[kevinlewi]

Fixes an append-only bypass in the AKD auditor.

Problem

The auditor verifies an epoch transition by inserting a proof's unchanged_nodes, then its unchanged_nodes + inserted nodes, checking each against the start/end root hash. This relies on re-inserting an unchanged node being a no-op. But AzksElementSet::partition silently drops any node whose label is not strictly beneath the pivot, so an unchanged interior node whose label is a strict prefix of an inserted leaf has its committed value discarded.

A malicious server can exploit this to rewrite an existing label's value while still producing a valid append-only proof, defeating the auditor's append-only guarantee.

Fix

Enforce that no committed value is dropped during an InsertMode::Auditor batch insert, turning the silent drop into a verification error. The check is count-based (every input element must land in the left or right subtree), so it catches a drop regardless of label shape, with a narrow carve-out for the single element that legitimately becomes a leaf.

Scoped to InsertMode::Auditor; the directory publish path inserts full-length leaves only and is unaffected.

Tests

• test_auditor_rejects_prefix_collision_value_rewrite (auditor.rs) — reproduces the bypass end-to-end through audit_verify: both membership proofs verify against their respective roots with val1 != val2, and the transition must now be rejected.
• test_auditor_insert_rejects_dropped_nodes (append_only_zks.rs) — exercises the guard directly: strict-prefix collision, duplicate-label collision, plus a positive control confirming disjoint leaves still insert cleanly.

Both verified to fail without the guard and pass with it, under both whatsapp_v1 and experimental configurations. Full akd lib suite green (106 tests).

Reported by @sanjit-bhat

[codecov-commenter]

Codecov Report

❌ Patch coverage is 96.35036% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.44%. Comparing base (3ce5335) to head (685e2a7).
⚠️ Report is 38 commits behind head on main.

Files with missing lines	Patch %	Lines
akd/src/append_only_zks.rs	97.18%	2 Missing ⚠️
akd/src/errors.rs	0.00%	2 Missing ⚠️
akd/src/auditor.rs	98.43%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #495      +/-   ##
==========================================
+ Coverage   88.61%   89.44%   +0.82%     
==========================================
  Files          39       38       -1     
  Lines        9109     7579    -1530     
==========================================
- Hits         8072     6779    -1293     
+ Misses       1037      800     -237     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sanjit-bhat]

The updated logic makes sense to me, thanks for fixing this!