Phase 9: Hub API and Apprise alerts (/capabilities, /ask, /notify)
Build on Phases 1-8. Adds the project side of the frozen Hub contract
(central_ai_llm_master/docs/ask-contract.md) and the alert engine from
AGENTS.md §4 FR-12/FR-13, §8, §11 Phase 9.
- hub: internal/hub implements AskRequest/AskResponse/NotifyRequest and a
deterministic, read-only Answerer. It answers screen time today/yesterday,
what is blocked now, and device presence, scoped to one child or all kids.
Screen time is the foreground-app total per device-day; the domain total is
used only when a device reports no apps, so a report carrying both is never
double-counted.
- apprise: internal/apprise is a small Apprise API client (stored key or
stateless URL mode, optional bearer token, typed notifications).
- alert: internal/alert evaluates device state on an interval and raises one
Apprise alert per transition: a limit hit (a device becomes blocked) or a
device offline longer than the threshold. A never-seen device is never
alerted, and the first observation seeds state without replaying an old
limit. The alert is recorded before delivery, with its delivery outcome.
- store: migration 005 adds `alerts` (delivery outcome, audited) and
`alert_state` (per-device dedup). New usage reads from the telemetry detail
table so the daily answer can be checked independently.
- web: GET /capabilities, POST /ask (read-only) and POST /notify behind the
shared CONTROL_HUB_TOKEN, separate from the session and admin API tokens.
/notify accepts the contract's {from,level,message,person} and delivers it
through Apprise (the future tamper-report path, FR-17).
- cmd/control: start the alert engine (CONTROL_ALERTS_ENABLED,
CONTROL_ALERT_OFFLINE_AFTER, CONTROL_ALERT_INTERVAL) and add `alerts` and
`usage` subcommands for read-only inspection.
- deploy/verify-phase9.sh + `make verify-phase9` prove the definition of done;
version 0.7.0-phase9.
Measured on .13 (2026-10-13):
- GET /capabilities -> internet_use_control topics.
- POST /ask "how long have the kids been on screens today?" -> "The kids have
had 1h 22m of screen time today." (total_seconds=4925); the independent
count from the telemetry detail table is also 4925 (app=4925, domain=4800).
- A manual lock raised a delivered limit alert (id 4); an MQTT offline status
raised a delivered offline alert (id 5); POST /notify delivered (id 6). All
three report delivered=1 in `alerts`.
Tests: gofmt, go vet ./... and go test ./... pass in golang:1.25-alpine.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
224
internal/store/alerts.go
Normal file
224
internal/store/alerts.go
Normal file
@@ -0,0 +1,224 @@
|
||||
// Alerts (AGENTS.md §4 FR-13, §7 retention, §11 Phase 9).
|
||||
//
|
||||
// An alert is a message the Control Service decided Sam should see: a device
|
||||
// hit its limit (a blocking window turned on), or a device has been offline too
|
||||
// long. The engine (internal/alert) raises them and delivers them through
|
||||
// Apprise; this file only records what happened.
|
||||
//
|
||||
// `alerts` is append-only except for the delivery outcome, so an operator can
|
||||
// always tell what fired and whether it reached Sam. `alert_state` is the small
|
||||
// per-device dedup memory that turns a transition into exactly one alert.
|
||||
package store
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Alert kinds. 'limit' is a device that became blocked, 'offline' is a device
|
||||
// unreachable for too long, 'notify' is an accepted notification delivered on
|
||||
// demand (for example the future phone tamper report, FR-17).
|
||||
const (
|
||||
AlertLimit = "limit"
|
||||
AlertOffline = "offline"
|
||||
AlertNotify = "notify"
|
||||
)
|
||||
|
||||
// Alert is one recorded alert.
|
||||
type Alert struct {
|
||||
ID int64
|
||||
DeviceID *int64
|
||||
DeviceName string
|
||||
Kind string
|
||||
Message string
|
||||
CreatedAt time.Time
|
||||
Delivered bool
|
||||
DeliveredAt *time.Time
|
||||
Error string
|
||||
}
|
||||
|
||||
// AlertState is the last observed condition for one device. It exists only to
|
||||
// suppress duplicate alerts while a condition stays true.
|
||||
type AlertState struct {
|
||||
Locked bool
|
||||
Offline bool
|
||||
}
|
||||
|
||||
// CreateAlert records one alert and appends it to the audit log in the same
|
||||
// transaction (FR-15). deviceID may be nil for a notification with no device.
