audit

Documentation

Overview

Package audit provides an append-only, in-enclave audit log.

Every claim and verify the loop performs emits one immutable line recording who/what/when plus a provenance flag marking machine-authored actions. The log is a local file only; nothing here makes a network call.

Index

• type Action
• type Entry
• type Log
  • func New(w io.Writer, actor string) *Log
  • func Open(path, actor string) (*Log, error)
  • func (l *Log) Close() error
  • func (l *Log) Record(e Entry) error

Types

type Action

type Action string

Action names the kind of event recorded.

const (
	ActionClaim    Action = "claim"
	ActionRelease  Action = "release"
	ActionVerify   Action = "verify"
	ActionEscalate Action = "escalate"
	ActionPark     Action = "park"
	ActionPropose  Action = "propose"
)

Recorded action kinds.

type Entry

type Entry struct {
	// Time is when the action occurred (UTC).
	Time time.Time `json:"time"`
	// Actor identifies who performed the action (e.g. "aegis-loop").
	Actor string `json:"actor"`
	// Action is the kind of event.
	Action Action `json:"action"`
	// RequirementID is the affected requirement, if any.
	RequirementID string `json:"requirement_id,omitempty"`
	// Result is a free-form outcome (e.g. "pass", "fail", "blocked").
	Result string `json:"result,omitempty"`
	// MachineAuthored flags actions authored by the machine rather than a human.
	MachineAuthored bool `json:"machine_authored"`
	// Detail is optional human-readable context.
	Detail string `json:"detail,omitempty"`
}

Entry is a single immutable audit record.

type Log

type Log struct {
	// contains filtered or unexported fields
}

Log is an append-only audit log backed by an io.Writer. It is safe for concurrent use.

func New

func New(w io.Writer, actor string) *Log

New returns a Log writing to w. The actor is stamped on every entry.

func Open

func Open(path, actor string) (*Log, error)

Open opens (creating if needed) an append-only log file at path.

func (*Log) Close

func (l *Log) Close() error

Close closes the underlying file if Log owns one.

func (*Log) Record

func (l *Log) Record(e Entry) error

Record appends one entry. Time and Actor are filled if unset.