Joseph Doherty
3.2 KiB
ZB.MOM.WW.Audit
Shared audit event model + writer seam for the ZB.MOM.WW SCADA family (single package; DEEP-adopted by all apps as the canonical record). Build/test from this directory: dotnet test. Component spec + gaps: ../components/audit/.
Index history (migrated from the scadaproj root CLAUDE.md)
Moved verbatim out of the scadaproj root
CLAUDE.mdon 2026-09-03 so it loads only when needed. This file is now the authoritative place for this history — append new entries here and keep the root index row short.
Narrative
The audit component is fully populated: a normalized spec, an
event-model reference, a
shared-contract, three
current-state docs, and an adoption GAPS
backlog. Common ground = canonical AuditEvent record + AuditOutcome enum + IAuditWriter /
IAuditRedactor seams + helpers (NullAuditRedactor, TruncatingAuditRedactor, NoOpAuditWriter,
CompositeAuditWriter, RedactingAuditWriter) + AddZbAudit DI registration; left per-project =
transport/storage and domain vocabulary. Closes the loop on Auth — audit's Actor field = the Auth
principal. IAuditRedactor is aligned with Telemetry's ILogRedactor seam convention.
The shared library is built and lives in this repo at ZB.MOM.WW.Audit/
(.NET 10; 1 package — ZB.MOM.WW.Audit; only non-BCL dependency Microsoft.Extensions.DependencyInjection.Abstractions;
23 tests (verified 2026-07-18); dotnet pack → 1 nupkg @ 0.1.0). Repo: https://gitea.dohertylan.com/dohertj2/zb-mom-ww-audit.
Adopted across all three apps on 2026-06-02 (audit GAPS #1–#6) on each repo's feat/adopt-zb-audit branch
(stacked on feat/adopt-zb-auth) — committed + reviewed, then merged into the repo's local default (main/master)
and PUSHED to origin (gitea) on 2026-06-03 (in sync). Depth =
DEEP adopt (the canonical 9-field AuditEvent is the record everywhere; domain fields ride in DetailsJson).
OtOpcUa: canonical record + AuditWriterActor : IAuditWriter + Outcome column/migration + ClusterAudit fix.
MxGateway: new canonical SQLite audit_event store + IAuditWriter + IApiKeyAuditStore→canonical adapter.
ScadaBridge: a full audit-subsystem re-architecture (the program's largest task) — canonical record everywhere via a
deterministic codec; site SQLite split into audit_event + an audit_forward_state forwarding sidecar; central
partitioned dbo.AuditLog collapsed to 10 canonical cols + persisted computed cols (CollapseAuditLogToCanonical
migration, MSSQL-verified). Phase 3 wires Actor from the Auth principal at authenticated emit sites (per-app
IAuditActorAccessor). Per-repo detail in components/audit/GAPS.md +
docs/plans/2026-06-02-auth-audit-normalization-phase2-deep.md + …-scadabridge-audit-rearch.md.
Build/test from ZB.MOM.WW.Audit/: dotnet test. Consumer matrix: all three apps consume the single
ZB.MOM.WW.Audit package (OtOpcUa, MxAccessGateway, ScadaBridge — DEEP-adopted as the canonical record).