GovOPlaN/govoplan-audit
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add verifiable audit evidence bundles

Browse Source
This commit is contained in:
zemion
2026-08-20 18:00:13 +02:00
parent f07d12fa52
commit 7b43816b22
19 changed files with 2164 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9
View File
@@ -11,6 +11,15 @@ This repository owns the live `audit_log` table, audit API route
contributions, the `@govoplan/audit-webui` package, and the target boundary
for future audit sink/export capability work.
Audit now also owns versioned evidence-bundle export. Authorized auditors can
select a bounded tenant or system record set, attach module-owned external
evidence references, and download a redacted artifact with canonical hashes
and optional Ed25519 signatures. The `govoplan-audit-verify` command validates
the bundle offline and reports unsupported, incomplete, unverifiable, and
tampered evidence separately. See
[docs/EVIDENCE_BUNDLES.md](docs/EVIDENCE_BUNDLES.md) for API permissions,
signing configuration, module contribution rules, and verifier usage.
The WebUI package contributes the `system-audit` and `tenant-audit` admin
sections through the shared `admin.sections` UI capability. The admin shell
does not render audit panels unless this module is installed and enabled.