Canonical audit event model, best-effort writer seam, and redactor seam for the ZB.MOM.WW SCADA family (OtOpcUa, MxAccessGateway, ScadaBridge). This is a library, not a service — it is linked directly into the consuming application at build time. Transport and storage remain per-project; only the shared record + seams live here.

Packages

Package	Description	Key Dependencies
`ZB.MOM.WW.Audit`	Canonical `AuditEvent` record, `AuditOutcome` enum, `IAuditWriter` + `IAuditRedactor` seams, shipped helpers (`NullAuditRedactor`, `TruncatingAuditRedactor`, `NoOpAuditWriter`, `CompositeAuditWriter`, `RedactingAuditWriter`), and `AddZbAudit` DI extension.	`Microsoft.Extensions.DependencyInjection.Abstractions`

Consumer Matrix

Consumer	ZB.MOM.WW.Audit
OtOpcUa	yes (adoption deferred)
MxAccessGateway	yes (adoption deferred)
ScadaBridge	yes (adoption deferred — "align, don't replace")

Adoption is tracked in components/audit/GAPS.md in the outer scadaproj workspace. Each app brings its own transport (Akka broadcast / SQLite append / SQL ingest) and domain vocabulary (channels / kinds / event-types) — those stay per-project. The shared library provides the canonical record and the two seams that decouple "what to audit" from "how to store it".

Auth alignment

AuditEvent.Actor is a string today. At adoption time it SHOULD be set to the ZB.MOM.WW.Auth principal identifier — this is the "audit closes the loop on Auth" hinge described in the spec. No compile-time dependency on ZB.MOM.WW.Auth is introduced here; the alignment is by convention.

Versioning

The single package is versioned from Directory.Build.props. The current release is 0.1.0. A single version bump in Directory.Build.props bumps the package.

Building and packing

# From ZB.MOM.WW.Audit/
dotnet build ZB.MOM.WW.Audit.slnx
dotnet test  ZB.MOM.WW.Audit.slnx

# Produce the NuGet package into ./artifacts/
./build/pack.sh

Design documentation

Full design docs live in the components/audit folder of the SCADA project workspace:

~/Desktop/scadaproj-audit/components/audit/spec/SPEC.md — overall audit specification
~/Desktop/scadaproj-audit/components/audit/spec/EVENT-MODEL.md — field-by-field event model + per-project mapping table
~/Desktop/scadaproj-audit/components/audit/shared-contract/ZB.MOM.WW.Audit.md — public API contract (on paper)
~/Desktop/scadaproj-audit/components/audit/GAPS.md — adoption backlog