audit-core/pyproject.toml

[project]
name = "audit-core"
version = "0.1.0"
description = "Standalone audit fabric interfaces and development backends."
readme = "README.md"
requires-python = ">=3.11"
license = { file = "LICENSE" }
authors = [
  { name = "NetKingdom / Audit Core maintainers" }
]

[project.optional-dependencies]
dev = ["pytest"]
# Production serving. Without this the entrypoint falls back to a threaded
# wsgiref server, which is bounded but not a production server (AUDIT-WP-0004-T06).
serve = ["waitress>=3.0"]
# Production custody (AUDIT-WP-0005). SQLite remains the development backend.
postgres = ["psycopg[binary,pool]>=3.2"]

[project.scripts]
audit-core-ingest = "audit_core.ingestion:main"

[tool.pytest.ini_options]
testpaths = ["tests"]
Add mock file audit backend 2026-06-01 23:44:03 +02:00			`[project]`
			`name = "audit-core"`
			`version = "0.1.0"`
			`description = "Standalone audit fabric interfaces and development backends."`
			`readme = "README.md"`
			`requires-python = ">=3.11"`
			`license = { file = "LICENSE" }`
			`authors = [`
			`{ name = "NetKingdom / Audit Core maintainers" }`
			`]`

			`[project.optional-dependencies]`
			`dev = ["pytest"]`
Bind sender identities, add operator read surface, real serving layer AUDIT-WP-0004 T03, T05, T06. T03 - the receiver accepted whatever tenant and source a caller sent as long as it held the one shared token, despite WP-0003 recording tenant isolation as delivered. audit_core.senders binds each credential to the sources and tenants it may assert, driven by AUDIT_CORE_SENDERS rather than literals. Identities hold a list of tokens so rotation publishes the replacement alongside the incumbent and needs no delivery gap. Read is a separate privilege from write, so a sender credential cannot read the audit trail back. T05 - lookup by event id, lookup by correlation id, and a dead-letter view. Rejections are recorded rather than silently dropped. An event rejected for carrying secret-shaped material has its payload withheld: storing it would write that material into the audit store, which is what the rejection exists to prevent. Reason and payload hash are kept so it stays traceable. Replay is deliberately not built here. Idempotent replay is a property of the durable store and building it against SQLite would produce a second implementation to throw away; it lands with the Postgres backend in AUDIT-WP-0005-T01. T06 - serving moves to waitress with configurable threads and channel timeout, installed in the image via the serve extra. Without it the entrypoint falls back to a threaded wsgiref server with a socket timeout and graceful shutdown on SIGTERM, and logs a warning so a deployment cannot quietly land on the fallback. Metric counters deferred to WP-0005-T03 to be designed against the real scrape path. Tests 36 -> 46, covering cross-tenant and cross-source refusal, token rotation, read/write privilege separation, correlation lookup, and payload withholding on secret rejection. Remaining in WP-0004: T04 redaction policy, which needs a decision on whether a secret-shaped field is a rejection or a redaction. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-10 14:50:02 +02:00			`# Production serving. Without this the entrypoint falls back to a threaded`
			`# wsgiref server, which is bounded but not a production server (AUDIT-WP-0004-T06).`
			`serve = ["waitress>=3.0"]`
Add the PostgreSQL audit backend and a shared conformance suite AUDIT-WP-0005-T01, built and verified against PostgreSQL 16 locally in Docker; the Railiance cluster was not needed. tests/test_backend_conformance.py is one suite run against every backend, so "the Postgres backend is done" means it satisfies the same contract SQLite already does rather than having its own green tests. It skips cleanly with no server reachable; make pg-test-up and make test-pg run it. Suite 50 -> 71. RetentionPolicy declares immutable=True and earns it: migration 0002 installs a trigger rejecting UPDATE and DELETE on the events table, so a leaked runtime credential can append but cannot rewrite or erase the trail. That materially narrows the residual risk ADR-0001 section 5 called out. tamper_evidence stays False because nothing here would prove a database owner had dropped the trigger - hash-chaining or external anchoring would be needed and is not implemented. Idempotency is one statement (INSERT ... ON CONFLICT DO NOTHING RETURNING), verified to behave identically to the SQLite backend under 12 concurrent submissions of the same event. Migrations are ordered, recorded and idempotent. Replay reconciles rather than duplicating - the piece deferred out of WP-0004-T05 - and is tested to leave exactly one custody record. Backend selection is by AUDIT_CORE_DATABASE_URL; the SQLite fallback logs a warning so a deployment that lost its URL is visible rather than quietly running on the wrong store. Also fixed: ingestion had no __main__ guard, so python -m audit_core.ingestion silently did nothing. Found during end-to-end smoke. Counting semantics documented: occurrences counts transmissions, not stored events, so a retry of a secret-shaped field increments it again. That is the sender behaviour being optimized away. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-10 17:09:46 +02:00			`# Production custody (AUDIT-WP-0005). SQLite remains the development backend.`
			`postgres = ["psycopg[binary,pool]>=3.2"]`
Add mock file audit backend 2026-06-01 23:44:03 +02:00
Implement durable event ingestion service 2026-08-09 20:59:14 +02:00			`[project.scripts]`
			`audit-core-ingest = "audit_core.ingestion:main"`

Add mock file audit backend 2026-06-01 23:44:03 +02:00			`[tool.pytest.ini_options]`
			`testpaths = ["tests"]`