Struct AuditRecord 

#[non_exhaustive]
pub struct AuditRecord {
    pub at: i64,
    pub sub: PrincipalId,
    pub act: Option<Actor>,
    pub camp_id: Option<String>,
    pub aud: String,
    pub method: String,
    pub scope: Vec<Scope>,
    pub result: String,
    pub request_id: String,
}

One audit record — verbatim with W159 §Audit journal.

Required fields: at, sub, aud, method, result, request_id. scope MAY be empty (e.g. a call rejected before scope-matching). act and camp_id are set when an agent acted on the subject’s behalf and/or the call was scoped to a camp; both None for a direct user-principal action with no camp context.

Mirrors the conditional-claim shape of McpClaims so a verified token’s metadata can flow into the record without lossy repackaging.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

at: i64

Unix-seconds timestamp the action happened (kamaji’s local clock).

sub: PrincipalId

Acting principal — the sub claim from the verified token.

act: Option<Actor>

camp_id: Option<String>

aud: String

Target resource URI (the verified token’s aud).

method: String

Free-form method identifier (POST /cloud/deploy, mcp.tools/call, …) — kamaji supplies a stable string per call shape.

scope: Vec<Scope>

Scope list the call presented. Stored as a typed Vec<Scope> so a future wildcard or unknown-scope ingest is rejected at parse time (per composition rule 1 — no wildcards on the wire).

result: String

Outcome string kamaji produced (allow | deny | error is the usual taxonomy, but cheers does not constrain it — see audit-reader docs in F14 for the canonical vocabulary). Cheers is durable storage, not the source of result semantics.

request_id: String

Correlator into kamaji’s local JSONL — same id appears in both places so an operator can match a cheers row to kamaji’s source.

Implementations

impl AuditRecord

pub fn new( at: i64, sub: PrincipalId, act: Option<Actor>, camp_id: Option<String>, aud: impl Into<String>, method: impl Into<String>, scope: Vec<Scope>, result: impl Into<String>, request_id: impl Into<String>, ) -> Result<Self, AuditValidationError>

Construct + validate. Returns the same error variants the wire layer surfaces as 400 audit_invalid.

pub fn validate(&self) -> Result<(), AuditValidationError>

Re-check the wire-shape invariants. Called from Self::new; the HTTP layer calls it again on records that arrived via Deserialize so a deserialized record can’t side-step the constructor.

Trait Implementations

impl Clone for AuditRecord

fn clone(&self) -> AuditRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditRecord

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuditRecord

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AuditRecord

impl PartialEq for AuditRecord

fn eq(&self, other: &AuditRecord) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for AuditRecord

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AuditRecord