Merge pull request #207 from runcycles/codex/disable-evidence-emission-when-unconfigured

[codex] Disable evidence emission when unconfigured

Author: amavashev

AUDIT.md

@@ -9,6 +9,12 @@
 
 All four `docker-compose*.yml` (base, `prod`, `full-stack`, `full-stack.prod`) gain a shared `x-logging` anchor (`json-file`, `max-size: 10m`, `max-file: 5`) referenced by every service (redis, cycles-server, cycles-admin, cycles-events). Previously no compose file declared a logging driver, so containers inherited Docker's default UNBOUNDED `json-file` logs — a slow disk-exhaustion path on long-running deployments (a stack left up for days grows each container's `*-json.log` without limit). The anchor caps every container at 5×10 MB = 50 MB with rotation. Runtime/deployment config only — no image, server-code, or wire change, so no version bump or release; the cap takes effect on containers (re)created from these files. `docker compose config` validates clean on all four.
 
+### 2026-06-23 — v0.1.25.38: disable evidence emission when identity is unconfigured
+
+Aligns runtime producer behavior with the event-tier disabled mode. Previously `EvidenceEmitter.emit` returned no `cycles_evidence` ref when `EVIDENCE_SERVER_ID` / `EVIDENCE_SIGNING_SIGNER_DID` were blank, but it still built and LPUSH'd a source record without `evidence_id` to `evidence:pending`. That made an intentionally non-evidence deployment accumulate work for a signer that should be off.
+
+`EvidenceEmitter.emit` now fail-opens earlier: if either public identity value is blank, it returns `null` before null-stripping payloads, computing ids, or touching `EvidenceQueueRepository`. Configured deployments retain the existing path exactly: payload null-stripping, synchronous `evidence_id` computation, record stamping, queue push, and response ref. `EvidenceEmitterTest` updates the unconfigured case to assert no Redis push and no failure metric, and the configured cases now set identity explicitly. Data-module focused test: `mvn -B -pl cycles-protocol-service-data -am -Dtest=EvidenceEmitterTest -Dsurefire.failIfNoSpecifiedTests=false test`. Version bump: `cycles-protocol-service/pom.xml` `<revision>` → `0.1.25.38`.
+
 ### 2026-06-22 — v0.1.25.37: link reservations to their evidence via `include=evidence`
 
 Implements cycles-protocol v0.1.25.9 (runcycles/cycles-protocol#117). The `cycles_evidence` ref previously rode only on the live reserve/commit/release response, so a reservation fetched later (e.g. by the admin dashboard) had no path back to its signed envelope — you had to have captured the `evidence_id` at the moment of the call. Now the server persists each computed ref onto the reservation and surfaces it via a new `evidence` projection.

CHANGELOG.md

@@ -14,6 +14,28 @@ changes to request/response bodies or Lua-script semantics would require a
 minor bump. "Internal signature changes" (e.g. Java method parameters) are
 called out but are not breaking to API clients.
 
+## [0.1.25.38] — 2026-06-23
+
+### Fixed
+
+- **Unconfigured CyclesEvidence no longer queues source records.** When either
+  `EVIDENCE_SERVER_ID` or `EVIDENCE_SIGNING_SIGNER_DID` is blank,
+  `EvidenceEmitter.emit(...)` now returns `null` before building a source record
+  or pushing to `evidence:pending`.
+- Configured deployments are unchanged: the emitter still null-strips the
+  evidence payload, computes `evidence_id` synchronously, stamps it onto the
+  queued record, and returns `cycles_evidence` for the response.
+
+### Documentation
+
+- Updated the evidence configuration comments to state that missing public
+  identity disables evidence emission completely.
+
+### Validation
+
+- `mvn -B -pl cycles-protocol-service-data -am -Dtest=EvidenceEmitterTest -Dsurefire.failIfNoSpecifiedTests=false test`
+  passes.
+
 ## [0.1.25.21] — 2026-05-22
 
 `expires_from`/`expires_to` and `finalized_from`/`finalized_to` ISO-8601 time-window filters on `GET /v1/reservations`, implementing `cycles-protocol-v0.yaml` revision 2026-05-22 ([runcycles/cycles-protocol#98](https://github.com/runcycles/cycles-protocol/pull/98)). Closes [#162](https://github.com/runcycles/cycles-server/issues/162).

cycles-protocol-service/cycles-protocol-service-api/src/main/resources/application.properties

