Surfaced by CodeRabbit on #48 (core/src/sync/audit.rs ~L81-92). Pre-existing — engine original vendor/.../sync/audit.rs:52-53 is the same to_writer + writeln! pair; ported unchanged (byte-pinned).
core/src/sources/sync.rs and sync/composio/periodic.rs can both append. Two write syscalls per entry means two appenders can interleave; read_audit_log then skips the malformed line and its cost data is lost. Note the engine's rebuild pipeline is a third writer with its own copy.
Fix: serialise entry + newline into one buffer, single write_all (O_APPEND makes a single write atomic for typical line sizes). Should land in both copies together — the line format is pinned by audit_line_format_is_pinned.
Surfaced by CodeRabbit on #48 (
core/src/sync/audit.rs~L81-92). Pre-existing — engine originalvendor/.../sync/audit.rs:52-53is the sameto_writer+writeln!pair; ported unchanged (byte-pinned).core/src/sources/sync.rsandsync/composio/periodic.rscan both append. Twowritesyscalls per entry means two appenders can interleave;read_audit_logthen skips the malformed line and its cost data is lost. Note the engine's rebuild pipeline is a third writer with its own copy.Fix: serialise entry + newline into one buffer, single
write_all(O_APPEND makes a single write atomic for typical line sizes). Should land in both copies together — the line format is pinned byaudit_line_format_is_pinned.