Molecule AI Backend Engineer 7584267a80 fix(security): address Security Auditor findings on audit-ledger (#651) ... - Replace == HMAC comparisons with hmac.compare_digest (Python) and hmac.Equal (Go) in ledger.py, verify.py, and audit.go to prevent timing oracle attacks (Fixes 1-6) - Increase PBKDF2 iterations from 100K to 210K in both ledger.py and audit.go — must match for cross-language verification (Fix 7) - Return chain_valid: null when offset > 0 (paginated views cannot verify a truncated chain; null means "not computed") (Fix 8) - Remove module-level AUDIT_LEDGER_SALT attribute from ledger.py; read the secret exclusively from os.environ inside _get_hmac_key() so the salt is not exposed in the module namespace (Fix 9) - Update tests: use monkeypatch.setenv/delenv instead of setattr on the removed AUDIT_LEDGER_SALT attribute; update testAuditKey helper to use 210K iterations; add TestAuditQuery_PaginatedOffsetReturnsNullChainValid - Fix migration 028: workspace_id column type TEXT → UUID to match workspaces.id UUID primary key All tests pass: 1043 pytest + 0 Go test failures. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-04-17 07:30:10 +00:00
..
__init__.py	feat: molecule-audit-ledger — HMAC-SHA256 immutable agent event log (#594)	2026-04-17 06:55:36 +00:00
hooks.py	feat: molecule-audit-ledger — HMAC-SHA256 immutable agent event log (#594)	2026-04-17 06:55:36 +00:00
ledger.py	fix(security): address Security Auditor findings on audit-ledger (#651)	2026-04-17 07:30:10 +00:00
verify.py	fix(security): address Security Auditor findings on audit-ledger (#651)	2026-04-17 07:30:10 +00:00