daemon: address Copilot review on checkpoint anchor (#871)

- verify --against-anchor: drop the pre-sort and validate strict monotonicity
  in anchor FILE ORDER. The emitter only ever writes a head past the highest it
  already anchored, so file order is strictly increasing by construction and an
  out-of-order/duplicate record is itself the tamper signal — sorting first
  laundered "seq 2 then seq 1" into a passing "1,2". The last record in file
  order is therefore the genuine latest head. Adds an out-of-order regression
  test.
- checkpoint.Verify: correct the docstring to distinguish (false, err) — the
  artifact could not be evaluated — from (false, nil) — parsed but the signature
  does not match. Behaviour unchanged; only the contract is now accurate.
- syslog sink: strip recordLine's trailing newline before writing, so one
  checkpoint is one syslog message rather than risking a split/multi-line entry.

Author: ojongerius

daemon/internal/anchor/syslog_unix.go

@@ -3,6 +3,7 @@
 package anchor
 
 import (
+	"bytes"
 	"fmt"
 	"log/syslog"
 	"sync"
@@ -37,13 +38,18 @@ func OpenSyslog(tag string) (*SyslogLog, error) {
 	return &SyslogLog{w: w, now: time.Now}, nil
 }
 
-// Write emits one record line to syslog. A write error means the record was
-// not accepted.
+// Write emits one record as a single syslog message. recordLine produces a
+// newline-terminated NDJSON line for file/git sinks; syslog frames each call as
+// its own message, so the trailing newline is stripped — leaving it in can make
+// some syslog backends split one record into multiple log entries. The record
+// JSON is itself single-line (no interior newlines), so trimming the final byte
+// is sufficient to keep one checkpoint == one syslog event.
 func (s *SyslogLog) Write(eventType string, payload []byte) error {
 	line, err := recordLine(s.now(), eventType, payload)
 	if err != nil {
 		return err
 	}
+	line = bytes.TrimRight(line, "\n")
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	if _, err := s.w.Write(line); err != nil {

daemon/internal/checkpoint/checkpoint.go

@@ -93,9 +93,17 @@ func Sign(cp Checkpoint, signer Signer) (Signed, error) {
 
 // Verify checks s's signature against the PEM/SPKI Ed25519 public key. It
 // re-canonicalises the embedded Checkpoint body (the wrapper fields are never
-// signed) and validates the detached signature. A malformed signature, wrong
-// key type, or mismatch returns (false, err) — checkpoint verification failure
-// is surfaced, never swallowed.
+// signed) and validates the detached signature.
+//
+// The two failure modes are distinct, so callers can tell a malformed artifact
+// from a genuine forgery:
+//   - (false, err): the signature, key, or canonical body could not even be
+//     evaluated (bad multibase prefix, wrong length, unparseable key, etc.).
+//   - (false, nil): everything parsed but the signature does not match the body
+//     (a real verification failure / forgery).
+//
+// Only (true, nil) means the checkpoint is authentic. Either failure must be
+// treated as a hard rejection — never swallowed.
 func Verify(s Signed, publicKeyPEM string) (bool, error) {
 	if len(s.Signature) < 2 {
 		return false, errors.New("checkpoint signature too short")

daemon/internal/verifycli/anchor.go

@@ -2,7 +2,6 @@ package verifycli
 
 import (
 	"fmt"
-	"sort"
 
 	"github.com/agent-receipts/ar/daemon/internal/checkpoint"
 )
@@ -43,7 +42,13 @@ func verifyAgainstAnchor(anchorPath, chainID, pubPEM string, headSeq int64, head
 		return anchorResult{Reason: fmt.Sprintf("no verified checkpoint found for chain %s in anchor %s", chainID, anchorPath)}
 	}
 
-	sort.Slice(cps, func(i, j int) bool { return cps[i].Sequence < cps[j].Sequence })
+	// Validate strict monotonicity in ANCHOR FILE ORDER, never after a re-sort.
+	// The daemon appends a chain's checkpoints in strictly increasing sequence by
+	// construction (the emitter only writes a head past the highest it already
+	// anchored), so an out-of-order or duplicate record in the file is itself the
+	// tamper/corruption signal. Sorting first would launder "seq 2 then seq 1"
+	// into "1, 2" and pass — so the last record in file order is also the genuine
+	// latest head, not a max() that hides reordering.
 	for i := 1; i < len(cps); i++ {
 		if cps[i].Sequence <= cps[i-1].Sequence {
 			return anchorResult{

daemon/internal/verifycli/anchor_test.go

@@ -173,3 +173,19 @@ func TestAnchorRejectsNonMonotonicLog(t *testing.T) {
 		t.Errorf("reason %q does not flag the ordering problem", got.Reason)
 	}
 }
+
+func TestAnchorRejectsOutOfOrderLog(t *testing.T) {
+	signer, pub := newAnchorSigner(t)
+	// seq 2 written before seq 1: the monotonic check runs in anchor FILE ORDER,
+	// so this must fail. Sorting first would launder it into 1,2 and pass, hiding
+	// a reordered/tampered log — guards against re-introducing a sort.
+	path := writeAnchor(t, signer, cp("c", 2, "sha256:2"), cp("c", 1, "sha256:1"))
+
+	got := verifyAgainstAnchor(path, "c", pub, 2, "sha256:2", true)
+	if got.OK {
+		t.Fatal("expected FAIL for an out-of-order checkpoint log")
+	}
+	if !strings.Contains(got.Reason, "increasing") {
+		t.Errorf("reason %q does not flag the ordering problem", got.Reason)
+	}
+}