Module audit 

The JSONL audit sink (vault-vq5): persist every authorization decision.

crate::decision::DecisionRecord is the single place a gated op’s (subject, op, key) -> Allow|Deny decision is materialized, and it is already logged structurally via tracing. This module adds a second, durable side channel: when the broker is started with config key audit-log, each recorded decision is also appended as exactly one JSON object per line (JSONL) to an open append-only file.

Discipline

• No secret bytes. A DecisionRecord carries only the actor subject, presenter context, op, key name, outcome, and reason token, never payloads, key bytes, or signatures. The audit line is built from exactly those fields plus a timestamp.
• Best-effort at request time. The kernel-trustworthy decision has already happened and is in tracing; queue or IO trouble must not panic and must not block or deny the op. A failed enqueue/write logs an error and the data plane carries on. (Audit-disk trouble must not take down the broker; see vault-vq5 close note.)
• Dedicated writer. Request handlers only enqueue a serialized line into a bounded channel. One audit writer thread owns the file handle, writes one complete JSONL record at a time, and flushes each line so a crash does not lose recent entries.
• Fail-closed startup. Opening the file (O_APPEND | O_CREATE, mode 0600) happens once at startup via AuditLog::open; a failure there is a clean startup error (the binary aborts), never a panic.

Structs

AuditLog

An open, append-only JSONL audit file backed by a dedicated writer thread.

Enums

ReloadActor

Who triggered a generation reload, for the actor field of a basil.audit.reload line (basil-atq, basil-mil0.5/basil-ftmc).