didericis/bot-bottle

PRD: canonical tamper-evident audit-event schema (#487) #504

Open

didericis-codex wants to merge 6 commits from didericis/prd-audit-event-schema into main

Author	SHA1	Message	Date
didericis-codex	016e59e029	docs(prd): tighten audit ordering and chain guarantees prd-number-check / require-numbered-prds (pull_request) Failing after 12s Details tracker-policy-pr / check-pr (pull_request) Successful in 15s Details	2026-07-26 17:44:41 +00:00
didericis-claude	f3664dea9f	docs(prd): drop policy_version (manifest is the policy); add engine field prd-number-check / require-numbered-prds (pull_request) Failing after 6s Details tracker-policy-pr / check-pr (pull_request) Successful in 5s Details Per review: bot-bottle has no separate policy artifact — a bottled agent's egress routes etc. are declared in its manifest (manifest/egress.py), so manifest_digest already pins the policy in force. Remove the redundant policy_version. Given a fixed manifest, the only other axis that changes an outcome is the enforcing code, so add 'engine' (bot-bottle version + git SHA) as a trusted field. Runtime operator overrides (supervise egress-allow) are themselves audit events, so effective policy = manifest_digest + logged deltas, reconstructable from the chain. Note the build must stamp the git SHA (only version=0.1.0 exists today). Refs #487 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 08:28:10 +00:00
didericis-claude	88b82a169e	docs(prd): complete audit-event contract to #487 acceptance checklist prd-number-check / require-numbered-prds (pull_request) Failing after 10s Details tracker-policy-pr / check-pr (pull_request) Successful in 11s Details Expand the PRD from a schema sketch to the full contract the issue mandates (issue is spec-only: 'defines the contract; implementation may be split into follow-up PRs'): - Envelope: add observed vs event timestamps, bottle/activation ids, manifest_digest + policy_version, actor/action/resource/outcome, correlation_id/causation_id, sensitivity class, typed payload, segment id. - Add a per-field trust-provenance table (trusted vs claimed for every common field); per-type trusted/claimed in the registry. - Canonicalization: normative, reproducible hash-chain test vectors; idempotency (id key, UPSERT), ordering guarantees, and behavior across rotation/restart/import/truncation (truncated-tail vs gap). - Storage: indexable fields + local audit query/verify/rebuild/import CLI. - Registry: cover all mandated groups incl hostctl., egress request/decision/cutoff/anomaly, commit.signed (#480), auth/authz, and audit. self-events; schema-evolution + backward-compatible reader rules. - Export: #324 delivery contract (payload, (epoch,seq) cursor, dedup, backpressure, retention ordering); #480 mapping preserving its byte-to-activation-key guarantee. - No raw prompt/response/body capture by default. - Add an acceptance-criteria coverage table mapping each #487 checkbox to a section. Refs #487 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 08:08:22 +00:00
didericis-claude	5a9428cc86	docs(prd): flatten to one untrusted region + address CloudEvents/OTel export prd-number-check / require-numbered-prds (pull_request) Failing after 7s Details tracker-policy-pr / check-pr (pull_request) Successful in 19s Details - Remove the trusted sub-block: everything outside untrusted (chain metadata, producer/host, bottled_agent, ts_) is trusted by construction. A field is trusted unless deliberately placed under untrusted (#495). - Add Export/interoperability section: the flattened envelope projects cleanly onto CloudEvents JSON (top-level scalars -> context/extension attributes, untrusted -> data) and the OpenTelemetry Logs data model (ts_wall -> Timestamp, trusted -> botbottle. attributes, untrusted -> botbottle.untrusted.*). Attribution preserved structurally; integrity fields carried as data with verification always on the native journal. Satisfies #487's export/interop requirement. Export adapters = chunk 6. Refs #487 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 07:45:58 +00:00
didericis-claude	60039f2eb3	docs(prd): address review #495 on audit-event schema prd-number-check / require-numbered-prds (pull_request) Failing after 7s Details tracker-policy-pr / check-pr (pull_request) Successful in 8s Details - Move ts_wall/ts_mono and producer inside the trusted block (host-supplied). - Rename subject to bottled_agent everywhere (field + lifecycle.bottled_agent_* leaves). - Add explicit epoch (writer-boot) counter + chain-head carry for ordering across host-controller restarts. - Commit to a single writer per host (host controller owns it). - Reuse egress dlp_detectors (scan_token_patterns/redact_tokens) for redaction; exclude scan_entropy as brittle on structured audit values. - Retention: carry rotated-out chain head as new segment genesis prev. - Fold resolved points into design; trim open questions. Refs #487 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 07:35:16 +00:00
didericis-claude	bc42836327	docs(prd): canonical tamper-evident audit-event schema (#487 ) prd-number-check / require-numbered-prds (pull_request) Failing after 8s Details tracker-policy-pr / check-pr (pull_request) Successful in 6s Details Draft PRD for a unified, versioned audit-event envelope with a trusted/untrusted field split, canonical JSON + per-writer hash chain, an append-only JSONL journal as source of truth, a rebuildable SQLite index for local query, and an initial event registry. Scheduled to land immediately after the host controller (#468), which becomes its first producer. Refs #487 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 07:12:40 +00:00