Function verifyHistoryAudit

src/cli/maintain-history.ts:71–78

(runs: MaintainRun[], audit: HistoryAudit | undefined, key?: string)

/** Verify a snapshot's audit block against its own runs. PURE. */
export function verifyHistoryAudit(runs: MaintainRun[], audit: HistoryAudit | undefined, key?: string): HistoryAuditVerdict {
  if (!audit) return { present: false, ok: true };            // legacy snapshot — nothing to check
  const headMatches = historyHead(runs.map(normalizeRun)) === audit.head;
  const signaturePresent = !!audit.signature;
  let signatureValid: boolean | undefined;
  if (signaturePresent && key) signatureValid = verifyChainSignature(audit.head, audit.signature!, key);
  return { present: true, headMatches, signaturePresent, signatureValid, ok: headMatches && (!signaturePresent || signatureValid !== false) };
}

/**
 * Parse a history snapshot back into runs. Tolerant of extra fields and either the wrapped file