Expand the PRD from a schema sketch to the full contract the issue mandates
(issue is spec-only: 'defines the contract; implementation may be split
into follow-up PRs'):
- Envelope: add observed vs event timestamps, bottle/activation ids,
manifest_digest + policy_version, actor/action/resource/outcome,
correlation_id/causation_id, sensitivity class, typed payload, segment id.
- Add a per-field trust-provenance table (trusted vs claimed for every
common field); per-type trusted/claimed in the registry.
- Canonicalization: normative, reproducible hash-chain test vectors;
idempotency (id key, UPSERT), ordering guarantees, and behavior across
rotation/restart/import/truncation (truncated-tail vs gap).
- Storage: indexable fields + local audit query/verify/rebuild/import CLI.
- Registry: cover all mandated groups incl hostctl.*, egress
request/decision/cutoff/anomaly, commit.signed (#480), auth/authz, and
audit.* self-events; schema-evolution + backward-compatible reader rules.
- Export: #324 delivery contract (payload, (epoch,seq) cursor, dedup,
backpressure, retention ordering); #480 mapping preserving its
byte-to-activation-key guarantee.
- No raw prompt/response/body capture by default.
- Add an acceptance-criteria coverage table mapping each #487 checkbox to a
section.
Refs #487
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Remove the trusted sub-block: everything outside untrusted (chain
metadata, producer/host, bottled_agent, ts_*) is trusted by construction.
A field is trusted unless deliberately placed under untrusted (#495).
- Add Export/interoperability section: the flattened envelope projects
cleanly onto CloudEvents JSON (top-level scalars -> context/extension
attributes, untrusted -> data) and the OpenTelemetry Logs data model
(ts_wall -> Timestamp, trusted -> botbottle.* attributes, untrusted ->
botbottle.untrusted.*). Attribution preserved structurally; integrity
fields carried as data with verification always on the native journal.
Satisfies #487's export/interop requirement. Export adapters = chunk 6.
Refs #487
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Move ts_wall/ts_mono and producer inside the trusted block (host-supplied).
- Rename subject to bottled_agent everywhere (field + lifecycle.bottled_agent_* leaves).
- Add explicit epoch (writer-boot) counter + chain-head carry for ordering across host-controller restarts.
- Commit to a single writer per host (host controller owns it).
- Reuse egress dlp_detectors (scan_token_patterns/redact_tokens) for redaction; exclude scan_entropy as brittle on structured audit values.
- Retention: carry rotated-out chain head as new segment genesis prev.
- Fold resolved points into design; trim open questions.
Refs #487
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Draft PRD for a unified, versioned audit-event envelope with a
trusted/untrusted field split, canonical JSON + per-writer hash chain,
an append-only JSONL journal as source of truth, a rebuildable SQLite
index for local query, and an initial event registry. Scheduled to land
immediately after the host controller (#468), which becomes its first
producer.
Refs #487
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
didericis-claude