foundation-audit-log

Immutable, append-only audit logging for compliance and security

Tier	foundation
Role	unclassified (baselined)
Path	`crates/foundation/audit-log`
Edition	2021
Targets	audit-attest, fleet-inventory-gen, foundation_audit_log, attest_cluster, attest_inventory, attest_pure, pg_attest, pg_consumer_convergence, pg_starter_seed, pg_worm_enforcement
Public items	213 across 21 modules
Tests	236

What it is for

# foundation-audit-log

Immutable, append-only audit logging for compliance and security.

Answers "Who did what, when, and where?" with permanent records.

Core Principle

Audit logs are NEVER updated or deleted. Once created, a log entry is permanent.

Example

use foundation_audit_log::{AuditLog, Sensitivity, actions};
use uuid::Uuid;

// Log a model operation
let log = AuditLog::builder()
.action(actions::UPDATE)
.actor(Uuid::new_v4(), "john@example.com")
.target("posts.Post", "123", "Post: Hello World")
.sensitivity(Sensitivity::Normal)
.build();

// Log a non-model event
let event = AuditLog::event(actions::LOGIN_FAILED)
.actor_display("unknown@example.com")
.sensitivity(Sensitivity::High)
.build();

Capabilities

`actions (other)`

Standard audit log action constants.

Item
`pub const CREATE: & str`
`pub const UPDATE: & str`
`pub const DELETE: & str`
`pub const VIEW: & str`
`pub const LOGIN: & str`
`pub const LOGOUT: & str`
`pub const LOGIN_FAILED: & str`
`pub const PASSWORD_CHANGED: & str`
`pub const SESSION_REVOKED: & str`
`pub const PASSWORD_RESET_REQUESTED: & str`
`pub const PERMISSION_DENIED: & str`
`pub const EXPORT: & str`
`pub const IMPORT: & str`
`pub const CORRECTION: & str`
`pub const ARCHIVE: & str`
`pub const RESTORE: & str`
`pub const APPROVE: & str`
`pub const REJECT: & str`
`pub const SUBMIT: & str`

`attest::auth (other)`

Authentication enforcement (Sprint 3.1, US-3.1.4).

Item
`pub const INVALID_PASSWORD_SQLSTATE: & str`
`pub const INVALID_AUTHORIZATION_SQLSTATE: & str`
`pub const INVALID_CATALOG_SQLSTATE: & str`
`pub const SENTINEL_PASSWORD: & str`
`fn auth_probe_dsn(dsn : & str) -> Option <String>`
`fn classify_audit_grants(role : & str, can_select : bool, can_insert : bool, can_update : bool, can_delete : bool,) -> CheckOutcome`
`fn classify_backup_currency(database : & str, age_hours : Option <u64>, window_hours : u64,) -> CheckOutcome`

`AuthProbeError`

Authentication enforcement (Sprint 3.1, US-3.1.4).

Item
`pub struct AuthProbeError`
`fn classify_auth_probe(result : Result <(), AuthProbeError>) -> CheckOutcome`

`attest::cluster (other)`

Cluster-level authentication posture (Sprint 3.1, US-3.1.1).

Item
`fn ipv4_mask_to_prefix(mask : & str) -> String`
`fn check_hba_auth_methods(rules : & HbaRule) -> ClusterOutcome`
`fn check_hba_exposure(rules : & HbaRule) -> ClusterOutcome`
`fn check_login_passwords(roles : & LoginRole) -> ClusterOutcome`

`ClusterCheckId`

Cluster-level authentication posture (Sprint 3.1, US-3.1.1).

Item
`pub enum ClusterCheckId`
`ClusterCheckId :: fn as_str(self) -> & 'static str`
`ClusterCheckId :: fn fmt(& self, f : & mut std::fmt::Formatter <'_>) -> std::fmt::Result`

`ClusterOutcome`

Cluster-level authentication posture (Sprint 3.1, US-3.1.1).

Item
`pub struct ClusterOutcome`
`fn check_transport_encryption(ssl_enabled : bool) -> ClusterOutcome`

`HbaRule`

Cluster-level authentication posture (Sprint 3.1, US-3.1.1).

Item
`pub struct HbaRule`

`LoginRole`

Cluster-level authentication posture (Sprint 3.1, US-3.1.1).

Item
`pub struct LoginRole`

`attest::db (other)`

The SQL shell: catalog inspection + the destructive-probe harness.

Item
`async fn attest_cluster(admin_url : & str,) -> Result <Vec <super::cluster::ClusterOutcome>, sqlx::Error>`
`async fn check_endpoint(c : & mut PgConnection) -> CheckOutcome`
`async fn check_topology(c : & mut PgConnection) -> CheckOutcome`
`async fn check_no_rules(c : & mut PgConnection) -> CheckOutcome`
`async fn check_triggers(c : & mut PgConnection) -> CheckOutcome`
`async fn check_truncate_guard_catalog(c : & mut PgConnection) -> CheckOutcome`
`async fn check_event_guards(c : & mut PgConnection) -> CheckOutcome`
`async fn check_ownership(c : & mut PgConnection, runtime_role : & str) -> CheckOutcome`
`async fn check_force_rls(c : & mut PgConnection) -> CheckOutcome`
`async fn check_row_hash(c : & mut PgConnection, statement_timeout_ms : u32) -> Vec <CheckOutcome>`
`async fn observe_invariant(c : & mut PgConnection) -> Result <InvariantRecord, sqlx::Error>`
`async fn check_fingerprint(c : & mut PgConnection, expected : Option <& str>) -> CheckOutcome`

`AttestConfig`

The SQL shell: catalog inspection + the destructive-probe harness.

