Documentation
¶
Overview ¶
Package compliance turns the raw material this proxy already collects - the tamper-evident audit log (internal/audit) and the reversibility registry (internal/registry) - into the thing a SOC2 auditor or a customer's compliance team actually wants: a structured summary over a time period, not a JSONL file they have to grep themselves.
Deliberately scoped to what a single, principled pass over the audit log can answer honestly. The audit log is the append-only source of truth; the approval/saga stores are mutable current-state views that can diverge from historical truth as records expire or get pruned, so this reads the log, not those stores, to avoid a report whose numbers could disagree with themselves depending on when it's run. It does mean a few figures (four-eyes count, approval tier) are recovered by parsing the human-readable "reason" string handler.go already writes - a real simplification, not hidden: see parseTier/parseRequiredApprovers below. A cleaner structured field on future audit entries would remove the need for this; not worth a wider handler.go change just for reporting.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Report ¶
type Report struct {
GeneratedAt time.Time `json:"generated_at"`
PeriodFrom *time.Time `json:"period_from,omitempty"`
PeriodTo *time.Time `json:"period_to,omitempty"`
// AuditChain is the tamper-evidence check embedded directly in the
// report - a report generated from a log whose chain doesn't verify
// says so plainly, rather than presenting numbers from a log that
// might have been altered.
AuditChain audit.VerifyResult `json:"audit_chain"`
TotalEvents int `json:"total_events"`
ByDecision map[string]int `json:"by_decision"`
ByReversibilityClass map[string]int `json:"by_reversibility_class"` // completed (EXECUTED/ALLOW) calls only, classified via the live registry
ByApprovalTier map[string]int `json:"by_approval_tier"` // tier1_envelope / tier2_hold / tier3_approval / step_up_taint
FourEyesRequired int `json:"four_eyes_required"`
SagaCompensationsSucceeded int `json:"saga_compensations_succeeded"`
SagaCompensationsFailed int `json:"saga_compensations_failed"`
ProvenanceJudgeInvocations int `json:"provenance_judge_invocations"`
ProvenanceJudgeErrors int `json:"provenance_judge_errors"`
KeyRotations int `json:"key_rotations"`
}
func Generate ¶
Generate walks auditLogPath once, classifying each entry against reg (for reversibility class) and the period bounds (either may be nil for "no lower/upper bound").
func GenerateFromPostgres ¶
GenerateFromPostgres is Generate's exact counterpart for a Postgres- backed audit log (see internal/audit's OpenPostgres) - same tally logic over rows read from the database instead of lines read from a file, for the same reason internal/audit's VerifyChainPostgres shares its recomputation algorithm with VerifyChainFile rather than duplicating it.
Source Files