feat(cognition): audit-recorder (MODULE-CATALOG #1 ranked module)

src/shared/generated/cognition/AuditEntry.ts

@@ -0,0 +1,46 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AuditEntryKind } from "./AuditEntryKind";
+
+/**
+ * One audit log entry. Append-only — entries are written once, never
+ * modified. The `chain_hash` is computed from the entry's content + the
+ * previous entry's chain_hash, forming the tamper-detection chain.
+ *
+ * The `payload` field is a free-form JSON value — each kind has its
+ * own payload shape that downstream tooling decodes. Keeping the wire
+ * format open-ended means new audit kinds can ship without a schema
+ * migration; tooling that doesn't recognize a kind just records the
+ * raw JSON.
+ */
+export type AuditEntry = { 
+/**
+ * Monotonic sequence number. Starts at 0 for the genesis entry.
+ * Verifier asserts seq == prev_seq + 1 — gap detection.
+ */
+seq: number, 
+/**
+ * Unix-ms timestamp the entry was recorded. Caller's clock —
+ * verifier asserts monotonic-non-decreasing across entries.
+ */
+timestampMs: number, 
+/**
+ * Which event kind this entry records.
+ */
+kind: AuditEntryKind, 
+/**
+ * Free-form JSON payload for this entry. Shape per-kind; the
+ * recorder doesn't validate the inner shape (downstream tooling
+ * does). On the TS wire it surfaces as `unknown` — consumers
+ * narrow by `kind`.
+ */
+payload: unknown, 
+/**
+ * Hex-encoded SHA-256 chain hash:
+ * `sha256(seq || timestamp_ms || kind || payload || prev_chain_hash)`.
+ * Genesis entry's prev_chain_hash is the all-zeros string of length 64.
+ */
+chainHash: string, 
+/**
+ * The hash of the previous entry. Genesis = "0" * 64.
+ */
+prevChainHash: string, };

src/shared/generated/cognition/AuditEntryKind.ts

@@ -0,0 +1,23 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * The four kinds of events the audit-recorder pins to disk per
+ * MODULE-CATALOG's subscription list. New kinds extend this enum;
+ * adding a kind is a non-breaking change to the wire format because
+ * it's serialized as a tagged string (`kind: "refusal"`).
+ *
+ * Today's set:
+ *
+ * - `Refusal` — a turn / dispatch / inference call was refused with a
+ *   typed reason. Composes with the residency gate's `ResidencyBlock`
+ *   (#1338) — every Block emits a Refusal audit entry.
+ * - `GovernorOverride` — the substrate governor overrode a module's
+ *   own lease request (e.g. lowered concurrency below what the module
+ *   asked for, evicted a working-set entry the module wanted to keep).
+ * - `FederationPolicyDrift` — a peer node's federation policy diverged
+ *   from our local policy. The drift gets logged; resolution is a
+ *   policy concern.
+ * - `AccessDenied` — the MMU-style genome permission table denied a
+ *   read / write / execute. Compartmentalization audit trail.
+ */
+export type AuditEntryKind = "refusal" | "governor-override" | "federation-policy-drift" | "access-denied";

src/shared/generated/cognition/index.ts

@@ -8,6 +8,8 @@ export type { AIGatingDecisionFactors } from './AIGatingDecisionFactors';
 export type { AdaptiveThroughputPlan } from './AdaptiveThroughputPlan';
 export type { AdaptiveThroughputRequest } from './AdaptiveThroughputRequest';
 export type { AnalysisError } from './AnalysisError';
+export type { AuditEntry } from './AuditEntry';
+export type { AuditEntryKind } from './AuditEntryKind';
 export type { GatingConversationMessage } from './GatingConversationMessage';
 export type { GatingMessageContent } from './GatingMessageContent';
 export type { GatingRagContext } from './GatingRagContext';