Memory
DECISION CANDIDATE — AUDIT-LOG BOUNDARY (Sep 6, 2026, ~5:50pm BST — Mike + Perplexity; direction, not yet ruled; CORRECTED in-session: the capability is a GATEKEEPER, with a thin per-workspace gadget only if a UI is required): build the audit log as a purpose-built gatekeeper, contract-first, rather than adopting OpenLogger (VPS, or CF Containers + FUSE-to-R2) or going Artifacts-only. RATIONALE: (1) authority separation — the evidence store for governed actions must sit at the governance plane, not inside the governed workspace; a workspace gadget holding its own audit trail leaves write authority with the audited party. Fits gatekeeper-family principle 6ed41ea6 and the existing family (scheduler, context, github); the scheduled-tasks gatekeeper also fires its anchoring. (2) Contract-first immutability: no update/delete in the contract = none in the deployed surface; append-only by construction, health-endpoint verifiable per DEPLOYER §8. (3) Tamper-evidence: hash-chained event rows in DO-backed storage (one DO per account/customer); scheduled-tasks gatekeeper anchors head hash + day batches into Cloudflare Artifacts (content-addressed Git-compatible storage). (4) Economics: DO-backed gatekeeper is storage-only at idle — the dormancy premise holds here where it failed for CF Containers (~25 GiB-hrs/month included on Workers Paid; sustained traffic ≈ VPS-level cost). UI: gatekeeper stays headless; if a browse UI is required, a per-workspace gadget fronts the gatekeeper's read surface (gadgets host UIs, gatekeepers hold authority). OpenLogger could survive only as a disposable read-replica viewer hydrating from exports, never system of record. REJECTED OPTIONS: OpenLogger on VPS (egress outside the platform boundary; 'immutable' = insert-only API over mutable text files, no tamper evidence); OpenLogger on CF Containers with s3fs-FUSE to R2 (database-on-object-store-FUSE is a documented corruption/data-loss class — buffered writes lost on container sleep, non-atomic full-file rewrites — and the Artifacts watcher would anchor corrupt bytes). OPEN: audit gatekeeper contract drafting (name registered per NAMING_CONTRACT once the naming-registry gadget exists — chicken-and-egg already recorded); account model (per-customer vs per-workspace accounts); Artifacts ref-protection / append-only spike; auditor read path (34b0f4a0 consumes the evidence stream). RELATED: gatekeeper-family principle 6ed41ea6; NAMING_CONTRACT §2; evidence standard a5e10e10; MINI_SPHERE_CONTRACT@0.1 (pin B846EDB4DB3F1F6D3E30534974D30ECCE59F1F9FC6D940E151627FB2D18D60F7, commit b5cfab48); mini-sphere design/spike 03005dfe (Facets cannot self-alarm); three-layers 2144b79b.
Tags: docuclear, audit-log, decision-candidate, gatekeeper, gadget, artifacts, openlogger, contracts, volatility:state, project:docuclear, kind:episodic — Source: mcp — 2026-09-06 16:52:18 UTC