Per-user attribution, audit trails, tenant content policy, and gated retention#4

Merged

CMGS merged 21 commits into

mainfrom

feat/audit-billing

Jul 15, 2026

Commits on Jul 15, 2026

feat(audit): phase 1 — per-user attribution, security-event stream, admin-op audit
CMGS
committed
review: apply phase-1 simplify findings (dedup user-id resolution, admin query helpers, comment trim)
CMGS
committed
feat(security): phase 2 (B1-B3) — per-tenant policy, action tiers, regex+secret recognizers
CMGS
committed
feat(retention): phase 2 (C2/C4/D2) — gated content retention, purge, billing precision
CMGS
committed
feat(phase3): moderation seam + per-user budgets
CMGS
committed
review: apply phase-2 simplify findings (zero-alloc part redaction, lazy content capture, shared join)
CMGS
committed
docs: document per-tenant audit/security/retention knobs in the embedded config
CMGS
committed
docs: per-user billing, enterprise content policy, and audit trails in governance.md
CMGS
committed
fix(review): rev-safety + rev-isolation findings
CMGS
committed
fix(realtime): resolve x-gw-user for billing, budget, and security events
CMGS
committed
refactor(attribution): single AkInfo::attributed_user across REST and realtime
CMGS
committed
fix(security): close realtime secret-redaction, keyless-full retention, and config-publish audit gaps
CMGS
committed
fix(batch): persist per-item user attribution so shared-key batches bill and budget correctly
CMGS
committed
fix(audit): root admin source IP at the TCP peer, trust proxy headers only when configured
CMGS
committed
docs: per-surface user attribution, retention redaction guarantee, audit source-IP trust
CMGS
committed
fix(realtime): apply external moderation; freeze audit source IP pre-reload; record inbound realtime DLP events
CMGS
committed
fix(realtime): audit outbound DLP per turn; reconcile the doc exemption
CMGS
committed
fix(realtime): flush aborted-turn outbound DLP audit on exit
CMGS
committed
review: apply simplify+code-rs convergence round (policy seams, hot-path allocs, comment trim)
CMGS
committed
feat(retention): read retained content back via /admin/audit/content/{request_id}
CMGS
committed
docs: document per-user attribution, audit trails, content policy, and retention
CMGS
committed