Enum AuditEvent 

pub enum AuditEvent {
    CommunityInstalled(CommunityInstalledData),
    EmergencyBootstrapInvoked(EmergencyBootstrapData),
    AdminPasskeyRegistered(AdminPasskeyData),
    AdminPasskeyRevoked(AdminPasskeyData),
    ConfigChanged(ConfigChangedData),
    ConfigReloaded(ConfigReloadedData),
    RestartRequested(RestartRequestedData),
    CommunityProfileUpdated(CommunityProfileUpdatedData),
    AuditKeyRotated(AuditKeyRotatedData),
    MemberUpdated(MemberUpdatedData),
    RoleChanged(RoleChangedData),
    AdminPromoted(AdminPromotedData),
    JoinRequestSubmitted(JoinRequestData),
    JoinRequestApproved(JoinRequestData),
    JoinRequestRejected(JoinRequestRejectedData),
    MemberAdded(MemberAddedData),
    MemberRemoved(MemberRemovedData),
    MembershipReciprocated(MembershipReciprocatedData),
    PolicyUploaded(PolicyUploadedData),
    PolicyActivated(PolicyActivatedData),
    VmcIssued(CredentialIssuedData),
    VecIssued(CredentialIssuedData),
    MembershipRenewed(MembershipRenewedData),
    StatusListFlipped(StatusListFlippedData),
    DidRotated(DidRotatedData),
    RegistryStatusChanged(RegistryStatusChangedData),
    RegistrySyncSucceeded(RegistrySyncOutcomeData),
    RegistrySyncFailed(RegistrySyncOutcomeData),
    RegistryRecordPolicyOverride(RegistryRecordPolicyOverrideData),
    CrossCommunitySessionMinted(CrossCommunitySessionMintedData),
    VrcPublished(VrcPublishedData),
    VrcRevoked(VrcRevokedData),
    PersonhoodAsserted(PersonhoodAssertedData),
    PersonhoodRevoked(PersonhoodRevokedData),
    CustomEndorsementIssued(CustomEndorsementIssuedData),
    CustomEndorsementRevoked(CustomEndorsementRevokedData),
    EndorsementTypeRegistered(EndorsementTypeRegisteredData),
    EndorsementTypeDeleted(EndorsementTypeDeletedData),
    WebsiteFileWritten(WebsiteFileWrittenData),
    WebsiteFileDeleted(WebsiteFileDeletedData),
    WebsiteBundleDeployed(WebsiteBundleDeployedData),
    WebsiteGenerationRolledBack(WebsiteGenerationRolledBackData),
    AdminUiServed(AdminUiServedData),
    AclGranted(AclChangeData),
    AclUpdated(AclChangeData),
    AclRevoked(AclRevokedData),
    InvitationIssued(InvitationIssuedData),
    InvitationRevoked(InvitationRevokedData),
    SessionRevoked(SessionRevokedData),
    SignedOut(SignedOutData),
    BackupExported(BackupData),
    BackupImported(BackupData),
    AdminInviteCreated(AdminInviteData),
    AdminInviteRevoked(AdminInviteData),
    SchemaRegistered(SchemaChangeData),
    SchemaDeleted(SchemaChangeData),
}

Audit-event payload. Tagged on type with the variant name and the variant’s data under data. Phase-0 vocabulary only; Phase-1+ adds variants alongside the features that emit them.

Variants

CommunityInstalled(CommunityInstalledData)

Bootstrap completed — the first admin DID was written into the ACL and the install carve-out was permanently closed.

EmergencyBootstrapInvoked(EmergencyBootstrapData)

vtc admin emergency-bootstrap was invoked with a valid master-seed mnemonic, re-opening the install carve-out exactly once. Loud event — surfaced prominently in diagnostics on next daemon start so a forgotten emergency action is impossible to miss.

AdminPasskeyRegistered(AdminPasskeyData)

A passkey was registered against an admin DID (initial enrol at install or a subsequent additional-device enrolment).

AdminPasskeyRevoked(AdminPasskeyData)

A passkey was revoked from an admin DID. The CAS check that refuses to leave zero passkeys runs before the event is emitted, so any persisted AdminPasskeyRevoked leaves at least one passkey behind.

ConfigChanged(ConfigChangedData)

One or more runtime configuration keys were modified via PATCH /v1/admin/config. Per-key sensitivity is honoured — values for keys flagged sensitive are redacted via ConfigChange::redact_if before persistence.

ConfigReloaded(ConfigReloadedData)

POST /v1/admin/config/reload applied hot-reloadable settings in-place. Lists which keys actually re-applied (a key that was unchanged-or-already-active doesn’t appear).

RestartRequested(RestartRequestedData)

POST /v1/admin/config/restart initiated graceful shutdown. Emitted before the process exits so the next-boot replay can correlate the restart with the prior config patches that triggered it.

CommunityProfileUpdated(CommunityProfileUpdatedData)

PUT /v1/community/profile updated one or more profile fields. Records which fields changed by name; the values themselves stay out of the audit log (profile data isn’t security-sensitive by nature, but keeping the event small is operator-friendly).

AuditKeyRotated(AuditKeyRotatedData)

The community audit_key was rotated. Emitted under the new key (the rotation itself is what creates the new epoch), so an investigator can find the row by querying the audit_by_type index without needing to walk the prior epoch.

MemberUpdated(MemberUpdatedData)

PATCH /v1/members/{did} updated profile or non-role metadata on a member’s record. Lists the field names that changed; values stay out of the envelope.

RoleChanged(RoleChangedData)

PATCH /v1/members/{did} reassigned the member’s role. Distinct event from MemberUpdated because role changes are security-significant — SIEM filters key on this variant separately. Admin promotion uses [AdminPromoted] instead (spec §10.4 keeps the two paths separate).

AdminPromoted(AdminPromotedData)

POST /v1/members/{did}/promote-to-admin finished with a successful step-up UV ceremony. Spec §10.4 makes this its own variant (distinct from RoleChanged) so SIEM rules can target it; admin elevation is the highest- privilege grant the community emits.

JoinRequestSubmitted(JoinRequestData)

POST /v1/join-requests (REST or DIDComm) accepted a well-formed submission and persisted it as Pending. The actor on this event is the applicant DID — they’re the principal, even though the daemon’s authenticated identity did not vouch for them.

JoinRequestApproved(JoinRequestData)

An admin / moderator approved a pending join request via POST /v1/join-requests/{id}/approve. Always paired with a MemberAdded emission in the same transaction (the approve flow writes the ACL + Member rows atomically).

JoinRequestRejected(JoinRequestRejectedData)

An admin / moderator rejected a pending join request. The reason field is operator-supplied and may be empty.

MemberAdded(MemberAddedData)

New member row written. Companion event to JoinRequestApproved — the latter is what an audit query for “who approved this” matches, the former is what “when did join” matches. Spec §10.1.

MemberRemoved(MemberRemovedData)

Member row removed (or anonymised) per spec §10.2. Spec §5 Disposition decides whether the row is purged outright, tombstoned with the DID retained, or kept historical.

MembershipReciprocated(MembershipReciprocatedData)

A member discharged the reciprocate_vmc obligation: they counter-signed the issued VMC with a member-issued reciprocal VC, completing the bidirectional DTG membership edge (join-requests/accept/1.0). The audit envelope’s target_did carries the member.

PolicyUploaded(PolicyUploadedData)

POST /v1/policies accepted an upload, compiled the source, and persisted a new revision. The row is not yet active — activation is a separate event. Spec §7.1; Phase 2 M2.3.

PolicyActivated(PolicyActivatedData)

POST /v1/policies/{id}/activate flipped the active pointer for a purpose. Carries the predecessor’s id so a forensic audit can chain backwards through revisions without scanning the whole policies: keyspace. Spec §7.1; Phase 2 M2.3.

VmcIssued(CredentialIssuedData)

A new VMC was minted (join-approve or renewal). Spec §6.1.

VecIssued(CredentialIssuedData)

A new role VEC was minted (join-approve, renewal, or role change). Spec §6.1.

MembershipRenewed(MembershipRenewedData)

POST /v1/members/me/renew re-minted the member’s VMC + role VEC. Spec §6.3. personhood_changed flips when the renewal’s personhood.rego re-eval produced a different flag than the prior VMC.

StatusListFlipped(StatusListFlippedData)

A status-list bit was flipped (revocation / suspension). Spec §6.2.

DidRotated(DidRotatedData)

A member rotated to a fresh DID. The audit envelope’s actor_did is the new DID (it’s the principal going forward); the prior DID lives in the data struct. Spec §10.5; Phase 2 M2.15.

RegistryStatusChanged(RegistryStatusChangedData)

The daemon’s trust-registry reachability state flipped (active ↔ degraded). Spec §8.1; Phase 3 M3.2. SIEM filters key on this to alert when the registry connection drops or recovers.

RegistrySyncSucceeded(RegistrySyncOutcomeData)

A MembershipSyncer job completed successfully against the registry. Spec §8.3; Phase 3 M3.4.

RegistrySyncFailed(RegistrySyncOutcomeData)

A MembershipSyncer job flipped to the Failed state after exhausting its retry budget. Spec §8.3 calls these out for operator attention — failed Purge jobs are silent privacy regressions. Phase 3 M3.4.

RegistryRecordPolicyOverride(RegistryRecordPolicyOverrideData)

A member-initiated Purge (RTBF) bypassed the active registry.rego.min_disposition floor. Spec §8.2 calls these out: RTBF always overrides the policy envelope. The audit envelope’s actor_did_hash is the HMAC-hashed identifier per §11.1; the actor_did_plain field is None for these envelopes (privacy-preserving by construction). Phase 3 M3.6.

CrossCommunitySessionMinted(CrossCommunitySessionMintedData)

A cross-community session was minted (or denied). Spec §8.4; Phase 3 M3.10. The outcome field discriminates minted from denied; the reason is populated only on denied and carries one of [RecognitionError]’s stable reason codes (issuer-key-unresolved / proof-invalid / status-list-failed / issuer-not-recognised / registry-unreachable / validity-window / malformed / role-mapping-denied).

VrcPublished(VrcPublishedData)

A member published a self-issued Verifiable Recognition Credential (VRC) — a trust edge issuer-member → subject- member per spec §5.4 + §6.1. Phase 4 M4.6. The actor is the issuer; the target is the subject DID.

VrcRevoked(VrcRevokedData)

A VRC was revoked — either by the original issuer or by an admin acting on behalf of the community. Phase 4 M4.6. Per D7, VRCs carry no credentialStatus; revocation is row deletion in the local relationships: keyspace.

PersonhoodAsserted(PersonhoodAssertedData)

A member’s personhood flag was asserted true via POST /v1/members/{did}/personhood/assert. Phase 4 M4.3. The actor is the asserter (admin or issuer); the target is the member. Per D2 review (VP-only assert), the presented evidence is verified at assert time and discarded — no evidence_sha256 field on this envelope.

PersonhoodRevoked(PersonhoodRevokedData)

A member’s personhood flag was revoked. Phase 4 M4.4 + M4.2.2. The reason discriminator pins which of the three triggers fired: "admin" (admin DELETE), "self" (member DELETE), or "renewal-policy" (renewal-time policy downgrade per D5 review’s downgrade arm).

CustomEndorsementIssued(CustomEndorsementIssuedData)

A custom (non-role) endorsement credential was issued by an issuer or admin. Phase 4 M4.8. Per D8 review, the credential carries a credentialStatus entry on the shared Revocation status list — status_list_index records the allocated slot.

CustomEndorsementRevoked(CustomEndorsementRevokedData)

A custom endorsement was revoked. Phase 4 M4.8. Flips the Revocation status-list bit at the credential’s status_list_index. Paired with a StatusListFlipped { purpose: "revocation", index, revoked: true } envelope (existing variant) so the status-list audit surface stays uniform.

EndorsementTypeRegistered(EndorsementTypeRegisteredData)

An operator registered a new custom endorsement type via POST /v1/endorsement-types. Phase 4 M4.8.1 (D4 review). The actor is the admin; the type_uri field records what was registered.

EndorsementTypeDeleted(EndorsementTypeDeletedData)

An operator deleted a custom endorsement type via DELETE /v1/endorsement-types/{uri}. Phase 4 M4.8.1. The registry refuses deletion when at least one live endorsement of this type still exists; this envelope only fires after a successful delete.

WebsiteFileWritten(WebsiteFileWrittenData)

PUT /v1/website/files/{path} succeeded. Phase 5 M5.5.2. Records the path + size + SHA-256 of the new content so the audit log carries enough material to reconstruct a deploy without persisting the full file body.

