fix(chain): compute Merkle hash on gate decision entries; fix verifyChain timestamp handling (Spike B)

Two pre-existing bugs found and fixed during Spike B end-to-end validation:

1. Gate decision entries (written by messages.go before calling the Anthropic API) were
   appended without PrevHash or Hash set. computeEntryHash() now links and hashes them
   before Append, making the full chain verifiable including denied calls.

2. verifyChain() and lastHash() type-asserted ChainEntry.Timestamp as time.Time, which
   silently fails after JSONL read-back (JSON unmarshal produces string, not time.Time).
   timestampString() now normalises both cases; hash computation is consistent across
   the in-memory and JSONL paths.

Adds spike_b_test.go (build tag: integration): end-to-end test that validates DENY path,
explicit Audit() call, and writ.Verify() against /tmp/writ-chain.jsonl.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: OpsKern

chain.go

@@ -184,26 +184,64 @@ func lastHash(store AuditStore) (string, error) {
 	}
 	internalEntries := make([]inaudit.Entry, len(entries))
 	for i, e := range entries {
-		ts := ""
-		if t, ok := e.Timestamp.(time.Time); ok {
-			ts = t.Format(time.RFC3339Nano)
-		}
 		internalEntries[i] = inaudit.Entry{
 			Hash:      e.Hash,
-			Timestamp: ts,
+			Timestamp: timestampString(e.Timestamp),
 		}
 	}
 	return inaudit.PrevHashFor(internalEntries), nil
 }
 
+// timestampString normalises a ChainEntry.Timestamp (interface{}) to the RFC3339Nano
+// string used in Merkle hash computation. Handles both time.Time (in-memory path) and
+// string (JSONL read-back path).
+func timestampString(v interface{}) string {
+	switch t := v.(type) {
+	case time.Time:
+		return t.Format(time.RFC3339Nano)
+	case string:
+		return t
+	default:
+		return ""
+	}
+}
+
+// computeEntryHash sets PrevHash to the last chain hash and computes the Merkle
+// hash for entry. Must be called on gate decision entries before Append, since
+// those are constructed without hash fields by the gate evaluator.
+func computeEntryHash(store AuditStore, entry ChainEntry) (ChainEntry, error) {
+	prevHash, err := lastHash(store)
+	if err != nil {
+		return ChainEntry{}, fmt.Errorf("read prev hash: %w", err)
+	}
+	entry.PrevHash = prevHash
+
+	internal := inaudit.Entry{
+		PrevHash:     entry.PrevHash,
+		EventType:    entry.EventType,
+		ActionType:   entry.ActionType,
+		Actor:        entry.Actor,
+		CallerID:     entry.CallerID,
+		InputHash:    entry.InputHash,
+		OutputHash:   entry.OutputHash,
+		Result:       entry.Result,
+		HookdTraceID: entry.HookdTraceID,
+		Allowed:      entry.Allowed,
+		DenialReason: entry.DenialReason,
+		Timestamp:    timestampString(entry.Timestamp),
+	}
+	hash, err := inaudit.ComputeHash(internal)
+	if err != nil {
+		return ChainEntry{}, fmt.Errorf("compute entry hash: %w", err)
+	}
+	entry.Hash = hash
+	return entry, nil
+}
+
 // verifyChain is the internal entry point for Verify().
 func verifyChain(entries []ChainEntry) error {
 	internalEntries := make([]inaudit.Entry, len(entries))
 	for i, e := range entries {
-		ts := ""
-		if t, ok := e.Timestamp.(time.Time); ok {
-			ts = t.Format(time.RFC3339Nano)
-		}
 		internalEntries[i] = inaudit.Entry{
 			ID:           e.ID,
 			PrevHash:     e.PrevHash,
@@ -218,7 +256,7 @@ func verifyChain(entries []ChainEntry) error {
 			HookdTraceID: e.HookdTraceID,
 			Allowed:      e.Allowed,
 			DenialReason: e.DenialReason,
-			Timestamp:    ts,
+			Timestamp:    timestampString(e.Timestamp),
 		}
 	}
 	return inaudit.Verify(internalEntries)

