Skip to content

docs(integrations): decision-sink demo — run the cpex#166 seam end-to-end and print the OCSF records - #479

Merged
Levaj2000 merged 1 commit into
mainfrom
claude/publishing-opportunity-xul1qe
Aug 21, 2026
Merged

docs(integrations): decision-sink demo — run the cpex#166 seam end-to-end and print the OCSF records#479
Levaj2000 merged 1 commit into
mainfrom
claude/publishing-opportunity-xul1qe

Conversation

@Levaj2000

Copy link
Copy Markdown
Owner

Makes the CPEX ↔ audit-seam ↔ plugin integration (#456/#457, cpex#166) visibly runnable in one command.

What it adds

examples/decision_sink_demo.rs — builds a sink-mode emitter (no hooks:, so it attaches as an AuditHandler exactly as in production), feeds it four finalized DecisionLogs the way the executor would (ordered steps, terminal verdict, span, (epoch, stream_id, stream_seq, emission_seq) stamps), and pretty-prints the resulting OCSF records:

  1. Clean allowaction: Allowed / disposition: Allowed
  2. Allow after modificationaction: Modified (never re-coded as a plain allow)
  3. Denyaction: Denied / disposition: Blocked, violation at status_code/status_detail — the record a post-hook observer can never produce
  4. Suppressed deny + aborted branch → flat deny_ignored: true flag plus per-step deny_ignored/aborted actions — "every suppressed transform deny" as one SIEM query

Deterministic timestamps and stream stamps, mirroring emit_sample (which remains the dispatch-half demo: hash chain + DSSE verification).

Verified live before this PR

  • cpex cloned at the verified seam revision feat/audit-seam @ 386710a, rustc 1.96 (MSRV pin honored)
  • cargo test: 32/32 green
  • cargo run --example decision_sink_demo and cargo run --example emit_sample both produce the expected output (chain checks and DSSE verification all true)

Run it

rustup toolchain install 1.96 && rustup default 1.96
git clone -b feat/audit-seam https://github.com/contextforge-org/cpex ../cpex && git -C ../cpex checkout 386710a
cd integrations/cpex-ocsf-audit
cargo test && cargo run --example decision_sink_demo

Docs/demo only — no product code changes. CHANGELOG entry included.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112fqxp71zJFg7ENqUoSGEA


Generated by Claude Code

…-end and print the OCSF records

Four finalized DecisionLogs through the sink-mode emitter: allow,
allow-after-modification, deny (violation at status_code/status_detail),
and suppressed deny (deny_ignored flag + aborted step). Deterministic
output; complements emit_sample's dispatch/chain half. Verified live
against cpex feat/audit-seam @ 386710a: 32/32 tests, both examples.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0112fqxp71zJFg7ENqUoSGEA
@vercel

vercel Bot commented Aug 21, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
ai-identity-landing Ready Ready Preview Aug 21, 2026 4:11am
dashboard Ready Ready Preview Aug 21, 2026 4:11am

@Levaj2000
Levaj2000 marked this pull request as ready for review August 21, 2026 04:57
@Levaj2000
Levaj2000 merged commit 09af611 into main Aug 21, 2026
11 checks passed
@Levaj2000
Levaj2000 deleted the claude/publishing-opportunity-xul1qe branch August 21, 2026 04:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants