Audit evidence plane: implementation status
Status: foundation implemented; external evidence-grade deployment controls still required.
The repository now implements the core evidence mechanics needed for an enterprise pilot. It would be inaccurate to describe the default installation as durable WORM or a complete evidence-grade compliance plane.
Implemented in the project
- privacy-safe structured audit metadata;
- SHA-256 predecessor links, stable chain IDs, and monotonic sequence numbers;
- Ed25519 signatures and public-key fingerprints;
- offline verification of hashes, signatures, ordering, gaps, and key mismatch;
- a tamper negative control in the public conformance harness;
- default bounded
best_effortdelivery with drop metrics; - opt-in
durableandrequiredlocal JSONL modes with acknowledgement, flush/fsync, and restart recovery; - OSCAL 1.2 assessment-result export and integrity-manifested compliance packs.
Not supplied by the local proxy
| Required production property | Why the current process cannot establish it | Deployment or roadmap action |
|---|---|---|
| Immutable WORM retention | A local administrator can delete or replace a JSONL file | Export to independently configured object-lock/compliance-mode storage and test retention policy |
| Deleted-suffix detection | A shortened internally valid chain has no terminal reference | Periodically anchor final chain ID, sequence, and hash in an independent trust domain |
| Production key identity | The default key is ephemeral and self-asserted | Use managed key provisioning, custody, rotation, revocation, and public-key archival |
| Global multi-worker ordering | Each process has its own chain and file | Aggregate per-instance chains with signed checkpoints and an explicit ordering/correlation model |
| Complete event capture | best_effort may drop under pressure | Select durable/required, alert on failures, and test failure semantics |
| Regulatory attestation | Software artifacts are not an auditor opinion | Operate controls, collect evidence over the audit period, and obtain independent assessment |
Recommended pilot profile
Use a stable signing key, a unique durable path per process, AUDIT_DURABILITY=required when audit loss must fail the request, an external immutable sink, and a separately retained checkpoint. Exercise disk-full, permission, restart, truncation, wrong-key, tampering, and queue-pressure cases before production.
The audit contract contains the configuration details. The Open Conformance Lab tests verifier behavior but does not validate your storage or key-management controls.