WebsiteFileDeleted(WebsiteFileDeletedData)

DELETE /v1/website/files/{path} succeeded. Phase 5 M5.5.2. Records the path; no content digest because the file no longer exists.

WebsiteBundleDeployed(WebsiteBundleDeployedData)

POST /v1/website/deploy succeeded. Phase 5 M5.5.3. Captures the bundle’s SHA-256, byte size, target deploy mode, and (managed mode only) the new generation number

• how many old generations were pruned.

WebsiteGenerationRolledBack(WebsiteGenerationRolledBackData)

POST /v1/website/rollback/{gen} succeeded. Phase 5 M5.5.4. Managed mode only. Records the symlink swap so the audit log surfaces which generation served before vs. after.

AdminUiServed(AdminUiServedData)

Emitted exactly once at daemon boot when the embedded admin UX (admin-ui cargo feature) is enabled. Captures the SHA-256 of the baked index.html so an operator can correlate which build of the admin SPA is currently serving. Phase 5 M5.7.2.

AclGranted(AclChangeData)

An ACL entry was created — a DID was granted a community role (POST /v1/acl). Authorization grants are the highest-value forensic events: this records who now holds what authority, scoped to which contexts, until when. Envelope target_did is the granted DID.

AclUpdated(AclChangeData)

An existing ACL entry was modified (PATCH /v1/acl/{did}) — role / contexts / expiry changed. Envelope target_did is the affected DID; the payload carries the new state.

AclRevoked(AclRevokedData)

An ACL entry was deleted (DELETE /v1/acl/{did}) — the DID lost its community authority. Envelope target_did is the revoked DID.

InvitationIssued(InvitationIssuedData)

A Verifiable Invitation Credential (VIC) was issued (POST /v1/invitations). Records the invitee, granted role, and the revocation slot so the credential’s whole lifecycle is traceable. Envelope target_did is the invitee.

InvitationRevoked(InvitationRevokedData)

An invitation was revoked (DELETE /v1/invitations/{id}) — its revocation bit flipped. Envelope target_did is the invitee.

SessionRevoked(SessionRevokedData)

One or more authenticated sessions were revoked by an admin (DELETE /v1/auth/sessions/{id} or ?did=). Cutting off access is security-relevant and must be attributable. Envelope target_did is the session owner (when revoking by DID).

SignedOut(SignedOutData)

A principal ended their own session (POST /v1/auth/sign-out).

Deliberately distinct from Self::SessionRevoked rather than a flag on it: voluntary sign-out is routine, admin-forced revocation is a security signal, and a SIEM rule that has to tell them apart by comparing actor to target will get it wrong the first time an admin revokes their own session. Same reasoning as Self::AdminPromoted versus Self::RoleChanged.

BackupExported(BackupData)

An encrypted state backup was exported (POST /v1/backup/export).

BackupImported(BackupData)

An encrypted state backup was imported, restoring community state (POST /v1/backup/import). A full-state restore is among the most sensitive operations — recorded so a restore is never silent.

AdminInviteCreated(AdminInviteData)

An admin onboarding invite was minted (POST /v1/admin/invites), optionally pre-creating an ACL grant. Envelope target_did is the invited admin DID (when bound to one).

AdminInviteRevoked(AdminInviteData)

An admin onboarding invite was revoked (DELETE /v1/admin/invites/{jti}).

SchemaRegistered(SchemaChangeData)

A credential schema or accepts-criterion was registered (POST /v1/schemas or /v1/schemas/accepts) — what the community accepts/recognises changed.

SchemaDeleted(SchemaChangeData)

A credential schema or accepts-criterion was deleted (DELETE /v1/schemas/{type_uri} or /v1/schemas/accepts/{id}).

Implementations

impl AuditEvent

pub fn variant_name(&self) -> &'static str

The serde tag for this variant — the same string that appears as {"type": ...} on the stored envelope.

This is what the canonical audit/list Trust Task exposes as action, and what audit/list’s action filter matches on, so it must stay identical to the serialized tag. Kept as an explicit match (rather than round-tripping through serde_json) so listing does not pay a serialization per row just to learn the name.

Trait Implementations

impl Clone for AuditEvent

fn clone(&self) -> AuditEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuditEvent

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AuditEvent

impl PartialEq for AuditEvent

fn eq(&self, other: &AuditEvent) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for AuditEvent

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AuditEvent