[jevt1c]

Component and requirement IDs

• Component: Audit (Team 12)
• Requirements: AUD-01 (contract); AUD-03, AUD-04, SEC-02, OPS-05 (respected by the contract)
• Author(s): Nikola Jevtić (PR 96/2023), story S-02

Changes

Proposes the central audit contract (status: DRAFT, version 0.1) and enforces it in code.

• docs/components/audit/CONTRACTS.md: the contract, event catalog, limits, producer obligations, consumers, residual risk and open questions.
• Platform.Audit/Contracts: IAuditWriter, ITrustedAuditWriter, AuditEventDraft, actor/context types, AuditWriteResult with stable rejection codes, AuditEventTypes, and AuditEventCatalog (schema version 1, 10 event types).
• Platform.Audit/Application: internal AuditDraftValidator and AuditDetailFormats.
• Platform.Audit.csproj: InternalsVisibleTo for the test project only.

Not in this PR: the writer itself, storage, DI registration (S-05, S-06), FakeAuditWriter, and any change to Identity or Access code.

Verification

• Command: dotnet test backend/SecurityLab.slnx --configuration Release
• Local run on 2026-11-03, .NET SDK 10.0.200, Windows, before the last docs-only commit: total 113, passed 113, failed 0, skipped 0.
• Platform.Audit.Tests: 71 tests, 67 of them new (T03). Identity tests (42) unchanged and passing.
• CI result: see the checks on this PR.

Architecture and data flow

No component diagrams changed in this PR; they are S-18/S-20. Dependency direction is unchanged: Platform.Access does not reference Platform.Audit; only Platform.Audit.Contracts types are public.

Security checks and negative tests

• Asset: integrity of audit records and absence of secrets in them.
• Trust boundary: business module → audit contract (TB2 in the team plan).
• Misuse scenarios and controls:
  • Forged actor, time or correlation: the draft has no such fields; they come from the server context.
  • Secrets in details: per-type allowlist, forbidden key names, no free text, size limits.
  • Log injection: correlation ID and values reject control characters and are format-restricted.
  • Unknown or wrong event data: unknown type, disallowed outcome, course or resource rules are rejected with stable codes; rejected values are never echoed.
• Tests: AuditDraftValidatorTests (positive case per event type, plus negative cases for type, outcome, actor, correlation, course, resource and details) and AuditEventCatalogTests (catalog, constants and examples stay in sync; no secret-like keys).
• Residual risk: ITrustedAuditWriter is public, so forged context is prevented by code review, not the compiler (documented in CONTRACTS.md).

Dependencies

• Contract is a DRAFT and needs confirmation from its consumers before it is treated as accepted.
• S-06 (member 3): proposed split — S-02 owns the catalog, schemas and draft validation; the writer calls AuditDraftValidator before storing.
• S-11/S-13 (member 9): Identity has its own IAuditWriter in Platform.Api.Services.Identity; adapter or switch is open question 1 in CONTRACTS.md (D1). Access is connected through the host adapter (S-13).