Struct AuditLogger 

pub struct AuditLogger { /* private fields */ }

Audit logger

Implementations

impl AuditLogger

pub fn new(config: AuditConfig, zeroclaw_dir: PathBuf) -> Result<Self>

Construct a logger over <zeroclaw_dir>/<config.log_path>.

One instance per file. The Merkle chain’s sequence and prev_hash live in this struct’s mutex, so the mutex serializes only the writers that go through THIS instance. Two loggers over one file each recover the same tip at construction and then both claim it, producing duplicate sequence numbers and broken links that make verify_chain reject the file — see two_loggers_on_one_file_duplicate_a_sequence.

Production code must therefore never construct a logger per request or per subsystem. Build one at daemon startup with AuditLogger::open_shared and inject the Arc; the certificate paths reach it through RpcContext::cert_audit. This constructor stays public for tests and for the single startup call behind open_shared.

pub fn open_shared( config: AuditConfig, zeroclaw_dir: PathBuf, ) -> Result<Arc<Self>>

Open THE audit logger for zeroclaw_dir — the single instance every certificate path in a daemon shares.

Returns an Arc because sharing is the whole point: enrollment, renewal and the issued-cert ledger all append to one file, and the chain is only consistent while one instance owns it (see AuditLogger::new for what a second instance does). Call this once per daemon iteration, store it in RpcContext::cert_audit, and clone the Arc into every consumer.

pub fn log(&self, event: &AuditEvent) -> Result<()>

Log an event.

One event is one atomic step. The chain lock spans rotation, sequencing, hashing, signing, serialization AND the durable append, and the in-memory chain state is committed only after sync_all returns. Two properties the trail depends on follow from that order:

• Concurrent callers cannot interleave. If the lock were released before the append, two threads could take sequences 0 and 1 and then write their lines in the opposite order — verify_chain rejects the file even though each write was individually correct.
• A failed append changes nothing. Rotation, serialization, open, write and fsync all fail before the commit, so the state stays exactly as it was and the caller’s retry reuses the same sequence and prev_hash. Advancing first left the in-memory chain ahead of the file, and every later entry then linked to a hash that was never written.

Both properties hold only WITHIN one instance: one AuditLogger per file is a hard requirement, see AuditLogger::new.

pub fn log_command_event(&self, entry: CommandExecutionLog<'_>) -> Result<()>

Log a command execution event.

pub fn log_command( &self, channel: &str, command: &str, risk_level: &str, approved: bool, allowed: bool, success: bool, duration_ms: u64, ) -> Result<()>

Backward-compatible helper to log a command execution event.