kumwe / audit

v0.1.2 2026-09-08 15:58 UTC

Requires

• php: ^8.5
• ext-json: *
• kumwe/access-context: 0.1.2
• kumwe/canonical-json: 0.1.1

Requires (Dev)

• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^12.5
• squizlabs/php_codesniffer: ^4.0

Apache-2.0

Published on Packagist.org on 2026-09-08 15:59 UTC

README

Bounded immutable audit events, secret redaction, versioned event and anchor digests, evidence values and host storage ports under Kumwe\Audit. Requires PHP 8.5, JSON, exact Canonical JSON 0.1.1 and Access Context 0.1.2.

Installation and use

Install the published package with an exact pre-1.0 pin:

composer require kumwe/audit:0.1.2

<?php

require 'vendor/autoload.php';

use Kumwe\Audit\Application\AuditMetadataRedactor;

$redactedCount = 0;
$safeMetadata = AuditMetadataRedactor::redact([
    'request_id' => 'request-1',
    'api_key' => 'example-secret',
], $redactedCount);
assert($safeMetadata['api_key'] === '[redacted]');
assert($redactedCount === 1);

Digest operations require an explicitly supplied Kumwe\CanonicalJson\CanonicalEncoder conforming to kumwe-canonical-json/generic-v1. There is no encoder fallback. The typed consumer example demonstrates recorder/storage adapters, redaction and evidence.

Core integration

Core binds AuditRecorder, AuditArchiveStorage, AuditTrailExporter and AuditTrailVerifier to its own adapters. Values and static helpers are constructed or called directly; no ConfigProvider is needed. Core owns authorization, transaction coupling, database guards, privileged export, retention, key custody and operational verification. The Core contract and integration guide define those boundaries.

Public API, architecture, charter and release record describe the package and its consumer compatibility contract. Published versions and source CI status are linked above; Core validates its own integration against selected versions.

Development and releases

composer install
composer check
composer examples

composer clean-consumer builds isolated ZIPs from this checkout and its installed declared Kumwe dependencies, installs a fresh no-dev authoritative consumer, and executes the shipped example. That proves composition; independent release verification binds the actual published source and archives. The package release standard describes publication and verification requirements. Licensed under Apache-2.0.