fix(ocsf-audit): declare sink capabilities, re-pin to praxis #84 5b76fa6 - #530
Merged
Conversation
PR #84's `0651258` makes audit sinks filtered like any other plugin: the engine pairs each handler with its own `plugins:` capability set in a new `AttachedSink` and hands `handle` a filtered `Extensions` rather than the executor's working copy. That is the right design. This crate declared no capabilities, so it silently lost three of the six typed fields it maps. `request`, `mcp` and `completion` are ungated. `agent` sits behind `read_agent`, `delegation` behind `read_delegation`, and security labels behind `read_labels`. Reproduced through `examples/panic_drive.rs`, which drives a real engine through `load_config`; the unit tests build `Extensions` directly and so never reach the filter. At the old pin `499ee91` the emitted record carries `ai_agent.uid: agent-7`. At `5b76fa6` with no capabilities declared it carries no `ai_agent` block at all, and still chains, still signs and still verifies offline. Declaring the three restores it. A silent evidence loss rather than a load error, which is the failure mode this project exists to prevent: a verifier cannot distinguish "no delegation occurred" from "the sink was not permitted to see it". Both demo config variants and both README wiring examples now declare the three, with a note on why omitting them costs evidence. The cpex host accepts the key and is unaffected. The seam itself held: `AuditHandler::handle`, `on_effect` and `Plugin::as_audit_handler` are unchanged at the new head, so the crate needed no source change. Only `Executor::with_audit_handlers` changed, and that is host-side. Verified the way CI runs it, toolchain 1.96.1 with a cpex sibling at `64c8eba`: warning-free `--locked` checks and 34 tests green on each host, `emit_sample` byte-identical to the AID-EMIT-1 section 12 conformance vector on both. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XyU3PRkgvMxgimkPBC5726
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
praxis-proxy/policy PR #84's
0651258makes audit sinks filtered like any other plugin: the engine pairs each handler with its ownplugins:capability set in a newAttachedSinkand handshandlea filteredExtensionsrather than the executor's working copy. Correct design. This crate declared no capabilities, so it silently lost three of the six typed fields it maps.The regression
request,mcpandcompletionare ungated.agentsits behindread_agent,delegationbehindread_delegation, and security labels behindread_labels.Reproduced through
examples/panic_drive.rs, which drives a real engine throughload_config. The unit tests buildExtensionsdirectly and never reach the filter, which is why 34 green did not catch it:499ee91(old)ai_agent.uid: agent-75b76fa6(new)ai_agentblock, still chains, still signs, still verifies offline5b76fa6(new)ai_agent.uid: agent-7againThe middle row is the point. Records still emit, still chain and still pass offline verification while carrying less than they should. A verifier cannot distinguish "no delegation occurred" from "the sink was not permitted to see it", which is the failure mode this project exists to prevent. A load error would have been better.
The change
panic_drive.rsand both README wiring examples declare the three capabilities.5b76fa6, withCargo.lockregenerated.PRAXIS-INTREE-PLAN.mdrecords the finding and the state of the five review items under a 2026-09-10 status.The cpex host accepts the
capabilities:key and is unaffected, verified by runningpanic_driveon it.The seam itself held
AuditHandler::handle,on_effectandPlugin::as_audit_handlerare unchanged at the new head, so the crate needed no source change. OnlyExecutor::with_audit_handlerschanged shape, and that is host-side.The same head also answers our review comment on #84:
emit_decisionis the single verdict finalizer, route-resolution denials seed a decision log, and reconciled effects take their place in the current stream rather than under the sequence numbers of the run that crashed, which was the AID-EMIT-1 section 7 density concern.Verification
Run the way CI runs it, toolchain 1.96.1, cpex sibling at
64c8eba:check --locked --all-targets,RUSTFLAGS=-D warningstest --lockedemit_samplevs the AID-EMIT-1 section 12 vectorSplit out of #529, which is docs only and now carries just the ocsf#1756 filing.
🤖 Generated with Claude Code
https://claude.ai/code/session_01XyU3PRkgvMxgimkPBC5726
Generated by Claude Code