Skip to content

v0.4.0 — Structured audit logging

Choose a tag to compare

View all tags
@fastrevmd-lab fastrevmd-lab released this 26 Jul 01:27
· 78 commits to main since this release
v0.4.0
471f553
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Structured audit logging via the shared mecmcp-audit crate (audit-v0.1.5). One event per tool call with caller attribution, target devices, outcome, and execution duration. Previously the server contained only an AUDIT_TARGET constant with no active logging.
  • Change-set lifecycle auditing. create_panos_change_set, approve_panos_change_set, and apply_panos_change_set each emit an audit event. The approval event carries both the change-set id and the fingerprint digest, providing independent evidence that a second principal reviewed the exact digest later applied. Previously mutation-state.json — a file the server itself rewrites — was the only record of approval.
  • New CLI flags for audit configuration:
    • --audit-format — choose json (default, machine-parseable) or pretty (human-readable).
    • --audit-log-file — write audit events to a file path.
    • --audit-journald — emit audit events to systemd journal.
    • --audit-redact — HMAC-pseudonymise declared fields (device names, caller identity) so the log can be shipped to a SIEM without leaking operational identifiers.
    • --audit-hmac-key-file — path to the HMAC key for redaction; required when --audit-redact is enabled.
  • Structured Attribution (Human/Agent, on_behalf_of, change_ref) carried through the audit path and included in every logged event.

See CHANGELOG.md for complete details.

Assets 4
Loading