event beside the
ledger row itself.
A healthy chain refuses: the chain verifies; nothing to re-anchor.
Flags
| Flag | Meaning |
|---|---|
--justification <text> | The incident story recorded forever on the discontinuity (mandatory). |
Exit codes
| Code | Meaning |
|---|---|
| 0 | The re-anchor row landed; the output names its seq and row hash. |
| 1 | Refused: healthy chain, missing authority, missing pack, missing elevation, or the write failed. |
| 2 | Usage error, including a missing --justification or server target. |