#535: stop auditing ensure-mkdirs that hit already-exists (v0.6.193) #544

Merged

Cordy merged 4 commits from fix-535 into main

2026-09-14 13:33:51 +00:00

Cordy commented

2026-09-14 13:32:41 +00:00

Owner

Root cause of the "mkdir log dump on login": the home-directory ensure (#146) and scope's per-prefix ensureReal re-run best-effort once per process — so on the first sign-in after every restart/version bump they Mkdir the whole existing tree, and audit.Driver.Mkdir recorded every attempt as mkdir — denied · already exists (the two actor-less rows were the home-ensure hook, which runs on context.Background()).

Fix: audit.Driver.Mkdir skips the event when the error is storage.ErrAlreadyExists — a directory that was already there is neither an action nor a denial, in the same spirit as the deliberately-unaudited List/Stat. Real failures (read-only, holds, backend errors) and successful creates still land.

TDD: red witnessed on the runner (flooded events), green with the full suite. CHANGELOG v0.6.193.

Root cause of the "mkdir log dump on login": the home-directory ensure (#146) and scope's per-prefix `ensureReal` re-run best-effort once per process — so on the first sign-in after every restart/version bump they Mkdir the whole existing tree, and `audit.Driver.Mkdir` recorded every attempt as `mkdir — denied · already exists` (the two actor-less rows were the home-ensure hook, which runs on `context.Background()`). Fix: `audit.Driver.Mkdir` skips the event when the error is `storage.ErrAlreadyExists` — a directory that was already there is neither an action nor a denial, in the same spirit as the deliberately-unaudited List/Stat. Real failures (read-only, holds, backend errors) and successful creates still land. TDD: red witnessed on the runner (flooded events), green with the full suite. CHANGELOG v0.6.193.

Cordy added 4 commits

2026-09-14 13:32:42 +00:00

one-shot: #535 red - already-exists mkdir floods the audit log a00b466e41

test(#535 ): already-exists mkdir must not be audited (red) 25d5e51efe

Witnessed failing on the runner: audit.Driver.Mkdir records every
attempt, so the once-per-process home/space ensures dump a page of
'mkdir denied - already exists' into the audit record on the first
login after every deploy.

one-shot: #535 green - skip already-exists mkdir events (v0.6.193) f78333bfe3

fix(#535 ): stop auditing ensure-mkdirs that hit already-exists

ci / test-and-build (pull_request) Successful in 56s

Details

7dadf07250

audit.Driver.Mkdir recorded every attempt, so the once-per-process
home and space-prefix ensures flooded the audit record with
'mkdir denied - already exists' on the first login after every
deploy. An existing directory is neither an action nor a denial;
real failures and real creates still land. CHANGELOG v0.6.193.

Cordy scheduled this pull request to auto merge when all checks succeed

2026-09-14 13:32:49 +00:00