Audit Log Specification¶

Standardizes audit events across the namespace. SPB-12.

Required fields¶

Field	Type	Notes
`id`	string (uuid)	Unique event id.
`ts`	ISO-8601 UTC	Event time.
`actor`	string	`human:<name>` or `agent:<name>` or `service:<name>`.
`actor_credential_label`	string	Credential label used (never the credential value).
`runtime`	enum	`local \| home_lab \| cloud`.
`action`	string	Short verb, e.g., `register_project_repo`, `tag_release`, `key_rotated`.
`target`	string	What was acted on. Repo / object id / route.
`scope`	string	Short summary of authorized scope.
`outcome`	enum	`success \| failure \| denied`.
`reason`	string (optional)	For failure / denied: why.
`correlation_id`	string (optional)	Ties multi-step operations together.
`data_classification`	enum	`private_sensitive \| internal \| low_sensitive \| n/a`.

Optional fields¶

Field	Notes
`approver`	for approval-gated actions
`jit_token_id`	for JIT operations
`evidence_uri`	pointer to artifact (signed validation, attestation)
`parent_event_id`	for nested actions

Retention¶

Append-only.
Minimum 365 days for private_sensitive actions; minimum 180 days otherwise.
Logs are tamper-evident (hash chain or signed batches recommended).

Redaction¶

Never include credential values, secret material, or PII verbatim.
Truncate object content to a hash where the value would otherwise be sensitive.
Apply SPB-09 redaction standards.

Privacy constraints¶

Logs themselves are agent-readable for analysis but never user-only-secret-store-readable.
Cross-classification logs split: private_sensitive events only stored locally; internal/low_sensitive may stream to a managed log sink with appropriate controls.

Sample event¶

{
  "id": "9f2c1a3e-...-d4",
  "ts": "2026-05-04T19:33:00Z",
  "actor": "agent:orchestrator",
  "actor_credential_label": "orchestrator-validate-only",
  "runtime": "local",
  "action": "validate_repo_contract",
  "target": "org-namespace/agent-skills@v0.1.3",
  "scope": "read-only-validate",
  "outcome": "success",
  "data_classification": "internal",
  "correlation_id": "promote-2026-05-04",
  "evidence_uri": "validations/agent-skills@v0.1.3-2026-05-04.json"
}

Conformance check¶

Each repo's automation.validate is expected to emit at least one audit event. Compatibility validation verifies this.