kaptein_viewmodel/
sink.rs

1//! The optional audit sink.
2//!
3//! The local audit log is a file on each laptop, which is **not** an audit trail for a
4//! reviewer. An optional `AuditSink` — syslog, OTLP, or webhook — forwards audit events,
5//! buffered locally during downtime. This is the hook that makes guardrails, break-glass,
6//! RBAC preflight, and agent governance mean something in a team, and it is the concrete
7//! hook against CRA / NIS2 / DORA.
8
9use serde::{Deserialize, Serialize};
10
11/// Where audit events are forwarded, beyond the local log.
12#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
13#[serde(tag = "type", rename_all = "snake_case")]
14pub enum AuditSink {
15    Syslog {
16        facility: String,
17    },
18    Otlp {
19        endpoint: String,
20    },
21    Webhook {
22        url: String,
23    },
24    /// No forwarding — local log only.
25    #[default]
26    Local,
27}
28
29/// Configuration for audit forwarding, per context.
30#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
31pub struct AuditConfig {
32    pub sink: AuditSink,
33    /// Buffer locally (and replay) while the sink is unreachable.
34    pub buffer_when_unreachable: bool,
35}
kaptein_viewmodel/sink.rs

kaptein_viewmodel/
sink.rs
