feat(integrations): decision-audit sink — cpex-ocsf-audit records denials off the cpex#166 seam - #457
Merged
Merged
Conversation
…ials off the cpex#166 seam Delivers the WS-A / P1 step the guinea-pig report (#456) left open. With no hooks: listed, the plugin auto-attaches as a cpex AuditHandler (same registration contract as the upstream audit-logger; hook-listed instances stay post-hook observers and never double-emit) and consumes the finalized DecisionLog at every pipeline verdict. Deny maps to action 2/Blocked with the violation surfaced at status_code/status_detail (plugin_panic stays distinguishable by code), allow-after-modification to Modified, plain allow to Allowed; ordered per-plugin steps (incl. deny_ignored, flagged flat, and aborted, distinct from error), span, entry taint, content hashes and the (epoch, stream_id, stream_seq, emission_seq) stamps ride under unmapped.cpex.* inside the hashed bytes, tamper-evident in the attestation chain. Non-CMF dispatches and zero-plugin invocations emit honest records. 11 new tests (32 total, green against seam head 386710a); on_effect lifecycle mapping tracked as follow-up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TKAGmGAp5ECmcjFuHei5q8
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Delivers the WS-A / P1 step the guinea-pig report (#456) left open: the OCSF audit plugin now consumes the first-class audit seam from contextforge-org/cpex#166 and records what the passive post-hook stream structurally never saw — denials, suppressed transform-denies, panics, and modifications.
What changed
factory.rs,emitter.rs): with nohooks:listed, the plugin auto-attaches as a cpexAuditHandlerviaPlugin::as_audit_handler— the same contract as the upstream audit-logger. Hook-listed instances stay legacy post-hook observers and deliberately do not also attach, so one invocation never emits twice. Emptyhooks:(previously a config error) is now the recommended sink mode; the factory logs which mode it inferred.ocsf.rs—build_event+apply_decision): verdict →security_control— Deny →action_id2 /dispositionBlocked with the violation surfaced atstatus_code/status_detail(a fail-closed panic arrives asplugin_panic, distinguishable by code); Allow-after-modification → 4 Modified; plain Allow → 1 Allowed.activity_*/type_uidare untouched — they describe the operation, the action describes the ruling.unmapped.cpex.*, inside the hashed bytes: ordered per-plugin steps in a stable snake_case vocabulary (incl.deny_ignored— flagged flat so "every suppressed deny" is one SIEM query — andaborted, distinct fromerror), invocation span (W3C ids), entry-taint labels, content input/output hashes, and the seam's(epoch, stream_id, stream_seq, emission_seq)completeness/ordering stamps. Chained records make all of it tamper-evident: a renumbered stream breaks the fingerprint chain (tested).activity_id0; zero-plugin invocations emit with an explicit empty steps array.Verification
feat/audit-seam@386710a(the post-hardening seam head), rustc 1.96.1;cargo check --all-targetsclean and theemit_sampleexample runs unchanged.SEAM-PORT-RESULTS.mdaddendum, lib.rs revision header, changelog.Follow-up (tracked)
AuditHandler::on_effect— effect-lifecycle events (token mints) want a richer OCSF class than API Activity 6003 (e.g. Authentication 3002); deliberately out of this PR.🤖 Generated with Claude Code
https://claude.ai/code/session_01TKAGmGAp5ECmcjFuHei5q8
Generated by Claude Code