[audit][C007] Batched commitment appends omit their accumulated BLAKE3 cost

[QuantumExplorer]

Audit group: C007. Classification: correctness. Provisional severity: low.

CommitmentTree::append_many_raw accumulates bulk/final-root BLAKE3 work in a separate hash_count but does not add it to the enclosing OperationCost. Consumers of CostResult therefore miss that work even when the result field is populated. Frontier Sinsemilla costs and the separate hash_count remain available. The audited in-repository callers were tests and seeding/benchmark usage; production fee impact was not established.

Expected contract and correction: Transfer completed BLAKE3 work into the public OperationCost as it occurs, retain incurred costs on error, and preserve the separate result field. Coordinate historical/versioned adoption with downstream cost consumers.

Validation to complete

• Assert the public cost result includes the completed BLAKE3 count for bounded batches.
• Check empty and nonempty input semantics plus retained costs on ordinary errors.
• Keep final roots and Sinsemilla costs consistent with the existing batching contract.

Limits and existing work

• Do not equate batching with repeated eager root computation; legitimate deferred-work savings must remain.

Related tracking: PR #751 (merged), PR #825 (merged), PR #826 (merged).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_3d19e9856522a9073785e1ff

Primary fingerprint: codex-security/v1:sha256:55cee090939981b8387e9b6bd714ba833597805332d839bfeddd3e4f9ec35537

Canonical finding ID: csf_7a6438bf2697a27028337bf7

Primary fingerprint: codex-security/v1:sha256:3b40474a0ff186633b8b2adc713070b7003d7dc987742e110a7de921a5097374

Source locations:

• Location (entrypoint): grovedb-commitment-tree/src/commitment_tree/mod.rs:425-429
• Location (root_control): grovedb-commitment-tree/src/commitment_tree/mod.rs:466-484
• Location (propagation): grovedb-commitment-tree/src/commitment_tree/mod.rs:519-525
• Location (sink): grovedb-commitment-tree/src/commitment_tree/mod.rs:535-542
• Location (counterevidence): grovedb-commitment-tree/src/commitment_tree/mod.rs:329-331
• Location (entrypoint): grovedb-commitment-tree/src/commitment_tree/mod.rs:418-432
• Location (propagation): grovedb-commitment-tree/src/commitment_tree/mod.rs:479-489
• Location (root_control): grovedb-commitment-tree/src/commitment_tree/mod.rs:519-543