@@ -78,8 +78,8 @@ cycles.evidence.store.key-prefix=${EVIDENCE_STORE_KEY_PREFIX:evidence:envelope:}
 # signer-did is PUBLIC (the hex Ed25519 public key) — never the private key.
 # Property names + env vars are SHARED with the worker (cycles.evidence.server-id /
 # EVIDENCE_SERVER_ID and cycles.evidence.signing.signer-did / EVIDENCE_SIGNING_SIGNER_DID)
-# so one env var configures both services. When unset, evidence is still queued but
-# no evidence_id is computed or returned.
+# so one env var configures both services. When either is unset, evidence is off:
+# no source record is queued and no evidence_id is computed or returned.
 cycles.evidence.server-id=${EVIDENCE_SERVER_ID:}
 cycles.evidence.signing.signer-did=${EVIDENCE_SIGNING_SIGNER_DID:}
 # Signer JWK Set publication (getEvidenceJwks, GET /v1/.well-known/cycles-jwks.json).

cycles-protocol-service/cycles-protocol-service-data/src/main/java/io/runcycles/protocol/data/service/EvidenceEmitter.java

@@ -20,9 +20,10 @@
  * identity), store and serve.
  *
  * <p>This server stamps the operational facts ({@code artifact_type},
- * {@code issued_at_ms}, {@code trace_id}, payload) AND — when the public server
- * identity ({@code cycles.evidence.server-id} + {@code cycles.evidence.signer-did})
- * is configured — computes the {@code evidence_id} SYNCHRONOUSLY via
+ * {@code issued_at_ms}, {@code trace_id}, payload) when the public server
+ * identity ({@code cycles.evidence.server-id} +
+ * {@code cycles.evidence.signing.signer-did}) is configured. It also computes
+ * the {@code evidence_id} SYNCHRONOUSLY via
  * {@link EvidenceIdComputer} and stamps it on the record. The {@code evidence_id}
  * is a pure function of the envelope contents (no private key needed), so it can
  * be returned on the lifecycle response ({@link EvidenceRef}) for a caller to
@@ -36,7 +37,7 @@
  * carry {@code reservation_id}, and {@code error} carries
  * {@code {endpoint, http_status, request, response}}.
  *
- * <p>DURABILITY: the enqueue is SYNCHRONOUS — the source record is LPUSH'd
+ * <p>DURABILITY: when evidence is configured, the enqueue is SYNCHRONOUS — the source record is LPUSH'd
  * before the lifecycle response returns, so a successful operation cannot return
  * without its evidence being durably queued. The enqueue targets the same Redis
  * as the ledger write that just committed, so it succeeds whenever the operation
@@ -108,9 +109,9 @@ private ObjectMapper evidencePayloadMapper() {
     private String signerDid;
 
     /**
-     * Synchronously enqueue an evidence-source record for a lifecycle artifact
-     * and, when the public server identity is configured, compute its
-     * {@code evidence_id} and return a {@link EvidenceRef} for the caller to
+     * When the public server identity is configured, synchronously enqueue an
+     * evidence-source record for a lifecycle artifact, compute its
+     * {@code evidence_id}, and return a {@link EvidenceRef} for the caller to
      * surface on the response. Call AFTER the ledger write commits and BEFORE
      * returning the response.
      *
@@ -122,10 +123,15 @@ private ObjectMapper evidencePayloadMapper() {
      *                     {@code payload.<artifactType>} (see class javadoc)
      * @return the evidence reference ({@code evidence_id} + {@code cycles_evidence_url})
      *         when the id could be computed, or {@code null} if the server
-     *         identity is unconfigured or emission failed (fail-open — never throws)
+     *         identity is unconfigured (no record queued) or emission failed
+     *         (fail-open — never throws)
      */
     public EvidenceRef emit(String artifactType, long issuedAtMs, String traceId, Object payloadBody) {
         try {
+            if (!identityConfigured()) {
+                return null;
+            }
+
             // Null-strip the payload ONCE into a tree, and use that same tree for
             // BOTH the content-id computation and the queued record, so the id the
             // worker recomputes over the stored payload matches byte-for-byte.
@@ -139,18 +145,15 @@ public EvidenceRef emit(String artifactType, long issuedAtMs, String traceId, Ob
             }
             record.put("payload", cleanPayload);
 
