daemon: out-of-band checkpoint anchor for tail-truncation resistance

[ojongerius]

Spike (#600) closing the ADR-0008 §2 tail-truncation gap with an additive,
out-of-band signed checkpoint emitted to a pluggable multi-sink anchor.
Receipts stay a linear VC chain — nothing here touches the receipt schema,
hash chain, @context, or issuer DID.

• checkpoint package: {chain_id, sequence, receipt_hash, timestamp} signed via
  the existing RFC 8785 JCS path; Sign/Verify against the daemon key.
• Emitter: fan-out to a sink LIST, per-chain cadence (default every receipt) +
  graceful-shutdown flush; sink failures are logged + metered (fail-visible,
  never blocking receipt emission — the opposite of the PY-P9 silent drop).
• Sinks behind the existing anchor.Sink interface: git (commit chain = the only
  Merkle structure; agent UID cannot write), file (FileLog), syslog (unix).
  OpenSink/OpenSinks dispatch file:/git:/syslog: specs.
• Daemon wiring: --checkpoint-anchor (fan-out list) + --checkpoint-cadence,
  with env + TOML parity; emit after each commit, flush on shutdown. Empty
  config keeps the commit path byte-identical to before.
• verify --against-anchor: chain intact + checkpoint signatures + strictly
  increasing log + head-match; a checkpoint ahead of the store HEAD is reported
  FAIL (truncation). Default off — verify is unchanged without the flag.
• CI gate (ADR-0024 catalogue Rename attest-config- temp dir prefix to ar-config- #11): emit chain, anchor it, truncate the store
  tail, assert verify --against-anchor goes red with a truncation reason while
  plain verify still reports VALID.
• Freeze: comment at the emit site + a one-line note in ADR-0008 that receipts
  MUST NOT carry an anchor reference; anchoring is out-of-band by design.

[Copilot]

Pull request overview

This PR adds an out-of-band, signed checkpoint anchoring mechanism to the daemon to detect receipt-store tail truncation (ADR-0008 gap), without changing the receipt schema or hash chain. It introduces a checkpoint emitter with pluggable multi-sink anchors (file/git/syslog) and extends obsigna receipt verify with an opt-in --against-anchor check plus CI gates/tests.

Changes:

• Introduces daemon/internal/checkpoint (checkpoint format, signing/verification, emitter, anchor log reader) and wires it into the pipeline + daemon shutdown flush.
• Adds anchor sink dispatch and new sink backends (git repo commits, file log reuse, syslog), plus config/flag/env/TOML plumbing.
• Adds verify --against-anchor and a truncation gate test, plus docs/ADR updates describing the anchoring freeze and verification contract gate.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
docs/adr/0024-project-verification-contract.md	Adds Gate #11 for tail-truncation detection via checkpoint anchoring.
docs/adr/0008-response-hashing-and-chain-completeness.md	Adds an “anchoring freeze” note: anchoring remains out-of-band and never enters receipts.
daemon/tests_framework.go	Adds DaemonFixture.Stop to allow tests to wait for graceful shutdown/flush completion.
daemon/tests_checkpoint_truncation_test.go	Adds deterministic truncation gate test that proves --against-anchor detects tail truncation.
daemon/tests_checkpoint_anchor_test.go	Adds integration tests covering end-to-end anchoring + shutdown flush and duplicate-avoidance regression.
daemon/README.md	Documents checkpoint anchoring, sink specs, cadence, failure behavior, and verify --against-anchor.
daemon/internal/verifycli/verify.go	Adds --against-anchor flag and invokes anchor verification after chain validation.
daemon/internal/verifycli/anchor.go	Implements the anchor verification logic (head match + truncation detection).
daemon/internal/verifycli/anchor_test.go	Unit tests for anchor verification outcomes (pass, truncation, tamper, missing, forged, ordering).
daemon/internal/pipeline/build.go	Adds pipeline Checkpointer hook and shutdown FlushCheckpoints.
daemon/internal/checkpoint/reader.go	Adds shared anchor-log reader that verifies checkpoint signatures while parsing NDJSON records.
daemon/internal/checkpoint/emitter.go	Adds per-chain cadence-based checkpoint emitter with fan-out sinks and failure metering/logging.
daemon/internal/checkpoint/emitter_test.go	Unit tests for fan-out, cadence+flush, fail-visible behavior, duplicate prevention, and close.
daemon/internal/checkpoint/checkpoint.go	Defines checkpoint payload + signature wrapper and Ed25519 sign/verify helpers.
daemon/internal/checkpoint/checkpoint_test.go	Crypto-level tests for sign/verify round-trip and malformed/wrong-key cases.
daemon/internal/anchor/syslog_unix.go	Adds syslog sink implementation (unix) using shared record envelope format.
daemon/internal/anchor/syslog_other.go	Adds non-unix stub returning a clear “syslog unsupported” error.
daemon/internal/anchor/open.go	Adds OpenSink / OpenSinks dispatcher for file/git/syslog sink specs.
daemon/internal/anchor/git.go	Adds git-backed sink that appends NDJSON and commits each write for tamper-evident history.
daemon/internal/anchor/git_test.go	Tests git sink write/commit behavior, config-on-open, and input validation.
daemon/internal/anchor/anchor.go	Adds checkpoint event type and refactors shared record-line marshaling for all sinks.
daemon/daemon.go	Wires checkpointing into daemon run lifecycle and flushes checkpoints on shutdown.
daemon/configfile.go	Extends TOML config schema with checkpoint anchor list + cadence.
daemon/cmd/obsigna-daemon/main.go	Adds flags/env/TOML parsing for checkpoint anchors/cadence and prints resolved config.
daemon/cmd/obsigna-daemon/config_test.go	Adds config-layer tests for checkpoint anchor parsing and cadence validation.