audit-core/WORK-RECORDS.md
tegwick 88d16847ff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Establish pre-production record disposition and add the migration tool
AUDIT-WP-0005-T04.

Disposition: there are no pre-production records. No audit-core SQLite store
on this host, no mock-file-backend output, and no audit-core pod, deployment
or PVC on railiance01 - the only audit-* PVC there is OpenBao's own audit
device. Consistent with the history: WP-0003-T03 was cancelled before the
receiver was ever deployed, so every SQLite store that has existed was a test
fixture. Nothing is being discarded because nothing was ever accepted outside
tests.

The tool is built anyway because the SQLite path stays reachable - the
entrypoint falls back to it when AUDIT_CORE_DATABASE_URL is unset. If that
fallback is ever used in anger the records are audit records, and writing the
migration afterwards under pressure is the wrong time.

audit_core.migrate_store and `python -m audit_core migrate-store` transfer
events, dead letters and secret-finding counters. Records keep their original
event_id, payload_hash and accepted_at, which is why this bypasses accept():
that stamps acceptance with the current time, and a migration that rewrote
acceptance times would destroy the evidence it exists to preserve.

Idempotent, and verification reads back from the destination rather than
trusting the write path. A destination record with a differing payload hash is
reported as a conflict and left untouched - silently overwriting a stored audit
record is the same class of failure as losing it. Conflicts and failed
verification exit non-zero; a partial migration is not a success.

Tests 71 -> 77.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-10 17:31:18 +02:00

3.1 KiB

Work Records — audit-core

Generated by statehub fix-consistency (CUST-WP-0061-T04, work-record stage 3). Do not edit by hand — edit the source file/block listed for each record and re-run fix-consistency to refresh this index. Archived workplans are omitted; closed decisions/intakes/engagements stay listed so recently-resolved work is still visible. [auto]

Kind ID Status Lane Source
workplan AUDIT-WP-0001 finished workplans/AUDIT-WP-0001-statehub-bootstrap.md
workplan AUDIT-WP-0002 finished workplans/AUDIT-WP-0002-pluggable-audit-backend.md
workplan AUDIT-WP-0003 finished workplans/AUDIT-WP-0003-user-engine-event-ingestion-service.md
workplan AUDIT-WP-0004 finished workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md
workplan AUDIT-WP-0005 proposed workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
task AUDIT-WP-0001-T01 done workplans/AUDIT-WP-0001-statehub-bootstrap.md
task AUDIT-WP-0001-T02 done workplans/AUDIT-WP-0001-statehub-bootstrap.md
task AUDIT-WP-0001-T03 done workplans/AUDIT-WP-0001-statehub-bootstrap.md
task AUDIT-WP-0002-T01 done workplans/AUDIT-WP-0002-pluggable-audit-backend.md
task AUDIT-WP-0003-T01 done workplans/AUDIT-WP-0003-user-engine-event-ingestion-service.md
task AUDIT-WP-0003-T02 done workplans/AUDIT-WP-0003-user-engine-event-ingestion-service.md
task AUDIT-WP-0003-T03 cancel workplans/AUDIT-WP-0003-user-engine-event-ingestion-service.md
task AUDIT-WP-0003-T04 cancel workplans/AUDIT-WP-0003-user-engine-event-ingestion-service.md
task AUDIT-WP-0004-T01 done workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md
task AUDIT-WP-0004-T02 done workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md
task AUDIT-WP-0004-T03 done workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md
task AUDIT-WP-0004-T04 done workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md
task AUDIT-WP-0004-T05 done workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md
task AUDIT-WP-0004-T06 done workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md
task AUDIT-WP-0004-T07 done workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md
task AUDIT-WP-0005-T01 done workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
task AUDIT-WP-0005-T02 todo workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
task AUDIT-WP-0005-T03 todo workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
task AUDIT-WP-0005-T04 todo workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
task AUDIT-WP-0005-T05 todo workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
task AUDIT-WP-0005-T06 todo workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md