[P0] Add sanitized audit logging and operational hardening #12

New issue

Closed

opened 2026-07-17 23:59:35 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-17 23:59:35 +00:00

(Migrated from github.com)

Goal

Make system behavior inspectable without leaking captured content or secrets.

Requirements

Structured audit events for state changes, policy decisions, provider selection, rejected records, deletion, export, and key operations.
Never log screenshots, OCR text, window titles, command lines, usernames, tokens, or provider prompts.
Stable opaque IDs for correlation.
Configurable log retention and permissions.
Disable or document crash dumps; avoid plaintext temporary files and unsafe debug modes.
Detect insecure storage permissions at startup and fail closed.

Acceptance criteria

Automated tests scan logs for seeded secrets and captured fixture text.
Audit logs can explain why a frame was captured, skipped, rejected, or deleted without exposing its content.
Debug logging cannot bypass sanitization.
Default file permissions are owner-only.

Depends on

## Goal Make system behavior inspectable without leaking captured content or secrets. ## Requirements - Structured audit events for state changes, policy decisions, provider selection, rejected records, deletion, export, and key operations. - Never log screenshots, OCR text, window titles, command lines, usernames, tokens, or provider prompts. - Stable opaque IDs for correlation. - Configurable log retention and permissions. - Disable or document crash dumps; avoid plaintext temporary files and unsafe debug modes. - Detect insecure storage permissions at startup and fail closed. ## Acceptance criteria - Automated tests scan logs for seeded secrets and captured fixture text. - Audit logs can explain why a frame was captured, skipped, rejected, or deleted without exposing its content. - Debug logging cannot bypass sanitization. - Default file permissions are owner-only. ## Depends on - #2 - #7 - #11