[ericcurtin]

Summary

Emit an OCSF event for each attempt to read provider credentials through GetSandboxProviderEnvironment and GetProviderCredentials. GetInferenceBundle is gone (#3172), so it is out of scope.

Related Issue

Part of #3017 (ConnectSupervisor stream coverage is a follow-up).

Changes

• DisclosureAudit records actor, resource identifiers, outcome, and request ID. It never records values or status text.
• Attach each valid target identifier before authorization, so denied and invalid exports stay attributable without echoing malformed input.
• Wire it into both RPCs; a dropped request is recorded as cancelled.
• Add correlation_uid to ConfigStateChangeBuilder; reuse RequestOrigin::from_request.
• Document the event and the contributor rule.
• No [openshell.gateway.audit] toggle yet; it does not exist on main.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo fmt, cargo clippy --all-targets, and cargo test for openshell-server and openshell-ocsf pass. Canary secret tests cover both RPCs.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@krishicks @johntmyers PTAL, and /ok to test ffcafb6b6bbdddf4f55cdbebc6d59c90e7610c20 if it looks good. @mattj-monad FYI, happy to rebase onto #2911 when it lands. Thank you!

[ericcurtin]

Merged main and fixed the conflicts. @krishicks @johntmyers PTAL, and /ok to test b0ae628c9e5265dfcb2222aebe15185420faf803 if it looks good. Thank you!

[ericcurtin]

@TaylorMutch @SDAChess PTAL when you get a chance, and /ok to test b0ae628c9e5265dfcb2222aebe15185420faf803 if it looks good. Thank you!

[ericcurtin]

@krishicks @purp PTAL when you get a chance, and /ok to test b0ae628c9e5265dfcb2222aebe15185420faf803 if it looks good. Thank you!

[ericcurtin]

@drew @TaylorMutch PTAL when you get a chance, and /ok to test b0ae628c9e5265dfcb2222aebe15185420faf803 if it looks good. Thank you!

[ericcurtin]

@krishicks @sjenning PTAL when you get a chance, and /ok to test b0ae628c9e5265dfcb2222aebe15185420faf803 if it looks good. Thank you!

[TaylorMutch]

The disclosure audit helper, secret-canary tests, and documentation cover much of #3017. Before this PR closes the issue, please include the remaining disclosure coverage and attribution below, with regression tests.

1. Cover provider-environment disclosure through ConnectSupervisor. At this PR's head, the stream already delivers provider environments through bootstrap and subsequent configuration updates (config_delivery/session.rs, including bootstrap_update_inner). Instrumenting only GetSandboxProviderEnvironment leaves supervisors receiving credentials over the stream outside the new disclosure audit trail. Please audit those deliveries and define the disclosure-attempt boundary and success/failure/cancellation semantics for the stream. Tests should cover bootstrap and subsequent updates, relevant failed/cancelled delivery paths, actor/resource/outcome/correlation fields, and secret canaries. Avoid treating a stream connection alone as proof that each credential-bearing update was delivered.

2. Retain safe target attribution on denied credential-export attempts. In provider_credentials.rs, require_operator and request validation can return before workspace/provider/key identifiers are attached to DisclosureAudit. Those records identify the caller and outcome but cannot identify the requested provider, even when the target identifiers themselves are valid. Please retain independently validated, safe resource identifiers on these paths without logging raw malformed input. Add tests for a denied request with valid selectors and an invalid request with mixed valid identifiers and secret-bearing malformed input, asserting useful target attribution and no secret leakage.

Both changes support the issue's core goal: identifying who accessed or attempted to access which credentials. Please address them here if practical. If streaming coverage requires substantial architectural work, an explicitly scoped, linked follow-up is reasonable, but #3017 should remain open until that coverage lands. The denied-attempt attribution should be completed in this PR.

The [openshell.gateway.audit] toggle is not part of this change request. Excluding the retired GetInferenceBundle is also consistent with the issue's scope clarification.

[ericcurtin]

@TaylorMutch item 2 is done: denied and invalid exports now keep each independently valid workspace, provider, and key, with tests for both cases and no leakage. Item 1 (ConnectSupervisor) needs per-update audit state across the async ack path in config_delivery (bootstrap, live, pending, session close), which is too large for this PR, so I changed the PR to "Part of #3017" and propose a follow-up for it. Could you /ok to test 4e56287? Thank you!