Module accountability_store 

Persistence for the accountability fabric — the on-disk home for the tamper-evident AccountabilityLedger, the revocable ConsentCredentials, and the durable ConductRecords (ADR 0011 D2/D4/D5). It turns the tested domain models into something the desktop can actually use.

Design: one small JSON sidecar file (wellfair/accountability.json), loaded/saved whole, matching the sibling-store convention (personal_profile::EmergencyContactStore). A person’s own accountability set is small, and whole-file rewrite is the correct shape for a store whose records mutate (a credential is revoked — the wrapped key destroyed in place — so append-only JSONL would not do).

Every accountability-relevant act is written into the signed hash-chained ledger, not only the convenience indexes: granting a credential logs a "consent_granted" entry, revoking logs "consent_revoked", and recording conduct logs a "conduct" entry carrying the record. So the ledger is the authoritative tamper-evident spine (a betrayer cannot quietly drop the inconvenient act — verify catches it), and AccountabilityState::credentials / AccountabilityState::conduct are fast views over it.

Scope: this is tamper-evidence + local durability. Anti-deletion durability across parties (so no one can destroy the only copy) is the commons-replication layer (swarm/WebTorrent; coordinate), and the two compose — replicate this file, and any pruned/rewritten copy is provably tampered. Real envelope encryption of the wrapped key is the vault’s job (deferred); here the wrapped key is carried as opaque bytes, exactly as the model intends.

Structs

AccountabilityState

The whole persisted accountability set.

AccountabilityStore

On-disk store for the accountability fabric.

DeadMansSwitchRecord

A persisted dead-man switch together with the party attestations accumulated toward its trigger. The DeadMansSwitch domain type carries no attestations (they are passed to enact); the store holds them so the gamified trigger can accumulate across sessions (in the real model, on the friends’ devices).

Constants

KIND_CONDUCT

KIND_CONSENT_GRANTED

Ledger record kinds this store writes (the tamper-evident spine’s vocabulary).

KIND_CONSENT_REVOKED

KIND_DEAD_MANS_ALIVE

KIND_DEAD_MANS_ARMED

KIND_DEAD_MANS_ATTESTED

KIND_DEAD_MANS_ENACTED

KIND_DISCLOSURE

KIND_INCAPACITY_ACTIVATED

KIND_INCAPACITY_ARMED

KIND_INCAPACITY_REVERSED

KIND_TRANSPARENCY_CC

STORE_FILE

Sidecar file, under the same wellfair/ prefix as the other host stores.

Functions

parse_commitment_hex

Parse a 32-byte hex commitment (helper for the host/command boundary). Err on wrong length / non-hex.