stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
5593212b414864ab213082c8945a267451b99901
git.stella-ops.org/docs/features/checked/timeline/immutable-audit-log.md

3.2 KiB
Raw Blame History

Immutable Audit Log (Timeline)

Module

Timeline

Status

VERIFIED

Description

Immutable timeline audit log with a dedicated web service and indexer for recording all scan, attestation, and verdict events.

Implementation Details

  • TimelineQueryService: src/Timeline/__Libraries/StellaOps.Timeline.Core/TimelineQueryService.cs -- append-only event store query layer: GetByCorrelationIdAsync (with HLC range, service/kind filters, pagination), GetCriticalPathAsync (causal latency analysis), GetByServiceAsync (service-scoped queries)
  • ITimelineEventStore: referenced from StellaOps.Eventing.Storage -- append-only persistence interface: events stored with deterministic EventId (SHA-256 of correlation_id+t_hlc+service+kind), HLC timestamps, payload digests, engine version fingerprints
  • TimelineEndpoints: src/Timeline/StellaOps.Timeline.WebService/Endpoints/TimelineEndpoints.cs -- REST API at /api/v1/timeline: GET /{correlationId} returns immutable event chain, GET /{correlationId}/critical-path for latency analysis
  • ExportEndpoints: src/Timeline/StellaOps.Timeline.WebService/Endpoints/ExportEndpoints.cs -- forensic export at /api/v1/timeline/{correlationId}/export: NDJSON/JSON bundle with optional DSSE signing for evidence preservation
  • TimelineBundleBuilder: src/Timeline/__Libraries/StellaOps.Timeline.Core/Export/TimelineBundleBuilder.cs -- builds NDJSON/JSON export bundles with event metadata (event_id, t_hlc, ts_wall, service, kind, payload_digest, engine_version); optional DSSE signing via IEventSigner
  • HealthEndpoints: src/Timeline/StellaOps.Timeline.WebService/Endpoints/HealthEndpoints.cs -- service health monitoring
  • TimelineAuthorizationMiddleware: src/Timeline/StellaOps.Timeline.WebService/Authorization/TimelineAuthorizationMiddleware.cs -- authorization for timeline access
  • Tests: src/Timeline/__Tests/StellaOps.Timeline.WebService.Tests/TimelineApiIntegrationTests.cs
  • Source: Feature matrix scan

E2E Test Plan

  • Verify events stored are immutable (no update/delete operations exposed)
  • Verify event IDs are deterministic based on correlation_id + t_hlc + service + kind
  • Test export endpoint produces valid NDJSON bundle with all event metadata
  • Verify DSSE-signed export bundles can be verified with the signing key
  • Test JSON export format includes event metadata section with count and export timestamp
  • Verify payload digests in exported events match original payloads
  • Test authorization middleware restricts timeline access to authorized users

Verification

Run ID: run-001 Date: 2026-02-10 Verdict: PASS

Implementation Verification:

  • Append-only enforced architecturally: ITimelineEventStore has AppendAsync only (no update/delete)
  • REST API has GET-only endpoints for events
  • TimelineAuthorizationMiddleware with tenant isolation
  • DSSE-signed forensic export via TimelineBundleBuilder
  • Integration tests verify GET-only access pattern

Test Execution:

  • Immutability tests PASS
  • Deterministic event ID tests PASS
  • Export format tests PASS
  • Authorization tests PASS

Build Status:

  • 0 errors
  • 0 warnings
  • Build: PASS

Overall Verdict: PASS