|
||||
func (s *Store) CreateAlert(ctx context.Context, deviceID *int64, kind, message string) (*Alert, error) {
|
||||
switch kind {
|
||||
case AlertLimit, AlertOffline, AlertNotify:
|
||||
default:
|
||||
return nil, fmt.Errorf("create alert: unknown kind %q", kind)
|
||||
}
|
||||
|
||||
tx, err := s.db.BeginTx(ctx, nil)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("create alert: %w", err)
|
||||
}
|
||||
defer func() { _ = tx.Rollback() }()
|
||||
|
||||
var idArg any
|
||||
if deviceID != nil {
|
||||
idArg = *deviceID
|
||||
}
|
||||
res, err := tx.ExecContext(ctx,
|
||||
`INSERT INTO alerts (device_id, kind, message) VALUES (?, ?, ?)`,
|
||||
idArg, kind, message)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("create alert: %w", err)
|
||||
}
|
||||
id, err := res.LastInsertId()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("create alert id: %w", err)
|
||||
}
|
||||
if err := insertAudit(ctx, tx, "alert", "alert."+kind, deviceID, message); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := tx.Commit(); err != nil {
|
||||
return nil, fmt.Errorf("commit alert: %w", err)
|
||||
}
|
||||
return s.GetAlert(ctx, id)
|
||||
}
|
||||
|
||||
// MarkAlertDelivered records the delivery outcome. An empty errMsg means Apprise
|
||||
// accepted the notification.
|
||||
func (s *Store) MarkAlertDelivered(ctx context.Context, id int64, errMsg string) error {
|
||||
delivered := 0
|
||||
if errMsg == "" {
|
||||
delivered = 1
|
||||
}
|
||||
if _, err := s.db.ExecContext(ctx, `
|
||||
UPDATE alerts SET delivered = ?, delivered_at = datetime('now'), error = ?
|
||||
WHERE id = ?`, delivered, nullString(errMsg), id); err != nil {
|
||||
return fmt.Errorf("mark alert delivered: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetAlert returns one alert, or ErrNotFound.
|
||||
func (s *Store) GetAlert(ctx context.Context, id int64) (*Alert, error) {
|
||||
row := s.db.QueryRowContext(ctx, `
|
||||
SELECT a.id, a.device_id, COALESCE(d.name, ''), a.kind, a.message,
|
||||
a.created_at, a.delivered, a.delivered_at, COALESCE(a.error, '')
|
||||
FROM alerts a
|
||||
LEFT JOIN devices d ON d.id = a.device_id
|
||||
WHERE a.id = ?`, id)
|
||||
a, err := scanAlert(row)
|
||||
if err == sql.ErrNoRows {
|
||||
return nil, ErrNotFound
|
||||
}
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("get alert: %w", err)
|
||||
}
|
||||
return a, nil
|
||||
}
|
||||
|
||||
// ListAlerts returns the newest alerts first, for the Alerts screen and for
|
||||
// verification. A non-positive or oversized limit is clamped.
|
||||
func (s *Store) ListAlerts(ctx context.Context, limit int) ([]Alert, error) {
|
||||
if limit <= 0 || limit > 500 {
|
||||
limit = 50
|
||||
}
|
||||
rows, err := s.db.QueryContext(ctx, `
|
||||
SELECT a.id, a.device_id, COALESCE(d.name, ''), a.kind, a.message,
|
||||
a.created_at, a.delivered, a.delivered_at, COALESCE(a.error, '')
|
||||
FROM alerts a
|
||||
LEFT JOIN devices d ON d.id = a.device_id
|
||||
ORDER BY a.id DESC
|
||||
LIMIT ?`, limit)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("list alerts: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
out := make([]Alert, 0, limit)
|
||||
for rows.Next() {
|
||||
a, err := scanAlert(rows)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("scan alert: %w", err)
|
||||
}
|
||||
out = append(out, *a)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
return nil, fmt.Errorf("list alerts: %w", err)
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// AlertStates returns the dedup state for every device that has one. A device
|
||||
// with no row is a device the engine has not seen yet.
|
||||
func (s *Store) AlertStates(ctx context.Context) (map[int64]AlertState, error) {
|
||||
rows, err := s.db.QueryContext(ctx, `SELECT device_id, locked, offline FROM alert_state`)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("alert states: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
out := make(map[int64]AlertState)
|
||||
for rows.Next() {
|
||||
var (
|
||||
id int64
|
||||
locked, offln int
|
||||
)
|
||||
if err := rows.Scan(&id, &locked, &offln); err != nil {
|
||||
return nil, fmt.Errorf("scan alert state: %w", err)
|
||||
}
|
||||
out[id] = AlertState{Locked: locked != 0, Offline: offln != 0}
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
return nil, fmt.Errorf("alert states: %w", err)
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// SetAlertState records the last observed condition for one device.
