Struct AuditRecord 

pub struct AuditRecord {

    pub ts: String,
    pub kind: AuditKind,
    pub peer: Option<String>,
    pub service: Option<String>,
    pub method: Option<String>,
    pub tool: Option<String>,
    pub args_hash: Option<String>,
    pub bytes_out: Option<u64>,
    pub status: Option<String>,
    pub latency_ms: Option<u64>,
    pub event: Option<String>,
    pub target: Option<String>,
    pub principal: Option<String>,
}

One audit record — the union of the event classes, and the record payload of a StreamFrame::Event. ONE schema for the on-disk JSONL log and the live stream. Every field beyond ts/kind is optional and elided when absent (skip_serializing_if), so each class serializes to just its relevant keys (a session record has no method; a trust record has no bytes_out).

PRIVACY: the proxied-request record carries method + tool (NAME only) + args_hash ("blake3:<hex>"), and NEVER the raw arguments, the request/response content, or any tool-output bytes — only a bytes_out COUNT and a status.

Fields

ts: String

RFC3339 UTC with millisecond precision, e.g. "2026-07-03T14:02:11.480Z". The YYYY-MM prefix also selects the monthly file (the rotation boundary), so it is always present.

kind: AuditKind

peer: Option<String>

The gate-resolved authenticated peer (attributed by the endpoint_id-keyed trust gate). Absent on local-only events with no remote peer (a manual roster install).

service: Option<String>

method: Option<String>

tool: Option<String>

The tool NAME only (never its arguments or output) — e.g. "read_file" for a tools/call.

args_hash: Option<String>

"blake3:<hex>" of the request arguments. The raw arguments are NEVER stored.

bytes_out: Option<u64>

Byte COUNT of the response sent back to the peer — a count, never the content.

status: Option<String>

"ok" / "error" (proxied request) or "ok" / "denied" (blob fetch).

latency_ms: Option<u64>

event: Option<String>

Trust-event verb: "pair" / "unpair" / "roster_install" / "revoke" (kind == Trust).

target: Option<String>

A reference, NEVER content: a blob hash (BlobFetch) or a trust-event target such as a nickname or org/serial (Trust).

principal: Option<String>

The subject’s STABLE principal, from the same gate resolution that produced peer (#57, api_minor >= 29). peer is a display name and collides — two devices under one nickname were indistinguishable in the stream and the on-disk log. Same argument and shape as PeerInfo (#41), PeerReachability (#42), and ActiveSession (#73).

TWO NAMESPACES, deliberately: session/request/blob records attribute the DEVICE (eid:<hex>, like ActiveSession — the exact authenticated endpoint), while the trust pair record carries the value the grant appended to the allow (b64u:<pk> when the device presented a user binding, else eid:, #38). Joining a bound peer’s sessions to its allow entry therefore goes through the status peers list (which carries BOTH the device principal and the user_id), not string equality on this field alone.

Deliberately absent on: unpair (may tear down several devices — no single subject), roster_install (purely local), and the failed-outbound-dial session record (our own dial, not a gate-resolved caller). Absent on every record written before 0.24.0.

Implementations

impl AuditRecord

pub fn session_open( ts: String, peer: Option<String>, service: String, principal: Option<String>, ) -> Self

principal is an EXPLICIT parameter on every constructor (#57, kept from the original #72 design): a builder would let a call site silently omit it and reintroduce the collapsed-identity bug for that one event class. Pass None only for the documented no-single-subject records (see the field doc).

pub fn with_status(self, status: &str) -> Self

Set the record’s status ("ok"/"error"/"denied"), returning self for chaining. Marks a synthesized failure record — e.g. the session_open for a FAILED dial, which reaches no backend and so is never audited by the far side’s session guard — without a dedicated constructor. DRY: reuses the existing optional status field.

pub fn session_close( ts: String, peer: Option<String>, service: String, principal: Option<String>, ) -> Self

pub fn proxied_request( ts: String, peer: Option<String>, service: String, method: String, tool: Option<String>, args_hash: String, bytes_out: u64, status: String, latency_ms: u64, principal: Option<String>, ) -> Self

A completed (request→response correlated) proxied line: method + tool NAME + args_hash, plus the response’s bytes_out COUNT, status, and latency_ms. PRIVACY: args_hash is a digest; no raw arguments, request/response content, or tool-output bytes are ever passed in.

pub fn proxied_notification( ts: String, peer: Option<String>, service: String, method: String, tool: Option<String>, args_hash: String, principal: Option<String>, ) -> Self

A proxied NOTIFICATION line (no id, so no response correlates): method + tool + args_hash, no bytes_out/status/latency_ms. The line is still recorded — every proxied request is audited.

pub fn blob_fetch( ts: String, peer: Option<String>, hash: String, status: String, principal: Option<String>, ) -> Self

pub fn trust( ts: String, event: String, target: Option<String>, principal: Option<String>, ) -> Self

Trait Implementations

impl Clone for AuditRecord

fn clone(&self) -> AuditRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditRecord

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuditRecord

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for AuditRecord

fn eq(&self, other: &AuditRecord) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for AuditRecord

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AuditRecord