feat(tx-killswitch): audit remote-driven gate transitions - #132
Merged
Conversation
The local Stop/Resume button writes a tx-control audit row on every press; remote-driven gate flips were silent. Now they audit symmetrically, so reviewing audit history shows both signals' impact. Logic: - First successful poll says BLOCK -> audit (the kill-switch is active right now is genuinely notable). - First successful poll says ALLOW -> no audit (steady state on every startup would be log noise). - ALLOW -> BLOCK transition: audit "BLOCK (was ALLOW): <reason>". - BLOCK -> ALLOW transition: audit "ALLOW (was BLOCK): <reason>". - Steady-state polls (same result as last time): no audit. - Failed polls: no audit (no state change to record). - Block targeted at other callsigns: counts as ALLOW for us, no audit on first poll. Audit kind is "tx-control" (matches the local toggle) and bearer is "remote" (the local toggle uses "ui"). Operators filtering for tx-control rows see both signals; the bearer field disambiguates. 7 new tests in TxKillSwitchPollerAuditTests cover each branch. TransmissionAuditService is injected nullable so the existing 18 poller tests don't need DB plumbing. Tests: 644/644 (was 637; added 7).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the asymmetry in audit coverage left over from the kill-switch trilogy. The local Stop/Resume button writes a `tx-control` row on every press; remote-driven gate flips were silent. Now they audit symmetrically.
What gets audited
`Kind="tx-control"` matches the local toggle; `Bearer="remote"` (the local toggle uses `"ui"`) so an operator filtering by bearer can separate the two signals.
Test plan
🤖 Generated with Claude Code