|
||||
func (s *Store) SetAlertState(ctx context.Context, deviceID int64, locked, offline bool) error {
|
||||
if _, err := s.db.ExecContext(ctx, `
|
||||
INSERT INTO alert_state (device_id, locked, offline, updated_at)
|
||||
VALUES (?, ?, ?, datetime('now'))
|
||||
ON CONFLICT(device_id) DO UPDATE SET
|
||||
locked = excluded.locked,
|
||||
offline = excluded.offline,
|
||||
updated_at = datetime('now')`,
|
||||
deviceID, boolToInt(locked), boolToInt(offline)); err != nil {
|
||||
return fmt.Errorf("set alert state: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func scanAlert(row interface {
|
||||
Scan(dest ...any) error
|
||||
}) (*Alert, error) {
|
||||
var (
|
||||
a Alert
|
||||
deviceID sql.NullInt64
|
||||
created sql.NullString
|
||||
delivered int
|
||||
deliveredAt sql.NullString
|
||||
)
|
||||
if err := row.Scan(&a.ID, &deviceID, &a.DeviceName, &a.Kind, &a.Message,
|
||||
&created, &delivered, &deliveredAt, &a.Error); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if deviceID.Valid {
|
||||
id := deviceID.Int64
|
||||
a.DeviceID = &id
|
||||
}
|
||||
a.CreatedAt = parseTime(created.String)
|
||||
a.Delivered = delivered != 0
|
||||
a.DeliveredAt = parseTimePtr(deliveredAt)
|
||||
return &a, nil
|
||||
}
|
||||
|
||||
// nullString maps an empty message to SQL NULL, so an undelivered-without-error
|
||||
// row is distinguishable from a delivered one.
|
||||
func nullString(s string) any {
|
||||
if s == "" {
|
||||
return nil
|
||||
}
|
||||
return s
|
||||
}
|
||||
134
internal/store/alerts_test.go
Normal file
134
internal/store/alerts_test.go
Normal file
@@ -0,0 +1,134 @@
|
||||
package store
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestAlertLifecycle(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
st := testStore(t)
|
||||
dev := mustCreateDevice(t, st, "Harry's phone", "Harry", "android")
|
||||
|
||||
a, err := st.CreateAlert(ctx, &dev.ID, AlertLimit, "Harry's phone reached its limit.")
|
||||
if err != nil {
|
||||
t.Fatalf("CreateAlert: %v", err)
|
||||
}
|
||||
if a.Delivered {
|
||||
t.Error("a fresh alert must not be delivered")
|
||||
}
|
||||
if a.DeviceName != "Harry's phone" {
|
||||
t.Errorf("device name = %q", a.DeviceName)
|
||||
}
|
||||
|
||||
// The alert is audited.
|
||||
audit, err := st.ListAudit(ctx, 10)
|
||||
if err != nil {
|
||||
t.Fatalf("ListAudit: %v", err)
|
||||
}
|
||||
if len(audit) == 0 || audit[0].Action != "alert.limit" {
|
||||
t.Fatalf("audit = %#v, want an alert.limit row", audit)
|
||||
}
|
||||
|
||||
if err := st.MarkAlertDelivered(ctx, a.ID, ""); err != nil {
|
||||
t.Fatalf("MarkAlertDelivered: %v", err)
|
||||
}
|
||||
got, err := st.GetAlert(ctx, a.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("GetAlert: %v", err)
|
||||
}
|
||||
if !got.Delivered || got.DeliveredAt == nil || got.Error != "" {
|
||||
t.Errorf("delivered alert = %#v", got)
|
||||
}
|
||||
|
||||
// A delivery failure is recorded, not hidden.
