jedarden/pdftract
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
721 commits 1 branch 0 tags 7.5 GiB
Commit graph

3 commits

Author SHA1 Message Date
jedarden
d03196eb04 docs(pdftract-4em4l): verify audit logging implementation complete 
- --audit-log FILE flag implemented on serve, mcp, inspect subcommands
- Per-request NDJSON line written with all documented fields (ts, client_ip, tool, fingerprint, duration_ms, status, diagnostics)
- Stdio MCP requests omit client_ip field (vs empty string)
- Log-policy enforcement via redact_audit_log_line() in log_policy.rs
- Rotation policy documented in --help output (logrotate, not built-in)
- Fingerprint logged, NOT path/URL
- AuditLogWriter crash-safe (single-write per line, flush after each write)

All acceptance criteria PASS. Infrastructure complete across:
- Serve mode (pdftract-cli/src/serve.rs)
- MCP HTTP mode (pdftract-cli/src/mcp/http.rs)
- MCP stdio mode (pdftract-cli/src/mcp/stdio.rs)
- Inspect mode (pdftract-cli/src/inspect/inspect.rs)

TH-08 test exists at tests/security/TH-08-log-audit.rs for NEVER-log verification.
 2026-05-29 01:05:37 -04:00
jedarden
8d06ad24ae docs(pdftract-4em4l): verify audit logging implementation complete 
Verification of pdftract-4em4l audit logging requirements:
- --audit-log FILE flag on serve, mcp, inspect subcommands ✅
- Per-request NDJSON with ts, client_ip, tool, fingerprint, duration_ms, status, diagnostics ✅
- Stdio MCP omits client_ip field (None, not empty string) ✅
- NEVER-log policy enforcement via log_policy.rs ✅
- Rotation policy documented in --help output ✅
- Fingerprint logged, not path/URL ✅
- AuditLogWriter crash-safe (BufWriter + flush) ✅
- TH-08 test at tests/security/TH-08-log-audit.rs ✅

All infrastructure was already in place. No code changes required.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-28 21:18:38 -04:00
jedarden
255d9c593b docs(pdftract-4em4l): audit logging implementation verification 
Add verification note documenting that all acceptance criteria for
the --audit-log flag and audit logging infrastructure are already
implemented in the codebase.

Acceptance criteria verified:
- --audit-log FILE flag on serve, mcp, and inspect subcommands
- Per-request NDJSON line with all documented fields
- Stdio MCP omits client_ip field
- Log-policy enforcement (compile-time CI gate + runtime redaction)
- TH-08 test for log policy verification
- Rotation policy documented in --help
- Fingerprint logged instead of path/URL
- AuditLogWriter is crash-safe

All audit module tests pass (6/6).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-28 14:36:45 -04:00