test(integrations): guinea-pig port of cpex-ocsf-audit against the audit seam (cpex#166) - #456
Merged
Merged
Conversation
…dit seam (cpex#166) — clean Built and ran the plugin's full suite against cpex feat/audit-seam @ 386710a (post-hardening): cargo check --all-targets clean, 21/21 tests green, zero source changes needed. Records the lockfile resolution (cpex-core picks up futures + sha2 on the seam branch) and writes up scope, findings, and the remaining AuditHandler/DecisionLog port step in SEAM-PORT-RESULTS.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TKAGmGAp5ECmcjFuHei5q8
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…released Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TKAGmGAp5ECmcjFuHei5q8
Levaj2000
marked this pull request as ready for review
August 18, 2026 21:53
Levaj2000
added a commit
that referenced
this pull request
Aug 18, 2026
…ials off the cpex#166 seam (#457) Delivers the WS-A / P1 step the guinea-pig report (#456) left open. With no hooks: listed, the plugin auto-attaches as a cpex AuditHandler (same registration contract as the upstream audit-logger; hook-listed instances stay post-hook observers and never double-emit) and consumes the finalized DecisionLog at every pipeline verdict. Deny maps to action 2/Blocked with the violation surfaced at status_code/status_detail (plugin_panic stays distinguishable by code), allow-after-modification to Modified, plain allow to Allowed; ordered per-plugin steps (incl. deny_ignored, flagged flat, and aborted, distinct from error), span, entry taint, content hashes and the (epoch, stream_id, stream_seq, emission_seq) stamps ride under unmapped.cpex.* inside the hashed bytes, tamper-evident in the attestation chain. Non-CMF dispatches and zero-plugin invocations emit honest records. 11 new tests (32 total, green against seam head 386710a); on_effect lifecycle mapping tracked as follow-up. Claude-Session: https://claude.ai/code/session_01TKAGmGAp5ECmcjFuHei5q8 Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Delivers the guinea-pig commitment made on contextforge-org/cpex#166: build and run our OCSF audit plugin against the seam branch and report anything that doesn't match intent.
What this contains
integrations/cpex-ocsf-audit/SEAM-PORT-RESULTS.md— the port report:cargo check --all-targetsclean and 21/21 tests green against cpexfeat/audit-seam@386710a(post-hardening head, includeseda9821), rustc 1.96.1, with zero source changes to the plugin. Scope of what was and wasn't exercised is spelled out (theAuditHandler/DecisionLogsink port withDenyIgnored/Abortedmapping is the tracked next step, WS-A / P1).integrations/cpex-ocsf-audit/Cargo.lock— lockfile refresh recording the resolution used: cpex-core on the seam branch addsfutures(panic containment) andsha2(content provenance) as transitive deps.Why it matters
Confirms the seam PR's "all changes are opt-in" claim for a real out-of-tree consumer, and gives us verified results to post on the cpex#166 thread ahead of the Friday call.
🤖 Generated with Claude Code
https://claude.ai/code/session_01TKAGmGAp5ECmcjFuHei5q8
Generated by Claude Code