Remove identifying labels with v4-only forensic audit uploads (#1779)

* Remove identifying labels with v4-only forensic audit uploads

* Address audit v4 review with rejection warnings and recorder validation

Author: erskingardner

Cargo.lock

@@ -36,6 +36,8 @@ license = "MIT"
 publish = false
 
 [workspace.dependencies]
+# Offline audit-schema validation; never enable remote reference resolution.
+jsonschema = { version = "0.56.0", default-features = false }
 # OpenMLS family — exact-pinned to the draft-10 last-resort KeyPackage fix.
 # Keep every companion crate on the same repository commit to prevent source skew.
 # Migration: once an upstream OpenMLS release contains this fix, replace all five

Cargo.toml

@@ -699,7 +699,7 @@ mod tests {
     use super::*;
 
     #[test]
-    fn group_state_change_kind_strings_match_v3_schema() {
+    fn group_state_change_kind_strings_match_v4_schema() {
         let member = MemberId::new(vec![0; 32]);
         let changes = [
             GroupStateChange::MemberAdded {
@@ -732,9 +732,9 @@ mod tests {
             .collect::<BTreeSet<_>>();
 
         let schema: serde_json::Value = serde_json::from_str(include_str!(
-            "../../marmot-forensics/schema/audit-log-event.v3.schema.json"
+            "../../marmot-forensics/schema/audit-log-event.v4.schema.json"
         ))
-        .expect("v3 schema parses");
+        .expect("v4 schema parses");
         let defined = schema
             .pointer("/$defs/groupStateChangeKind/enum")
             .and_then(serde_json::Value::as_array)

crates/cgka-engine/src/audit_helpers.rs

@@ -48,6 +48,10 @@ App runtime bridge for the first real Marmot app surfaces.
   the upload client, the per-account upload checkpoint (`audit-upload-checkpoint.json`), and the `MarmotApp` methods for
   audit settings, recorder open/build, file enumeration, path validation/resolution/removal, and HTTP upload. Audit-log
   unit tests live in its own `#[cfg(test)] mod tests`.
+- Record into distinct v4 files and upload only strictly validated v4 snapshots. Never migrate or send v1-v3
+  or key-reveal files. Reject removed/unknown fields and duplicate keys before HTTP; cache ineligible file verdicts
+  by size and mtime without retry cooldowns. Keep legacy files available locally for inspection/deletion.
+  Account/device names are forbidden in rows and headers; hardware model is system-sourced, never a label.
 - Keep audit uploads incremental (mdk#1181). An audit file whose size and mtime still match its checkpoint entry is
   never re-read or re-posted; only the growing active file re-transfers, bounded by the recorder's segment threshold.
   Checkpoint only complete immutable upload snapshots after successful upload.

crates/marmot-app/AGENTS.md

@@ -34,6 +34,7 @@ hex.workspace = true
 httpdate.workspace = true
 hkdf.workspace = true
 image.workspace = true
+jsonschema.workspace = true
 marmot-account.workspace = true
 marmot-forensics.workspace = true
 marmot-markdown.workspace = true