CDF governance audit event

One line of the append-only governance journal. Rotated files carry the same shape. Deliberately holds a request hash rather than the request, and a sanitised summary rather than content: this file is retained indefinitely, so anything that reaches it is effectively permanent. CORRECTED against real artefacts: event_id and session_id are NOT required. A writer active between 2026-05-12 and 2026-05-15 emitted 61 codex.health.audit_probe records without them. The journal is append-only and retained indefinitely, so those records are permanent and a conformant reader will meet them. Rejecting real evidence would be worse than a slightly weaker schema. The current writer emits both.

Schema
audit-event.schema.json, served as JSON at its $id: https://cognitive-delivery.github.io/contract/1.x/audit-event.schema.json
Dialect
http://json-schema.org/draft-07/schema#
Root
object, open (additional properties are carried)
required: schema_version, timestamp, event_type
Stability
none stated at the root; every declared property carries its own
Properties
21 declared: 21 under the root, 0 in definitions

Properties

Every declared property under the root, in the schema's own order. [] is an array's items, .* the shape of every unnamed member, #name a definition. Objects carry additional properties unless a row says otherwise.

PathTypeRequiredDescriptionConstraintsStability
schema_versionstringyesContract version this record was written against, as major.minor. One rule across every schema (schema set 1.2): a reader compares the major only, and a minor it has not met is additive by the contract's own rule.pattern ^\d+\.\d+$stable
timestampstringyesISO 8601 with a timezone.pattern ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$stable
event_idstringOptional for historical reasons only — see the schema description. Current writers emit it.stable
event_typestringyesWhat happened, as two or more lower-case dotted segments (spec.created, codex.health.audit_probe). OPEN, unlike the CDI signal vocabulary: a product may record its own kinds of event. The reference writer's first segments are reserved for its vocabulary (agent, architecture, artefact, audit, break_glass, cdi, chat, codex, config, decision, deploy, enforcement, evidence, execution, fg, governance, integration, lease, memory, mode, phase, provenance, report, responsible_ai, review, roadmap, security, session, spec, steering, task, tool, ux, work, workbench, workspace); any other writer uses its vendor name as the first segment. Empty, upper case, whitespace and a single segment are refused (schema set 1.2): every one of the 33,608 real records already conformed.pattern ^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$
max length 120		stable
session_idstringOptional for historical reasons only — see the schema description. Current writers emit it.stable
request_idstringstable
spec_slugstringstable
task_idstringstable
phasestringAn OPEN string. This field previously carried a closed six-value software lifecycle union, which meant a product with a different lifecycle could not record its own phase in the shared journal without lying. A reader must tolerate an unrecognised value: not throw, not coerce it to a known one, not drop it.stable
actorobjectWho or what acted. Records the KIND of actor and the model, never a person's name, email or git identity.stable
actor.kindstringyesone of "human", "agent", "system"stable
actor.runtimestringThe client that acted, as a label: the reference deployment has written vscode, claude-code, codex-cli, GitHub Copilot and others. Deliberately OPEN: closing it would reject real evidence. Identity is runtime_agent.stable
actor.model_vendorstringstable
actor.model_familystringstable
actor.model_versionstringstable
actor.runtime_agentstringThe closed agent identity vocabulary the lease carries, so an audit event keys to the same identity (schema set 1.2, optional; a 1.2 writer records it on every agent-kind event). unknown is a first-class value.one of "codex-cli", "claude-code", "gemini-code-assist", "github-copilot", "cdf-native", "unknown"stable
summarystringA sanitised one-line summary, at most 300 characters: the reference writer's own cap. Never prompt text. No control character (U+0000 to U+001F and U+007F, written as literal characters in the pattern so Python's re, RE2 and ECMAScript all read it the same way), tab and newline included: the reference writer replaces them with a space before write.max length 300
must not match [\u0000-\u001f\u007f]		stable
reasoningstringWhy the agent chose this action, at most 500 characters: the reference writer's own cap. Never prompt text. No control character, as summary.max length 500
must not match [\u0000-\u001f\u007f]		stable
request_hashstringSHA-256 of the request, lower-case hex. NEVER the request itself; the pattern refuses anything that is not a 64-character digest.pattern ^[0-9a-f]{64}$stable
outcomestringone of "success", "failure", "partial"stable
detailsobjectFlat scalars only, and keys are filtered by name: a key with a lower-case or camelCase segment that is authorization, content, file, password, path, payload, prompt, request, secret or token is refused by the schema. This approximates the reference writer's rule, which drops such a key before write; the schema is case-sensitive where the writer is not, and propertyNames lists the differences. Do not defeat this by renaming a sensitive field.keys must not match (^|[^A-Za-z0-9])(authorization|content|file|password|path|payload|prompt|request|secret|token)([^A-Za-z0-9]|$)
keys must not match [a-z0-9](Authorization|Content|File|Password|Path|Payload|Prompt|Request|Secret|Token)([^a-z]|$)
keys must not match ^(authorization|content|file|password|path|payload|prompt|request|secret|token)[A-Z]
Approximates the reference writer's rule, which splits a key at camelCase boundaries, lower-cases it, splits it on non-alphanumerics and drops it when any segment is one of ten words: authorization, content, file, password, path, payload, prompt, request, secret, token. The three clauses refuse the lower-case segment form (api_token, file-path), the camelCase interior form (filePath, apiToken) and the camelCase leading form (tokenCount). The differences: the schema is case-sensitive, so it admits Authorization, API_TOKEN, Token, TokenCount, PATH and x-Token, all of which the writer drops; and it ends a camelCase segment at a digit, so it refuses apiToken2 and myFile2, which the writer keeps. estimated_files_touched is legal: files is not file. No lookahead, so RE2 validators load it.
additional properties: see details.*		stable
details.*string | number | booleanA flat scalar; a string value is at most 200 characters, the reference writer's own cap, because details reaches a permanent record.max length 200