Repository navigation
fix(minimald): bound the decision audit log and fail closed on an unrecordable allow #1911
Description
The dynamic-ingress decision audit log (crates/minimald/src/audit.rs, decisions.log under the state directory's audit/) has two durability gaps. Both were left out of the task that added it (#1891) and are tracked here together.
- No rotation or cap. The log is append-only and grows without bound. Add size-based rotation or a cap that keeps a bounded tail. The daemon's state dump, which reads the log's tail, must keep working across a rotation.
- A decision whose audit append fails is still applied. When
appendrefuses (for example a planted symlink in place ofaudit/ordecisions.log) or fails (for example a full disk), the warn line is logged and the decision goes ahead unrecorded. NET-046 requires every decision to be recorded. Fail closed on an unrecordable allow: refuse the exposure and log why. An unrecordable deny still applies, because refusing it would open the port.
Tests: an allow whose append is refused is not published; a deny whose append is refused still refuses; rotation keeps the newest records and the state dump's tail still reads them.
Spec: NET-046 (spec 18).
Activity
norrietaylor commentedon Oct 17, 2026
Closing: done by #2027 on main.