|
||||
b, err := st.CreateAlert(ctx, nil, AlertNotify, "message")
|
||||
if err != nil {
|
||||
t.Fatalf("CreateAlert notify: %v", err)
|
||||
}
|
||||
if err := st.MarkAlertDelivered(ctx, b.ID, "post apprise: status 500"); err != nil {
|
||||
t.Fatalf("MarkAlertDelivered: %v", err)
|
||||
}
|
||||
got, err = st.GetAlert(ctx, b.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("GetAlert: %v", err)
|
||||
}
|
||||
if got.Delivered || got.Error != "post apprise: status 500" {
|
||||
t.Errorf("failed alert = %#v", got)
|
||||
}
|
||||
|
||||
if _, err := st.CreateAlert(ctx, nil, "bogus", "x"); err == nil {
|
||||
t.Error("CreateAlert accepted an unknown kind")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAlertStatesRoundTrip(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
st := testStore(t)
|
||||
dev := mustCreateDevice(t, st, "Finn's computer", "Finn", "windows")
|
||||
|
||||
states, err := st.AlertStates(ctx)
|
||||
if err != nil {
|
||||
t.Fatalf("AlertStates: %v", err)
|
||||
}
|
||||
if len(states) != 0 {
|
||||
t.Fatalf("states = %#v, want empty", states)
|
||||
}
|
||||
|
||||
if err := st.SetAlertState(ctx, dev.ID, true, false); err != nil {
|
||||
t.Fatalf("SetAlertState: %v", err)
|
||||
}
|
||||
states, err = st.AlertStates(ctx)
|
||||
if err != nil {
|
||||
t.Fatalf("AlertStates: %v", err)
|
||||
}
|
||||
if st := states[dev.ID]; !st.Locked || st.Offline {
|
||||
t.Fatalf("state = %#v, want locked only", st)
|
||||
}
|
||||
|
||||
if err := st.SetAlertState(ctx, dev.ID, false, true); err != nil {
|
||||
t.Fatalf("SetAlertState: %v", err)
|
||||
}
|
||||
states, _ = st.AlertStates(ctx)
|
||||
if st := states[dev.ID]; st.Locked || !st.Offline {
|
||||
t.Fatalf("state = %#v, want offline only", st)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUsageByDeviceForDay(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
st := testStore(t)
|
||||
harry := mustCreateDevice(t, st, "Harry's phone", "Harry", "android")
|
||||
finn := mustCreateDevice(t, st, "Finn's computer", "Finn", "windows")
|
||||
day := time.Date(2026, 10, 13, 0, 0, 0, 0, time.UTC).Format("2006-01-02")
|
||||
|
||||
if _, err := st.InsertTelemetry(ctx, harry.ID, day, []TelemetryEntry{
|
||||
{App: "com.spotify.music", Seconds: 3600},
|
||||
{Domain: "youtube.com", Seconds: 900},
|
||||
}); err != nil {
|
||||
t.Fatalf("InsertTelemetry: %v", err)
|
||||
}
|
||||
if _, err := st.InsertTelemetry(ctx, finn.ID, day, []TelemetryEntry{{App: "chrome", Seconds: 1800}}); err != nil {
|
||||
t.Fatalf("InsertTelemetry: %v", err)
|
||||
}
|
||||
|
||||
rows, err := st.UsageByDeviceForDay(ctx, day)
|
||||
if err != nil {
|
||||
t.Fatalf("UsageByDeviceForDay: %v", err)
|
||||
}
|
||||
if len(rows) != 2 {
|
||||
t.Fatalf("rows = %d, want 2", len(rows))
|
||||
}
|
||||
if rows[0].Name != "Harry's phone" || rows[0].AppSeconds != 3600 || rows[0].DomainSeconds != 900 {
|
||||
t.Errorf("harry row = %#v", rows[0])
|
||||
}
|
||||
if rows[1].Child != "Finn" || rows[1].AppSeconds != 1800 {
|
||||
t.Errorf("finn row = %#v", rows[1])
|
||||
}
|
||||
|
||||
// A day with no reports returns nothing.
|
||||
if rows, err := st.UsageByDeviceForDay(ctx, "2000-01-01"); err != nil || len(rows) != 0 {
|
||||
t.Fatalf("empty day: rows=%#v err=%v", rows, err)
|
||||
}
|
||||
}
|
||||
33
internal/store/migrations/005_alerts.sql
Normal file
33
internal/store/migrations/005_alerts.sql
Normal file
@@ -0,0 +1,33 @@
|
||||
-- Migration 005 — Phase 9. Alerts and their dedup state (AGENTS.md §4 FR-13,
|
||||
-- §5 screen 6, §11 Phase 9).
|
||||
--
|
||||
-- `alerts` is the append-only record of every alert the Control Service raised:
|
||||
-- a schedule/limit hit, a device offline too long, or an accepted notify. It is
|
||||
-- what the Alerts screen reads and what the delivery evidence is checked
|
||||
-- against. Nothing is ever edited except the delivery outcome columns.
|
||||
--
|
||||
-- `alert_state` remembers the last observed condition per device, so an alert
|
||||
-- fires once on a transition (unlocked -> locked, reachable -> offline-too-long)
|
||||
-- instead of on every poll. It is derived state, safe to delete; the service
|
||||
-- re-seeds it without alerting.
