openagent-claude-agent · audit
Declared module signatures, types, configuration, and source documentation.
Source: openagent-sdk/integrations/claude-agent-sdk/rust/src/audit.rs. SHA-256: 132364e5627d22ac9cdf310625d67c4fd39583c23ca482194e5fada810de2bcb.
This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.
audit::GENESIS_PREV_HASH
Sentinel for the head of the chain (64 zero hex chars).
pub const GENESIS_PREV_HASH: &str;Source line: 13.
audit::AuditKind
Categories of audit events.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "kebab-case")]
pub enum AuditKind {
/// Session lifecycle: opened.
SessionStart,
/// Session lifecycle: closed.
SessionStop,
/// Tool call preflight (pre-execution scope check).
ToolPreflight,
/// Tool call completed.
ToolComplete,
/// Skill invocation preflight (policy check before body runs).
SkillPreflight,
/// Skill invocation completed.
SkillComplete,
/// Outbound / inbound message audit.
MessageSigned,
/// Generic policy denial.
PolicyDeny,
}Source line: 19.
audit::Outcome
Outcome of an audited operation.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum Outcome {
/// Operation was allowed (gating check).
Allow,
/// Operation was denied (gating check).
Deny,
/// Operation completed successfully.
Ok,
/// Operation failed.
Error,
}Source line: 41.
audit::AuditRecord
One audit record. Hash chained via prev_hash -> hash.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuditRecord {
/// Monotonic sequence within the session.
pub seq: u64,
/// ISO-8601 timestamp.
pub timestamp: String,
/// Session id.
pub session_id: String,
/// Agent DID.
pub agent_did: String,
/// Event category.
pub kind: AuditKind,
/// Tool / skill name when applicable.
#[serde(skip_serializing_if = "Option::is_none")]
pub name: Option<String>,
/// Outcome of the operation.
pub outcome: Outcome,
/// Hash of the request payload.
#[serde(skip_serializing_if = "Option::is_none")]
pub input_hash: Option<String>,
/// Hash of the response payload.
#[serde(skip_serializing_if = "Option::is_none")]
pub output_hash: Option<String>,
/// Pointer to the previous record's `hash` field.
pub prev_hash: String,
/// This record's hash (computed from every field except `hash` itself).
pub hash: String,
/// Free-form context.
#[serde(skip_serializing_if = "Option::is_none")]
pub context: Option<serde_json::Value>
}Source line: 54.
audit::AuditSink
Audit sink trait — implement to ship records to a durable backend.
#[async_trait]
pub trait AuditSink: Send + Sync {
/// Append a single record. MUST be best-effort and non-throwing.
async fn append(&self, record: AuditRecord);
}Source line: 87.
audit::AuditChain
Builds and signs (hash-chains) audit records for a single session.
pub struct AuditChain {
}Source line: 93.
audit::AuditChain::new
Construct a new chain rooted at the genesis prev hash.
pub fn new(
session_id: impl Into<String>,
agent_did: impl Into<String>,
sink: std::sync::Arc<dyn AuditSink>,
) -> Self;Source line: 103.
audit::AuditChain::append
Append a record. Sink errors are swallowed by design.
pub async fn append(
&self,
kind: AuditKind,
name: Option<&str>,
outcome: Outcome,
input_hash: Option<String>,
output_hash: Option<String>,
context: Option<serde_json::Value>,
) -> Result<AuditRecord>;Source line: 118.
audit::AuditChain::head
Current chain head.
pub fn head(&self) -> String;Source line: 166.
audit::hash_record
Compute the hash of a record (excludes the hash field itself).
pub fn hash_record(record: &AuditRecord) -> Result<String>;Source line: 175.
audit::verify_chain
Verify a previously emitted chain.
pub fn verify_chain(records: &[AuditRecord]) -> Result<()>;Source line: 185.
audit::InMemoryAuditSink
In-memory audit sink (handy for tests + dev).
#[derive(Debug, Default)]
pub struct InMemoryAuditSink {
}Source line: 202.
audit::InMemoryAuditSink::new
Construct a new in-memory sink.
pub fn new() -> Self;Source line: 208.
audit::InMemoryAuditSink::snapshot
Snapshot the buffered records (test helper).
pub fn snapshot(&self) -> Vec<AuditRecord>;Source line: 213.
audit::FanOutAuditSink
Fan-out sink: dispatch each record to every inner sink.
pub struct FanOutAuditSink {
}Source line: 231.
audit::FanOutAuditSink::new
Construct a new fan-out sink.
pub fn new(sinks: Vec<std::sync::Arc<dyn AuditSink>>) -> Self;Source line: 237.