Struct AuditLog 

pub struct AuditLog { /* private fields */ }

An open, append-only JSONL audit file backed by a dedicated writer thread.

Request handlers serialize the record and try to enqueue it into a bounded channel. They never perform audit file IO. The writer thread owns the BufWriter<File>, writes whole lines, flushes per line, and handles logrotate-friendly reopen requests.

Implementations

impl AuditLog

pub fn open(path: &Path) -> Result<Self>

Open (or create) the audit file at path in append-only mode, 0600.

The file is opened once at startup; the handle is then held for the broker’s lifetime. O_APPEND makes each write atomic w.r.t. other appenders, and mode 0600 keeps the audit trail owner-only.

Errors

Returns the underlying std::io::Error if the file cannot be opened or created (a fail-closed startup error: the binary aborts cleanly, no panic).

pub fn append(&self, record: &DecisionRecord)

Append one audit record as a single JSONL line (best-effort).

Builds the line from the DecisionRecord plus a timestamp and tries to enqueue it. A full or closed queue is logged and swallowed: appending the audit line must never block or fail the op. This method therefore returns nothing and never panics.

pub fn append_value(&self, value: &Value)

Append one pre-rendered structured JSON value as a single JSONL line (best-effort). Used by events that build their own audit JSON, e.g. a provider operation (ProviderAuditEvent), which carries its own occurred_at timestamp. Like Self::append, a full or closed queue is logged and swallowed: this never blocks, fails the op, or panics.

pub fn append_reload( &self, previous_generation: u64, new_generation: u64, outcome: &str, reason: &str, actor: ReloadActor, )

Append one reload audit line (basil-y3e.2, basil-atq): a basil.audit.reload JSONL event recording a generation reload, allow or reject.

actor attributes the trigger: a ReloadActor::Sighup for the operator SIGHUP signal path, or a ReloadActor::Caller carrying the peer-cred attested uid for the gated admin Reload RPC. The two paths are otherwise byte-identical (same gen ids + outcome + reason shape), so a SIGHUP and an RPC reload of the same candidate differ in the audit trail ONLY in this actor field. outcome is "applied"/"checked"/"rejected"; new_generation is the id now serving (== previous_generation on a reject/check, since no swap happened); reason is a short, stable, non-secret token (signal/admin_rpc on success, or the ReloadError audit reason on a reject). Best-effort and non-blocking, exactly like Self::append.

pub fn request_reopen(&self)

Request a logrotate-friendly close/reopen of the configured audit path.

This is best-effort and non-blocking for the caller. The writer thread observes the request before the next write, or within a short idle poll.

Trait Implementations

impl Debug for AuditLog

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for AuditLog

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.