feat(audit)!: make the selected warehouse the audit store of record

AUTHZ.md

@@ -908,6 +908,18 @@ go run ./cmd/role-catalog-import -catalog roles.json -database-url "$DATABASE_UR
 go run ./cmd/role-catalog-import -catalog roles.json -database-url "$DATABASE_URL"
 ```
 
+The importer records one audit event per changed role through the same emitter
+the service uses, so it must run under the deployment's `AUDIT_SINK`
+(`-audit-sink`, defaulting to `$AUDIT_SINK`): under a swap value (ADR 0009) its
+events go to the transactional queue the accounts relay delivers, not to
+`audit_events`. Unlike the service, the importer has no default: an unset (or
+blank) `AUDIT_SINK` makes it exit before touching the store, because guessing
+`postgres` would write its events where a warehouse deployment never reads
+them. A deployment that relies on the service's `postgres` default must
+therefore set `AUDIT_SINK=postgres` explicitly. The deploy step below declares
+it (`service_environment: [AUDIT_SINK]`), so the driver gives the Job the
+accounts service's own value, which is why the service must have one.
+
 Domain core is `pkg/rolecatalog` (parse + diff + deterministic plan, no DB);
 `pkg/infra` snapshots current state and applies the plan in one transaction.
 

gitops.go

@@ -113,6 +113,11 @@ type bundleDeployJob struct {
 	Force   bool               `json:"force,omitempty"`
 	Writes  bundleDeployTarget `json:"writes"`
 	After   []string           `json:"after,omitempty"`
+	// ServiceEnvironment names environment variables the driver sets on the Job
+	// to the values the running service has in the same environment, so the
+	// step behaves as the service would — the import, for one, records its audit
+	// events wherever the service's AUDIT_SINK sends them.
+	ServiceEnvironment []string `json:"serviceEnvironment,omitempty"`
 }
 
 type bundleDeployTarget struct {
@@ -247,10 +252,9 @@ type topologyModule struct {
 }
 
 type topologyInterface struct {
-	Service      string   `yaml:"service"`
-	Endpoint     string   `yaml:"endpoint"`
-	Visibility   string   `yaml:"visibility"`
-	AllowModules []string `yaml:"allow-modules,omitempty"`
+	Service    string `yaml:"service"`
+	Endpoint   string `yaml:"endpoint"`
+	Visibility string `yaml:"visibility"`
 }
 
 type topologyService struct {
@@ -324,6 +328,9 @@ type topologyDeployJob struct {
 	Force   bool                    `yaml:"force,omitempty"`
 	Writes  topologyDeployJobTarget `yaml:"writes"`
 	After   []string                `yaml:"after,omitempty"`
+	// ServiceEnvironment names the running service's environment variables the
+	// Job receives with the service's own values (bundleDeployJob).
+	ServiceEnvironment []string `yaml:"service_environment,omitempty"`
 }
 
 type topologyDeployJobTarget struct {
@@ -460,7 +467,8 @@ func planDeployJobs(topology deploymentTopology, plan environmentPlan) []bundleD
 				Endpoint: job.Writes.Endpoint,
 				Port:     endpoint.Port,
 			},
-			After: append([]string(nil), job.After...),
+			After:              append([]string(nil), job.After...),
+			ServiceEnvironment: append([]string(nil), job.ServiceEnvironment...),
 		})
 	}
 	if len(jobs) == 0 {
@@ -1907,10 +1915,24 @@ func validateDeployJobs(moduleDir string, topology deploymentTopology, services
 				return fmt.Errorf("deployment topology deploy Job %q runs after undeclared service %q", job.Name, after)
 			}
 		}
+		inherited := make(map[string]struct{}, len(job.ServiceEnvironment))
+		for _, name := range job.ServiceEnvironment {
+			if !environmentVariableName.MatchString(name) {
+				return fmt.Errorf("deployment topology deploy Job %q service_environment entry %q is not an environment variable name", job.Name, name)
+			}
+			if _, repeated := inherited[name]; repeated {
+				return fmt.Errorf("deployment topology deploy Job %q service_environment repeats %q", job.Name, name)
+			}
+			inherited[name] = struct{}{}
+		}
 	}
 	return nil
 }
 
+// environmentVariableName is the shape of a name a deploy Job may inherit from
+// its running service: upper-case letters, digits and underscores.