Item
`pub struct AttestConfig`
`AttestConfig :: fn new(inspect_url : impl Into <String>, runtime_role : impl Into <String>) -> Self`
`async fn probe_once(rt : & mut PgConnection, cfg : & AttestConfig, kind : ProbeKind, sql : & str,) -> CheckOutcome`
`async fn attest(cfg : & AttestConfig) -> Result <Evidence, sqlx::Error>`

`attest::evidence (other)`

The per-database evidence record, and DSN redaction.

Item
`fn redact_dsn(dsn : & str) -> String`
`fn dsn_identity(dsn : & str) -> String`

`Evidence`

The per-database evidence record, and DSN redaction.

Item
`pub struct Evidence`
`Evidence :: fn new(dsn : & str, runtime_role : & str, checks : Vec <CheckOutcome>) -> Self`
`Evidence :: fn with_fingerprints(mut self, expected : String, observed : String) -> Self`

`attest::fingerprint (other)`

Deployed-invariant fingerprinting.

Item
`fn normalize_definition(src : & str) -> String`
`fn is_definition_key(key : & str) -> bool`
`pub const CANONICAL_FINGERPRINT: & str`

`InvariantRecord`

Deployed-invariant fingerprinting.

Item
`pub struct InvariantRecord`
`InvariantRecord :: fn new() -> Self`
`InvariantRecord :: fn put(& mut self, key : impl Into <String>, value : impl AsRef <str>)`
`InvariantRecord :: fn get(& self, key : & str) -> Option <& str>`
`InvariantRecord :: fn len(& self) -> usize`
`InvariantRecord :: fn is_empty(& self) -> bool`
`InvariantRecord :: fn iter(& self) -> impl Iterator <Item =(& str, & str)>`
`InvariantRecord :: fn drifted_keys(& self, other : & Self) -> Vec <String>`
`InvariantRecord :: fn definitions(& self) -> Self`
`fn fingerprint(record : & InvariantRecord) -> String`

`EphemeralRule`

The fleet inventory — the scope declaration for an attestation run.

Item
`pub struct EphemeralRule`

`Inventory`

The fleet inventory — the scope declaration for an attestation run.

Item
`pub struct Inventory`
`Inventory :: fn len(& self) -> usize`
`Inventory :: fn is_empty(& self) -> bool`
`Inventory :: fn get(& self, name : & str) -> Option <& InventoryEntry>`
`Inventory :: fn names(& self) -> impl Iterator <Item = & str>`
`Inventory :: fn entries(& self) -> impl Iterator <Item = & InventoryEntry>`
`Inventory :: fn is_ephemeral(& self, name : & str) -> bool`
`Inventory :: fn undeclared <'a>(& self, live : & 'a String) -> Vec <& 'a String>`
`fn parse_inventory(src : & str) -> Result <Inventory, InventoryError>`

`InventoryEntry`

The fleet inventory — the scope declaration for an attestation run.

Item
`pub struct InventoryEntry`
`InventoryEntry :: fn scope_state(& self) -> ScopeState`

`InventoryError`

The fleet inventory — the scope declaration for an attestation run.

Item
`pub enum InventoryError`
`InventoryError :: fn fmt(& self, f : & mut std::fmt::Formatter <'_>) -> std::fmt::Result`

`attest::probe (other)`

Destructive-probe classification — the attestor's sharpest edge.

Item
`pub const WORM_SQLSTATE: & str`
`fn classify_probe(kind : ProbeKind, result : Result <(), ProbeError>) -> CheckOutcome`

`ProbeError`

Destructive-probe classification — the attestor's sharpest edge.

Item
`pub struct ProbeError`

`ProbeKind`

Destructive-probe classification — the attestor's sharpest edge.

Item
`pub enum ProbeKind`
`ProbeKind :: fn check_id(self) -> CheckId`
`ProbeKind :: fn as_str(self) -> & 'static str`

`FleetReport`

Fleet roll-up: SOURCE COMPLETE is not DEPLOYED COMPLETE.

Item
`pub struct FleetReport`
`FleetReport :: fn new() -> Self`
`FleetReport :: fn record(& mut self, database : impl Into <String>, state : ScopeState)`
`FleetReport :: fn passing(& self) -> usize`
`FleetReport :: fn failing(& self) -> usize`
`FleetReport :: fn not_certified(& self) -> usize`
`FleetReport :: fn len(& self) -> usize`
`FleetReport :: fn is_empty(& self) -> bool`
`FleetReport :: fn verdict(& self) -> CheckStatus`
`FleetReport :: fn render_markdown(& self) -> String`

`ScopeState`

Fleet roll-up: SOURCE COMPLETE is not DEPLOYED COMPLETE.

Item
`pub enum ScopeState`
`ScopeState :: fn status(self) -> Option <CheckStatus>`
`ScopeState :: fn label(self) -> String`

`attest::status (other)`

Check identity, evidence status, and the fail-closed roll-up.

Item
`fn roll_up(checks : & CheckOutcome) -> CheckStatus`

`CheckId`

Check identity, evidence status, and the fail-closed roll-up.

Item
`pub enum CheckId`
`CheckId :: fn as_str(self) -> & 'static str`
`CheckId :: fn fmt(& self, f : & mut std::fmt::Formatter <'_>) -> std::fmt::Result`

`CheckOutcome`

Check identity, evidence status, and the fail-closed roll-up.

Item
`pub struct CheckOutcome`
`CheckOutcome :: fn new(id : CheckId, status : CheckStatus, detail : impl Into <String>) -> Self`