[kvlonge]

Why

Publishing a project whose models attach the same inline audit, for example not_null on two models, failed with duplicate snapshot node identity. Inline audits compile to their definition name, so every attachment produced the same audit:<name> snapshot key. The default sqb playground project hits this, so it could not be published to a location.

Changes

• Audits attached to a target are now keyed by their execution identity, audit:<name>:<kind>:<target>[:<column>]. This is the same identity build progress and results already use. Singular audits keep audit:<name>.
• Identity change: an existing location's first republish shows each attached audit's old key as removed and its new key as added in that publication's change list. Nothing else stores audit node keys:
  • role grants and job selections resolve through the project graph, which has no audit nodes;
  • run history holds only graph nodes and check: keys;
  • audit results are keyed by audit name and binding key;
  • published snapshots are immutable and keep their keys.
• A remaining duplicate now names its key in the error, for example one column attaching the same unnamed audit twice. That case already failed before this change.
• A DuckShop orchestration edge case covers two models sharing inline and explicitly named audits.

Verification

• New integration test, through the installed CLI and a real server. It publishes the default playground and the DuckShop case, checks one audit node per attachment, and checks that an unchanged republish reports no changes.
• The test fails without the fix (duplicate snapshot node identity). The playground and the edge case also fail the same way with the 0.191.0 CLI.
• The snapshot, native audit, publication, project role and worker integration tests pass (129).
• make check-ci passes.