4 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Opus 5.5	4ba9d20b4e	fix(ingestion): tripwire alerts survive outages; drop only permanent rejections ... PR #160 round 2: dropping a message after 5 failures could not tell a poison message from an ntfy outage. A 15-minute outage dropped the only incident with nothing reported, and drops were not counted (74 of 300 removals were neither delivered nor counted). - audit.NtfyNotifier returns *RejectedError for non-2xx; Permanent() is true for 4xx other than 429. - The tripwire queue drops a message only on a permanent rejection and counts it; every other failure is an outage and is retried, however long. Each flush tries every queued message, so an undeliverable one cannot block the rest. - Overflow and drops go into one counter, sent as a summary retried every tick and never dropped. Every removal is delivered or counted. Tests (red first): an outage of ~100 ticks still delivers the only incident; delivered + counted equals the number of removals; a permanently rejected message is dropped and counted. The short-outage test is renamed to say it is short. The Watch doc no longer claims 'loses none' unconditionally. Refs #157 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 18:30:46 +02:00
mathias	1a9be0cfb1	style: apply gofmt ... Estate-wide consolidation pass. golangci-lint v2 default set enables NO formatter, so gofmt drift accumulated silently across the estate -- 8 repos were carrying it, this one included. Same hole that let two files rot in dma-cli until they were found by hand (dma-cli#12). Mechanical and deterministic: `gofmt -w`, nothing hand-edited. Verified before commit -- gofmt -l now reports 0, go build and go vet both pass. Clears this repo to adopt the canonical .golangci.yml (infra ci-templates/golangci.yml, infra#309 pattern) in a later wave.	2026-09-05 12:40:34 +02:00
mathiasandClaude Opus 4.8	77f5e06d6b	feat(audit): DegradingSink + durable buffer + loki/ntfy + reconcile (#54) ... The classification-aware I5 audit path (§4.4): - DegradingSink.Reserve: central up → AuditCentral; central down + confidential → refuse (no buffer); central down + internal/public + buffer writable → AuditBuffered; central down + buffer unwritable → floor refuse. Record executes the reserved outcome and, when buffered, fires an ntfy alert. - FileBuffer: durable JSONL buffer that survives process restart; Confirm rewrites the file without a record, so a buffered record is cleared ONLY after its central write is confirmed. - LokiCentral: /ready probe + /loki/api/v1/push (full audit entry as the structured line). NtfyNotifier: degraded-state alerts; token only in the auth header, never logged (regression-tested). - Reconcile + StartReconcile: replay buffered records to central on recovery, confirm-then-clear per record; a failed push keeps the record buffered (no loss). SlogSink updated to the two-phase shape (always central, never fails) — the default when no loki endpoint is set. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-22 23:54:24 +02:00
mathiasandClaude Opus 4.8	77680c7445	feat(audit): minimal slog AuditSink for capture I5 (#53) ... Emits the request-level audit record to structured logs (scraped by the existing alloy/loki substrate) and surfaces security events at warn level. Placeholder behind the AuditSink interface — the classification- aware loki+buffer+reconcile sink (confidential fails closed, internal degrades) lands in #54 and replaces this without touching callers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-22 23:42:18 +02:00