Tamper-evident append-only fault audit log

[mfaferek93]

Closes #483

Optional (off by default) append-only, hash-chained audit log of fault state transitions in the fault manager: one immutable row per transition, sha256(prev_hash + canonical(event)) with a persisted chain head, a verify routine, retention that seals a segment anchor before pruning, and append-only triggers.

Threat model is documented honestly: the chain is unkeyed and lives in a single writable file, so it detects non-recomputing tampering and accidental loss; a key/signature or external anchoring is a follow-up.

Tested: 121 unit tests incl. truncation and tamper cases.

[Copilot]

Pull request overview

This PR adds an optional, tamper-evident (hash-chained) append-only audit log to ros2_medkit_fault_manager to make fault state-transition history independently verifiable (detecting non-recomputing edits/deletions), with configurable retention/rotation and test coverage for tamper/truncation scenarios.

Changes:

• Introduces FaultAuditLog (SQLite-backed) with hash chaining, persisted head, verify routine, and sealed-anchor retention pruning.
• Hooks the audit log into FaultManagerNode for write-path transitions (including timer-driven PREFAILED→CONFIRMED auto-confirmations) and adds/updates unit tests accordingly.
• Updates dependencies/build/docs/config/changelog to include OpenSSL (EVP SHA-256) and document the threat model and parameters.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/ros2_medkit_fault_manager/src/fault_audit_log.cpp	Implements the SQLite-backed append-only, hash-chained audit log with verify + rotation/anchors.
src/ros2_medkit_fault_manager/include/ros2_medkit_fault_manager/fault_audit_log.hpp	Public API/types for audit events, records, head, and verification results.
src/ros2_medkit_fault_manager/src/fault_manager_node.cpp	Creates/configures the audit log and appends records on fault transitions, including timer auto-confirmation.
src/ros2_medkit_fault_manager/include/ros2_medkit_fault_manager/fault_manager_node.hpp	Declares audit-log plumbing and exposes test-only accessors used by new tests.
src/ros2_medkit_fault_manager/src/sqlite_fault_storage.cpp	Changes time-based confirmation to return confirmed fault codes for auditing.
src/ros2_medkit_fault_manager/src/fault_storage.cpp	Updates in-memory storage to return confirmed fault codes for auditing.
src/ros2_medkit_fault_manager/include/ros2_medkit_fault_manager/fault_storage.hpp	Updates the check_time_based_confirmation() contract to return confirmed fault codes.
src/ros2_medkit_fault_manager/include/ros2_medkit_fault_manager/sqlite_fault_storage.hpp	Updates override signature for the new confirmation return type.
src/ros2_medkit_fault_manager/test/test_fault_audit_log.cpp	Adds focused unit tests for append/verify/tamper/truncation/rotation and trigger enforcement.
src/ros2_medkit_fault_manager/test/test_fault_manager.cpp	Adds end-to-end node tests verifying audit logging (enabled/disabled/timer-confirm paths).
src/ros2_medkit_fault_manager/test/test_sqlite_storage.cpp	Updates tests to match new confirmation return type (vector of fault codes).
src/ros2_medkit_fault_manager/CMakeLists.txt	Links OpenSSL crypto, builds the new audit-log implementation and test target.
src/ros2_medkit_fault_manager/package.xml	Adds OpenSSL development dependency (libssl-dev).
src/ros2_medkit_fault_manager/config/fault_manager.yaml	Documents audit-log parameters and threat model in the default config.
src/ros2_medkit_fault_manager/README.md	Documents audit-log behavior, parameters, rotation, and threat model.
src/ros2_medkit_fault_manager/CHANGELOG.rst	Adds a forthcoming entry describing the new audit-log feature and behavior.

[bburda]

Additional findings outside the diff:

• The audit log has no runtime read/verify/health surface. verify(), read(), head(), record_count(), and the dropped-writes / audit-healthy counters are reachable only as C++ getters (the test-only accessor); no runtime path calls verify(), and nothing exposes the log or its health outside the process. The README (line 119, and the fail_closed row of the parameter table) presents the dropped-writes counter as the safety net for the completeness gap, but an operator has no way to observe audit health or run verify() without stopping the node and using an offline tool that reimplements canonicalize(). The history and its verify/health result should be reachable over the gateway API (a read plus a verify/health resource), with an optional fault-manager ROS service for verify/health, so the log is observable at runtime.

[mfaferek93]

Agreed, and this is intentional for this PR. #487 lands only the write-time primitive: the append-only hash chain plus the in-process verify() / read() / head APIs. Surfacing the log and its verify/health at runtime (a read plus a verify/health resource over the gateway API, and optionally a fault-manager service) is deliberately out of scope here and tracked as follow-up work.

I'll also tighten the README so the dropped-writes / audit-healthy signals aren't presented as operator-observable at this stage (they are in-process only until that runtime surface lands), and I'll address the concrete correctness findings in the diff in a follow-up commit.