messages.go

@@ -24,6 +24,10 @@ func (s *MessagesService) New(ctx context.Context, params anthropic.MessageNewPa
 	}
 
 	entry.Timestamp = time.Now().UTC()
+	entry, err = computeEntryHash(s.wc.chain, entry)
+	if err != nil {
+		return nil, fmt.Errorf("writ: hash pre-call audit entry: %w", err)
+	}
 	if err := s.wc.chain.Append(entry); err != nil {
 		return nil, fmt.Errorf("writ: write pre-call audit entry: %w", err)
 	}
@@ -58,6 +62,10 @@ func (s *MessagesService) NewStreaming(ctx context.Context, params anthropic.Mes
 
 	entry.EventType = "llm_call_streaming_started"
 	entry.Timestamp = time.Now().UTC()
+	entry, err = computeEntryHash(s.wc.chain, entry)
+	if err != nil {
+		return nil, fmt.Errorf("writ: hash streaming-started audit entry: %w", err)
+	}
 	if err := s.wc.chain.Append(entry); err != nil {
 		return nil, fmt.Errorf("writ: write streaming-started audit entry: %w", err)
 	}

spike_b_test.go

@@ -0,0 +1,77 @@
+//go:build integration
+
+package writ_test
+
+// TestSpikeB_EndToEnd is the Spike B acceptance test (writ-v0-spikes-2026-05-05.md).
+// It validates writ.New() ergonomics end-to-end without an Anthropic API key:
+//
+//   - HARD_BLOCK: deny-all policy → DenialError returned, no Anthropic API call,
+//     pre-call audit entry written with Merkle link intact.
+//   - Explicit audit: writ.Audit() writes a tool_use entry to the same chain.
+//   - Verification: writ.Verify confirms all Merkle hash links are intact.
+//
+// Produces /tmp/writ-chain.jsonl as a side effect for acceptance-criteria checks.
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/anthropics/anthropic-sdk-go"
+	"github.com/opskernel-io/writ"
+)
+
+func TestSpikeB_EndToEnd(t *testing.T) {
+	policyDir := t.TempDir()
+	const denyPolicy = `package writ.gate
+import rego.v1
+default allow := false
+default tier := 0
+default denial_reason := "spike-b deny test"`
+	if err := os.WriteFile(filepath.Join(policyDir, "deny_all.rego"), []byte(denyPolicy), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	chainPath := "/tmp/writ-chain.jsonl"
+	_ = os.Remove(chainPath)
+
+	c, err := writ.New(writ.Config{
+		PolicyPath: policyDir,
+		AuditPath:  chainPath,
+		CallerID:   "spike-b-test",
+	})
+	if err != nil {
+		t.Fatalf("writ.New: %v", err)
+	}
+
+	// HARD_BLOCK: deny policy → DenialError, Messages.New makes no Anthropic API call.
+	_, callErr := c.Messages.New(context.Background(), anthropic.MessageNewParams{})
+	if callErr == nil {
+		t.Fatal("want DenialError from deny policy, got nil")
+	}
+	var denialErr *writ.DenialError
+	if !errors.As(callErr, &denialErr) {
+		t.Fatalf("want *writ.DenialError, got %T: %v", callErr, callErr)
+	}
+	t.Logf("HARD_BLOCK ok: reason=%q audit_id=%s", denialErr.Reason, denialErr.AuditID)
+
+	// Explicit audit: tool_use event written via writ.Audit().
+	if err := c.Audit(writ.AuditEvent{
+		EventType:  "tool_use",
+		ActionType: "read_file",
+		InputHash:  "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+		Result:     "success",
+		Timestamp:  time.Now().UTC(),
+	}); err != nil {
+		t.Fatalf("writ.Audit: %v", err)
+	}
+
+	// Chain verification: all Merkle hash links must be intact.
+	if err := writ.Verify(chainPath); err != nil {
+		t.Fatalf("writ.Verify: %v", err)
+	}
+	t.Logf("chain at %s verified OK", chainPath)
+}