-            EvidenceRef ref = null;
-            if (identityConfigured()) {
-                // Compute the content id over the SAME envelope the worker will
-                // build, BEFORE the record is serialized — and never over a
-                // response already carrying cycles_evidence (the caller stamps
-                // the ref on the response only AFTER this returns), so the
-                // attested payload stays free of a self-reference.
-                String evidenceId = evidenceIdComputer.compute(
-                        artifactType, serverId, signerDid, issuedAtMs, traceId, cleanPayload);
-                record.put("evidence_id", evidenceId);
-                ref = new EvidenceRef(evidenceId, evidenceUrl(evidenceId));
-            }
+            // Compute the content id over the SAME envelope the worker will
+            // build, BEFORE the record is serialized — and never over a
+            // response already carrying cycles_evidence (the caller stamps
+            // the ref on the response only AFTER this returns), so the
+            // attested payload stays free of a self-reference.
+            String evidenceId = evidenceIdComputer.compute(
+                    artifactType, serverId, signerDid, issuedAtMs, traceId, cleanPayload);
+            record.put("evidence_id", evidenceId);
+            EvidenceRef ref = new EvidenceRef(evidenceId, evidenceUrl(evidenceId));
 
             repository.push(objectMapper.writeValueAsString(record));
             return ref;

cycles-protocol-service/cycles-protocol-service-data/src/test/java/io/runcycles/protocol/data/service/EvidenceEmitterTest.java

@@ -16,6 +16,7 @@
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 
 class EvidenceEmitterTest {
@@ -46,6 +47,8 @@ private void configureIdentity() throws Exception {
 
     @Test
     void enqueuesSynchronouslyWithArtifactTypeTraceAndPayloadBody() throws Exception {
+        configureIdentity();
+
         emitter.emit("reserve", 1810000000100L, "trace-abc",
                 Map.of("request", Map.of("idempotency_key", "k1"),
                         "response", Map.of("decision", "ALLOW")));
@@ -63,6 +66,8 @@ void enqueuesSynchronouslyWithArtifactTypeTraceAndPayloadBody() throws Exception
 
     @Test
     void stripsNullValuedPropertiesFromTheEvidencePayload() throws Exception {
+        configureIdentity();
+
         // The evidence mirrors are additionalProperties:false with non-nullable typed
         // fields, so an unset request field serialized as null (e.g. ttl_ms / metadata)
         // would make the envelope fail mirror validation. Null-strip it.
@@ -112,6 +117,8 @@ void evidenceIdIsComputedOverTheNullStrippedPayload() throws Exception {
 
     @Test
     void omitsTraceIdWhenBlank() throws Exception {
+        configureIdentity();
+
         emitter.emit("commit", 123L, "  ", Map.of("request", Map.of("a", 1), "response", Map.of("b", 2)));
 
         ArgumentCaptor<String> captor = ArgumentCaptor.forClass(String.class);
@@ -120,15 +127,14 @@ void omitsTraceIdWhenBlank() throws Exception {
     }
 
     @Test
-    void returnsNullAndOmitsEvidenceIdWhenIdentityUnconfigured() throws Exception {
+    void returnsNullAndDoesNotQueueWhenIdentityUnconfigured() {
         // default wire() leaves server-id/signer-did blank
         EvidenceEmitter.EvidenceRef ref = emitter.emit("reserve", 1L, null,
                 Map.of("request", Map.of(), "response", Map.of("decision", "ALLOW")));
 
         assertThat(ref).isNull();
-        ArgumentCaptor<String> captor = ArgumentCaptor.forClass(String.class);
-        verify(repository).push(captor.capture());
-        assertThat(mapper.readTree(captor.getValue()).has("evidence_id")).isFalse();
+        verify(repository, never()).push(anyString());
+        verify(metrics, never()).recordEvidenceEmitFailed(anyString());
     }
 
     @Test
@@ -168,7 +174,8 @@ void evidenceUrlJoinsCleanlyWhenServerIdHasTrailingSlash() throws Exception {
     }
 
     @Test
-    void failsOpenAndMetersWhenPushThrows() {
+    void failsOpenAndMetersWhenPushThrows() throws Exception {
+        configureIdentity();
         doThrow(new RuntimeException("redis down")).when(repository).push(anyString());
 
         // a push failure must NOT propagate (the ledger write already committed)

cycles-protocol-service/pom.xml

@@ -18,7 +18,7 @@
         <module>cycles-protocol-service-api</module>
     </modules>
     <properties>
-        <revision>0.1.25.37</revision>
+        <revision>0.1.25.38</revision>
         <java.version>21</java.version>
         <maven.compiler.source>21</maven.compiler.source>
         <maven.compiler.target>21</maven.compiler.target>