feat(sidecar): cross-process locking + atomic writes, and wire provenance/history CLI (V-L2-F4, #150)

[hyperpolymath]

Hardening + CLI follow-up to the JSON sidecar (#146). Closes #150.

Harden the JSON store

• Cross-process write locking (src/sidecar/lock.rs): dependency-free advisory <path>.lock (O_EXCL via create_new) with retry/backoff and stale-lock steal (a lock older than the staleness window is reclaimed, so a crashed writer can't wedge the sidecar), RAII release on drop. json::with_locked(path, fmt, |store| …) holds the lock across the whole load → mutate → save cycle; gc apply now runs through it (dry-run stays lock-free/read-only).
• Atomic writes: documents and keeps the temp-file + same-dir rename durability already in save() — a concurrent reader always sees a complete file, never a partial one. The one documented difference from SQLite (engine-serialised) is now closed for the single-host case.

Wire the stub CLI subcommands (sqlite and json; postgres refuses)

• provenance <entity> — prints the entity's chain, verify_chain status, and any fork points (ADR-0010).
• history <entity> [--at <RFC3339>] — lists temporal versions, or the point-in-time snapshot per modality; bad --at → clean error.

Docs + config

• README "Sidecar storage backends" section (storage/format + per-command backend matrix) + rustdoc throughout.
• examples/json-sidecar/ NDJSON example; blog-db notes the json option.
• Version 0.1.0 → 0.2.0; CHANGELOG.adoc [0.2.0] entry.
• ⚠️ The requested .claude/settings.json permission allowlist was blocked by the harness self-modification guardrail (an agent can't widen its own permissions). Left out — see the PR thread / my message; you can add it directly.

Verification

• 145 lib unit tests (incl. lock acquire/release, contention timeout, stale-steal) + integration tests, incl. a new end-to-end tests/sidecar_cli_test.rs that seeds via the locked write path (real hashes) and drives provenance/history through the built binary.
• cargo clippy --all-targets -- -D warnings and cargo fmt --check clean; MSRV-conservative (edition 2024 / 1.85).

Acceptance (#150)

• JSON writes guarded by a cross-process lock; crash-safe atomic rename.
• provenance/history work on sqlite + json (tests cover json end-to-end).
• Docs, example, version/CHANGELOG updated. (settings.json blocked — flagged.)
• fmt/clippy/test green at source.

https://claude.ai/code/session_01S2xDQQU5o85N3xTpeFUSfN

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 82 issues detected

Severity	Count
🔴 Critical	3
🟠 High	7
🟡 Medium	72

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-toolchain@stable needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action Swatinem/rust-cache@v2 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-toolchain@master needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action Swatinem/rust-cache@v2 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence