#433: audit verb registry — one source of truth, a self-growing dropdown #441

Cordy · 2026-09-06T05:03:29Z

Cordy commented

2026-09-06 05:03:29 +00:00

Closes #433. Built to the researched design (GitLab's audit-event-type registry + Keycloak's serverinfo-fed filter, with build-time enforcement neither has).

audit.Verbs — canonical, append-only vocabulary: 52 verbs in 9 groups (files, trash, locks, shares, spaces, legal holds, encryption, peering, seats & licence). Replaces the prose comment as the source of truth.
Scanner tripwire (verbs_test.go, witnessed compile-red): walks the repo, fails the build when any emitted verb — literal Action: fields plus the known dynamic families — is unregistered, or when an Action is built from an unexempted non-literal. It caught real drift twice during its own build: the peering runtime family (peer-auth/send/deliver/…), then auto-purge and key-drain wired in main.go — all absent from the manual inventory (and my own scout). The "auto-purge is never emitted" theory from the research phase was wrong; the scanner corrected it.
Server-fed dropdown: Info() carries the registry through the existing /api/v1/admin/audit/info; the query page builds grouped optgroups from it (9 i18n group labels ×4 locales). The hardcoded seven-option list is gone; the dropdown is version-correct by construction and preserves the current selection across refills.

CHANGELOG v0.6.135.

Closes #433. Built to the researched design (GitLab's audit-event-type registry + Keycloak's serverinfo-fed filter, with build-time enforcement neither has). - **`audit.Verbs`** — canonical, append-only vocabulary: 52 verbs in 9 groups (files, trash, locks, shares, spaces, legal holds, encryption, peering, seats & licence). Replaces the prose comment as the source of truth. - **Scanner tripwire** (`verbs_test.go`, witnessed compile-red): walks the repo, fails the build when any emitted verb — literal `Action:` fields plus the known dynamic families — is unregistered, or when an Action is built from an unexempted non-literal. **It caught real drift twice during its own build**: the peering runtime family (`peer-auth/send/deliver/…`), then `auto-purge` and `key-drain` wired in main.go — all absent from the manual inventory (and my own scout). The "auto-purge is never emitted" theory from the research phase was wrong; the scanner corrected it. - **Server-fed dropdown**: `Info()` carries the registry through the existing `/api/v1/admin/audit/info`; the query page builds grouped optgroups from it (9 i18n group labels ×4 locales). The hardcoded seven-option list is gone; the dropdown is version-correct by construction and preserves the current selection across refills. CHANGELOG v0.6.135.

Cordy added 8 commits

2026-09-06 05:03:32 +00:00

#433 red: the verb-registry tripwire c37047ae9a

Compile-red against main: Verbs and VerbInfo do not exist yet. The
scanner walks the repo's Go source and fails when any emitted audit verb
- literal Action fields and the known dynamic verb families - is not in
the registry, and when an Action is built from a non-literal outside the
exemption list. This is what makes the vocabulary self-growing: a new
verb cannot ship without the dropdown learning it (GitLab's registry +
Keycloak's serve-from-server, enforced at build time).

#433 one-shot: verbs registry + Info feed + grouped dropdown (red then green) ce90050b40

#433 one-shot fix: post-conditions (fillAuditVerbs 3; auto-purge scoped to the option tag) 9860fb0880

#433 one-shot fix: AUD_GRP_KEYS post-condition is 3 (def + two uses on the label line) 2a648e0579

#433 red, refined by its own first catch: peering-runtime family + main.go wiring exemption a3fc6b1aa2

The scanner's first run caught what the manual scout missed: the four
Audit callbacks wired in cmd/cairnd/main.go carry the peering package's
runtime verbs (peer-auth, peer-send, peer-deliver families). Add the
.audit(" carrier so those literals are scanned at source, and exempt the
main.go plumbing that forwards them.

#433 one-shot: register the peering-runtime family the scanner caught (42 verbs) 22082133a9

#433 one-shot: register the scanner's second catch (auto-purge, key-drain, service peer-*) — 52 verbs, 9 groups 2c64c9c893

#433 : audit verb registry - one source of truth, a self-growing dropdown

ci / test-and-build (pull_request) Successful in 42s

Details

faac44ab0a

audit.Verbs is the canonical, append-only action vocabulary (52 verbs in 9 groups). The scanner test walks the repo and fails the build when an emitted verb - literal Action fields plus the known dynamic families (admin peering, runtime peer-* helpers, driver file ops, lock break, space lifecycle) - is not registered, or when an Action is built from an unexempted non-literal. It proved itself during its own build: two red runs surfaced the peer-* runtime family, auto-purge and key-drain, all missing from the manual inventory. Info() serves the registry through /api/v1/admin/audit/info; the query page builds grouped optgroups from it (9 i18n group labels x4) instead of the hardcoded seven-option list.

TDD: registry scanner witnessed compile-red on the runner; all green after splice.

Cordy merged commit eab514b1d2 into main

2026-09-06 05:05:37 +00:00

Cordy referenced this pull request from a commit

2026-09-06 05:05:40 +00:00

Merge pull request '#433: audit verb registry — one source of truth, a self-growing dropdown' (#441) from audit-verbs-433 into main

Cordy deleted branch audit-verbs-433

2026-09-06 05:05:41 +00:00

Cordy referenced this pull request

2026-09-06 05:13:35 +00:00

Audit query: Action filter dropdown is a stale hardcoded list (missing seat-release and friends) #433

Sign in to join this conversation.

No reviewers