Skip to content

feat(auth): add durable audit and operator lifecycle - #4847

Draft
cea-block wants to merge 18 commits into
cea/o4-client-productionfrom
cea/o5-durable-audit-operator-lifecycle-4941806
Draft

feat(auth): add durable audit and operator lifecycle#4847
cea-block wants to merge 18 commits into
cea/o4-client-productionfrom
cea/o5-durable-audit-operator-lifecycle-4941806

Conversation

@cea-block

@cea-block cea-block commented Aug 5, 2026

Copy link
Copy Markdown

Why

Protected authorization decisions need atomic, durable evidence, and privileged binding changes need an authenticated lifecycle interface that remains absent from the stock relay unless a deployment explicitly composes it.

What

  • Add a transactional audit outbox and append-only decision queue with ordered delivery leases, bounded retry, backpressure, quarantine, dead-letter, and restoration handling
  • Route production authorization evaluations through durable decision acceptance so authorization does not proceed without accepted evidence
  • Add authenticated, capability-gated, idempotent list, preview, revoke, and rotate operations with single-use authority and approval evidence
  • Commit lifecycle changes, audit records, operation receipts, and invalidation atomically
  • Add migrations 0046 through 0050 and a synthetic OSS test environment for lifecycle and failure-injection scenarios

Review guide

  • Audit model: typed events, privacy-bounded identifiers, encoding, registry, outbox, queue, leases, and restoration
  • Decision acceptance: evidence delivery, duplicate handling, backpressure, quarantine, and deny behavior
  • Operator lifecycle: authentication, capability checks, approval evidence, idempotency, preview, revocation, rotation, tombstones, and atomic invalidation
  • Verification: PostgreSQL concurrency and rollback cases plus the repository-native OSS scenario suite

Risk assessment

Medium. This PR changes protected decision recording and adds migrations. The operator router is not registered by the stock relay, and this PR does not install a provider, activate routes, grant capabilities, configure an external audit sink, or add cross-channel continuity consumers.

Testing

  • PostgreSQL migration, atomicity, concurrency, serialization, compare-and-swap, replay, and rollback cases
  • Audit encoding, redaction, tamper, retry, backpressure, quarantine, dead-letter, and restoration cases
  • Operator authentication, approval, idempotency, preview, revocation, rotation, tombstone, and invalidation cases
  • Repository-native OSS authorization and lifecycle scenarios, formatting, linting, and hosted repository checks

References

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
(cherry picked from commit a5c28eaedb3616e74fc7604f00756d0cf896cd4b)
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant