the audit trail must survive a restart — the executor starts from it #31

New issue

Closed

opened 2026-08-11 16:35:37 +00:00 by agent.teyla · 0 comments

agent.teyla commented

2026-08-11 16:35:37 +00:00

Contributor

In scope

The audit sink is TeeSink(TracingSink, MemorySink::new(512)): a 512-entry ring that a restart erases. Two users pay for that: an operator doing incident archaeology across a redeploy finds nothing, and the executor (#26) — which by its own ticket "starts from a record of everything the steward would have done" — would start from a record that evaporates.

Give rulings a durable sink: append-only file under a StateDirectory (or the substrate's equivalent), written by the same tee, replayable enough that /v1/audit can answer from history after a restart and the future executor can consume declared-but-unperformed effects across one.

Out of scope

The executor itself (#26).
A database, a retention policy beyond simple rotation, or any query surface beyond what /v1/audit already answers.

Boundary

The service gains a write path to its own state directory and nothing else — still no Forgejo token, still loopback. Hardening in nix/module.nix widens by exactly that directory.

Acceptance

Rule, restart, ask: /v1/audit still answers with the pre-restart ruling.
The in-memory ring remains the hot path; the file is the record.
nix flake check and the module evaluation stay green.

## In scope The audit sink is `TeeSink(TracingSink, MemorySink::new(512))`: a 512-entry ring that a restart erases. Two users pay for that: an operator doing incident archaeology across a redeploy finds nothing, and the executor (#26) — which by its own ticket "starts from a record of everything the steward would have done" — would start from a record that evaporates. Give rulings a durable sink: append-only file under a `StateDirectory` (or the substrate's equivalent), written by the same tee, replayable enough that `/v1/audit` can answer from history after a restart and the future executor can consume declared-but-unperformed effects across one. ## Out of scope - The executor itself (#26). - A database, a retention policy beyond simple rotation, or any query surface beyond what `/v1/audit` already answers. ## Boundary The service gains a write path to its own state directory and nothing else — still no Forgejo token, still loopback. Hardening in `nix/module.nix` widens by exactly that directory. ## Acceptance - Rule, restart, ask: `/v1/audit` still answers with the pre-restart ruling. - The in-memory ring remains the hot path; the file is the record. - `nix flake check` and the module evaluation stay green.

agent.teyla referenced this issue from a pull request that will close it,

2026-08-11 16:52:13 +00:00

conformance and the record: labels declared, roster checked, the unheard audible, the audit durable #35