Unit 2: Registry audit trail — structured mutation logging

[TeoSlayer]

Scope

Structured audit logging for all registry mutations via slog JSON events.

Deliverables

• audit() helper emitting slog JSON events
• 18 mutation handlers instrumented:
  • node.registered, key.rotated
  • network.created, network.joined, network.left, network.deleted, network.renamed
  • trust.created, trust.revoked
  • visibility.changed, task_exec.changed
  • handshake.relayed, handshake.responded
  • hostname.changed, tags.changed
  • node.deregistered
  • invite.created, invite.responded
• Filterable via jq 'select(.msg=="audit")'

Files

• pkg/registry/server.go
• tests/audit_test.go (6 tests)

Status: Complete

[TeoSlayer]

Context

Compliance frameworks (SOC 2, ISO 27001, HIPAA) require immutable, structured audit logs for all state mutations. The audit trail makes every registry change machine-parseable and filterable.

Key Decisions

• slog-based — no new dependency, works with existing --log-format=json flag
• 18 mutation points instrumented (every handler that changes state)
• Filterable via jq 'select(.msg=="audit")' — operators can extract audit events from mixed log streams
• Key attributes vary per action: node_id, network_id, hostname, public, accept — whatever is relevant

Implementation Notes

• Single audit() helper method: slog.Info("audit", append([]any{"audit_action", action}, attrs...)...)
• One-line additions in each handler's success path
• 6 tests including concurrent mutation stress test