Audit as a First-Class Contract
Many policy engines emit audit logs as an afterthought — or omit them entirely. hp-guard treats audit as a first-class contract.
JSON Lines Format
Authorization records are written as JSON Lines to a durable audit log. Each entry includes:
timestamp(ISO format)agenttooldecision(allow/deny/throttle/etc.)matched_rules(indices of rules that influenced the decision)
args are omitted by default for privacy. Audit failure is fail-closed: the adapter returns no effect.
Explicit Policy LifeCycle — Deliberate Boundaries
The project maintains explicit boundaries around what audit does and does not provide:
| Boundary | What It Means |
|---|---|
| No encryption at rest | Relies on filesystem permissions |
| No tamper-evident records | A crash can lose in-flight records |
| No replicated store | Single-process writer lease on Unix |
| No write-ahead log | Durable recovery intentionally unsupported on non-Unix platforms |
This is a deliberate choice: auditability without building a full security perimeter. The spec states: "Hardpoint Guardian is an authorization decision component, not a complete security perimeter."
Durable Log Recovery
The conformance test durable_log_recovery_v1.json tests recovery of a torn final record or interrupted bounded rotation — a minimal, intentional boundary, not a full WAL or replicated log.