#201: stable audit event catalogue for syslog/SIEM export #261

Merged

fable-5 merged 1 commits from feat/201-audit-event-catalogue into main 2026-07-31 05:07:50 +02:00

Conversation 0 Commits 1 Files Changed 6 +278 -4

fable-5 commented 2026-07-31 04:51:21 +02:00

Collaborator

Copy Link

Stacked on #260 (#200) -> #259 (#199) -> #258 (#202) -> merged #257. Issue #201.

• The 36 audit action ids become a typed union (AUDIT_EVENTS) — an uncatalogued id is a compile error; all existing ids keep their names.
• Published catalogue docs/architecture/audit-events.md (v1.0): per event id, trigger, severity, actor/target semantics and every field; compatibility promise (ids never repurposed, additions = minor, removal of a retired row = major + release notes); stable stdout field set and the forwarding path (container stdout -> operator's collector, deliberately no app-side syslog client).
• Fence: audit-catalogue.test.ts parses the document's event tables and fails when ids or severities drift from the code — verified in both directions (fake id made both tests fail).
• Audit stdout lines now carry the catalogue severity as a routing hint (pino level unchanged); no DB migration.
• Full api suite green (482) against a fresh DB. References for #228/#230 follow as issue comments after merge.

Stacked on #260 (#200) -> #259 (#199) -> #258 (#202) -> merged #257. Issue #201. - The 36 audit action ids become a typed union (`AUDIT_EVENTS`) — an uncatalogued id is a compile error; all existing ids keep their names. - Published catalogue `docs/architecture/audit-events.md` (v1.0): per event id, trigger, severity, actor/target semantics and every field; compatibility promise (ids never repurposed, additions = minor, removal of a retired row = major + release notes); stable stdout field set and the forwarding path (container stdout -> operator's collector, deliberately no app-side syslog client). - Fence: `audit-catalogue.test.ts` parses the document's event tables and fails when ids or severities drift from the code — verified in both directions (fake id made both tests fail). - Audit stdout lines now carry the catalogue `severity` as a routing hint (pino level unchanged); no DB migration. - Full api suite green (482) against a fresh DB. References for #228/#230 follow as issue comments after merge.

fable-5 added 4 commits 2026-07-31 04:51:21 +02:00

#202: SBOM and license report in CI ... d3289b2167

The release run now generates CycloneDX 1.6 SBOMs with a pinned
anchore/syft container — one per released image (scanned from the
freshly built image tar, OS packages included) and one for the pnpm
workspace (from the lockfile) — plus the full pnpm licenses report, and
attaches everything as build artefacts BEFORE publishing the release,
so a red gate stops the release. Runner constraints dictated the
mechanics (documented in the workflow): the job talks to the HOST
daemon, so files travel into the syft container via docker cp and
images via docker save to a tar copied the same way (syft cannot read
a tar from stdin — verified).

scripts/check-licenses.mjs is the documented license policy: permissive
allowlist, MPL-2.0/CC-BY-4.0 with recorded reasoning, per-package
exception table (khroma: MIT text shipped, metadata missing). CI runs
the gate on every PR (pnpm licenses:check); positive and negative case
tested locally, both SBOM paths tested against real images/lockfile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#199: SHA-256 integrity hashes for attachments ... 74970f6073

Every upload stores the SHA-256 of its bytes, computed from the
in-memory buffer that is written — never by re-reading disk. Every
download re-hashes the stored object BEFORE the first byte leaves
(memory bounded by the max_file_bytes quota that gated the upload) and
fails closed on mismatch with attachment_integrity_failure; the
mismatch lands in the audit trail as file.integrity_failed with both
hashes. Detection of payload manipulation is the one integrity duty
par. 52 VSA leaves with the application — only it knows what the file
should be.

Pre-#199 rows are hashed by a bounded, idempotent backfill that rides
the existing nightly orphan-file-sweep job (no new scheduler job, job
fence untouched); unreadable files are logged and retried, never
silently skipped, and null-hash rows are served unverified only until
the backfill reaches them. Operator runbook note in security.md
(restore from backup, re-download, audit entry carries both hashes).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#200: hard instance-wide plugins.enabled kill switch ... c4c84b33f9

plugins.enabled (instance setting, default on — plugins predate the
switch; the VS-NfD reference configuration turns it off) makes every
plugin surface answer 404 via a shared guard: Site-Admin
install/list/mode, pond activation and plugin list, the sandbox frame
and asset routes. The dropzone watcher quarantines drops instead of
installing. Deliberately NOT guarded: the authenticated
fallback-metadata route — it serves no plugin code and existing
plugin_block nodes need it to render their declared fallback (an image
fallback degrades to the neutral placeholder while off, because its
bytes live on the disabled asset surface). The editor offers no plugin
blocks because the pond plugin list is one of the 404ing surfaces.
Admin settings panel gets the toggle (i18n de+en) with the documented
api-restart note (in-process settings cache).

Answers "code execution inside the zone?" with one verifiable
off-switch instead of per-plugin trust machinery (#232, ADR 0025).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#201: stable audit event catalogue for syslog/SIEM export ... 000d110727

The 36 audit action ids become a typed union (AUDIT_EVENTS in
audit-actions.ts) — an uncatalogued id is now a compile error; every
existing id keeps its name. The published, versioned catalogue
(docs/architecture/audit-events.md, v1.0) documents per event: trigger,
severity, actor and target semantics, and every field, plus the
compatibility promise (ids are never repurposed; retiring keeps the row
forever) and the stable stdout field set. audit-catalogue.test.ts is
the fence: it parses the document's event tables and fails when ids or
severities drift from the code (negative case verified). Audit stdout
lines now carry the catalogue severity as a routing hint — pino level
stays 30 so transport is unaffected; no DB migration.

Forwarding path documented: container stdout -> operator's collector;
deliberately no application-side syslog client.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

fable-5 merged commit 000d110727 into main 2026-07-31 05:07:50 +02:00

fable-5 referenced this pull request 2026-07-31 05:08:09 +02:00

[VS-NfD] Define a stable event catalogue for syslog/SIEM export #201

fable-5 referenced this pull request 2026-07-31 05:08:10 +02:00

[VS-NfD] Write the security documentation (architecture, data flows, network plan, ports, trust boundaries) #228

fable-5 referenced this pull request 2026-07-31 05:08:10 +02:00

[VS-NfD] Produce the IT-Grundschutz mapping for APP.3.1 and CON.11.1 #230

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:auth

  

area:docs

  

area:export

  

area:ops

  

area:storage

  

area:supply-chain

  

auth

Authentication, permissions, quotas

  

backend

API server (apps/api)

  

blocked

Blocked on external dependency/infrastructure

  

collab

Collaboration server (apps/collab)

  

deployment

Docker, CI/CD, hosting

  

docs

Documentation

  

effort:L

  

effort:M

  

effort:S

  

frontend

SPA (apps/web)

  

plugins

Plugin system and SDK

  

qa

Tests, fixtures, e2e

  

vs-nfd

  

vs-nfd:blocker

No Label

area:auth

area:docs

area:export

area:ops

area:storage

area:supply-chain

auth

backend

blocked

collab

deployment

docs

effort:L

effort:M

effort:S

frontend

plugins

qa

vs-nfd

vs-nfd:blocker

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#261

No description provided.