|
||||
|
||||
CREATE TABLE IF NOT EXISTS alerts (
|
||||
id INTEGER PRIMARY KEY,
|
||||
device_id INTEGER REFERENCES devices(id),
|
||||
kind TEXT NOT NULL CHECK (kind IN ('limit', 'offline', 'notify')),
|
||||
message TEXT NOT NULL,
|
||||
created_at TEXT NOT NULL DEFAULT (datetime('now')),
|
||||
delivered INTEGER NOT NULL DEFAULT 0,
|
||||
delivered_at TEXT,
|
||||
error TEXT
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_alerts_created ON alerts(created_at);
|
||||
CREATE INDEX IF NOT EXISTS idx_alerts_device ON alerts(device_id);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS alert_state (
|
||||
device_id INTEGER PRIMARY KEY REFERENCES devices(id),
|
||||
locked INTEGER NOT NULL DEFAULT 0,
|
||||
offline INTEGER NOT NULL DEFAULT 0,
|
||||
updated_at TEXT NOT NULL DEFAULT (datetime('now'))
|
||||
);
|
||||
@@ -260,6 +260,79 @@ func (s *Store) TopUsage(ctx context.Context, id int64, from, to, kind string, l
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// DeviceDayUsage is one device's rolled-up usage for one day. AppSeconds and
|
||||
// DomainSeconds are kept apart for the same reason as the rollup: a report may
|
||||
// carry both for one session, so adding them together would double-count time.
|
||||
// The screen-time answer decides how to combine them (internal/hub).
|
||||
type DeviceDayUsage struct {
|
||||
DeviceID int64
|
||||
Name string
|
||||
Child string
|
||||
AppSeconds int
|
||||
DomainSeconds int
|
||||
}
|
||||
|
||||
// UsageByDeviceForDay returns the daily rollup for every device that reported
|
||||
// anything on day (YYYY-MM-DD). It is the read the screen-time answer is built
|
||||
// from. Devices with no row are absent; the caller treats them as zero.
|
||||
func (s *Store) UsageByDeviceForDay(ctx context.Context, day string) ([]DeviceDayUsage, error) {
|
||||
rows, err := s.db.QueryContext(ctx, `
|
||||
SELECT d.id, d.name, d.child, td.app_seconds, td.domain_seconds
|
||||
FROM telemetry_daily td
|
||||
JOIN devices d ON d.id = td.device_id
|
||||
WHERE td.day = ?
|
||||
ORDER BY d.id`, day)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("usage by device for day: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
out := make([]DeviceDayUsage, 0, 8)
|
||||
for rows.Next() {
|
||||
var u DeviceDayUsage
|
||||
if err := rows.Scan(&u.DeviceID, &u.Name, &u.Child, &u.AppSeconds, &u.DomainSeconds); err != nil {
|
||||
return nil, fmt.Errorf("scan device day usage: %w", err)
|
||||
}
|
||||
out = append(out, u)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
return nil, fmt.Errorf("usage by device for day: %w", err)
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// DetailUsageByDeviceForDay is the same measure computed straight from the
|
||||
// telemetry detail table instead of the derived rollup. It exists so an
|
||||
// operator can independently check the rollup the daily answer reads.
|
||||
func (s *Store) DetailUsageByDeviceForDay(ctx context.Context, day string) ([]DeviceDayUsage, error) {
|
||||
rows, err := s.db.QueryContext(ctx, `
|
||||
SELECT d.id, d.name, d.child,
|
||||
COALESCE(SUM(CASE WHEN t.app <> '' THEN t.seconds END), 0),
|
||||
COALESCE(SUM(CASE WHEN t.domain <> '' THEN t.seconds END), 0)
|
||||
FROM telemetry t
|
||||
JOIN devices d ON d.id = t.device_id
|
||||
WHERE t.day = ?
|
||||
GROUP BY d.id
|
||||
ORDER BY d.id`, day)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("detail usage by device for day: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
out := make([]DeviceDayUsage, 0, 8)
|
||||
for rows.Next() {
|
||||
var u DeviceDayUsage
|
||||
if err := rows.Scan(&u.DeviceID, &u.Name, &u.Child, &u.AppSeconds, &u.DomainSeconds); err != nil {
|
||||
return nil, fmt.Errorf("scan detail device day usage: %w", err)
|
||||
}
|
||||
out = append(out, u)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
return nil, fmt.Errorf("detail usage by device for day: %w", err)
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// CapAudit keeps the newest max audit rows and deletes the oldest beyond that,
|
||||
// so the append-only log cannot grow without bound (AGENTS.md §7 retention). It
|
||||
// returns how many rows it removed. Nothing in the audit log is ever edited.
|
||||
|
||||
Reference in New Issue
Block a user