+var environmentVariableName = regexp.MustCompile(`^[A-Z][A-Z0-9_]*$`)
+
 func serviceDependsOn(service topologyService, dependency, endpoint string) bool {
 	for _, declared := range service.Dependencies {
 		if declared.Service == dependency && slices.Contains(declared.Endpoints, endpoint) {
@@ -2259,7 +2281,6 @@ func bootstrapJobIngressPolicy(namespace string, labels map[string]string, servi
 			"ingress": []any{map[string]any{
 				"from": []any{map[string]any{"podSelector": map[string]any{"matchLabels": map[string]string{
 					"codefly.dev/bootstrap-service": service,
-					"job-name":                      service,
 				}}}},
 				"ports": networkPorts(ports),
 			}},
@@ -2275,7 +2296,6 @@ func bootstrapJobEgressPolicy(namespace string, labels map[string]string, servic
 		Spec: map[string]any{
 			"podSelector": map[string]any{"matchLabels": map[string]string{
 				"codefly.dev/bootstrap-service": service,
-				"job-name":                      service,
 			}},
 			"policyTypes": []string{"Egress"},
 			"egress": []any{map[string]any{

gitops_test.go

@@ -597,6 +597,26 @@ func TestGenerateBundleRejectsHostileContracts(t *testing.T) {
 			},
 			want: "references undeclared service",
 		},
+		{
+			name: "deploy job inheriting a malformed environment name",
+			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
+				t.Helper()
+				writeCatalogArtifact(t, moduleDir)
+				appendDeployJob(t, moduleDir, "store", "http")
+				replaceInDeployJobs(t, moduleDir, "      - AUDIT_SINK\n", "      - audit-sink\n")
+			},
+			want: "is not an environment variable name",
+		},
+		{
+			name: "deploy job inheriting an environment name twice",
+			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
+				t.Helper()
+				writeCatalogArtifact(t, moduleDir)
+				appendDeployJob(t, moduleDir, "store", "http")
+				replaceInDeployJobs(t, moduleDir, "      - AUDIT_SINK\n", "      - AUDIT_SINK\n      - AUDIT_SINK\n")
+			},
+			want: "service_environment repeats",
+		},
 		{
 			name: "deploy job to a migration-bearing target without ordering",
 			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
@@ -809,6 +829,9 @@ func TestDeployJobWiresCatalogImport(t *testing.T) {
 		if !slices.Equal(job.After, []string{"store"}) {
 			t.Errorf("%s deploy job ordering = %v", env.Name, job.After)
 		}
+		if !slices.Equal(job.ServiceEnvironment, []string{"AUDIT_SINK"}) {
+			t.Errorf("%s deploy job service environment = %v, want the running service's AUDIT_SINK", env.Name, job.ServiceEnvironment)
+		}
 	}
 
 	overlays := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays")
@@ -2348,7 +2371,9 @@ func appendDeployJob(t *testing.T, moduleDir, writesService, writesEndpoint stri
 			"      service: "+writesService+"\n"+
 			"      endpoint: "+writesEndpoint+"\n"+
 			"    after:\n"+
-			"      - store\n")
+			"      - store\n"+
+			"    service_environment:\n"+
+			"      - AUDIT_SINK\n")
 }
 
 // serviceManifestFixture renders an authored service.codefly.yaml: one endpoint,
@@ -2365,9 +2390,6 @@ func serviceManifestFixture(name, endpoint, api, visibility string, port int, to
 	}
 	if visibility != "private" {
 		manifest.WriteString("    visibility: " + visibility + "\n")
-		if visibility == "internal" {
-			manifest.WriteString("    allow-modules: [\"*\"]\n")
-		}
 	}
 	manifest.WriteString("spec:\n")
 	manifest.WriteString(spec)

go.mod

@@ -3,7 +3,7 @@ module github.com/codefly-dev/agents/modules/saas-starter
 go 1.27.0
 
 require (
-	github.com/codefly-dev/core v0.5.11-0.20260926231217-d481a2d49683
+	github.com/codefly-dev/core v0.14.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 

go.sum

@@ -28,8 +28,8 @@ github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
 github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/codefly-dev/core v0.5.11-0.20260926231217-d481a2d49683 h1:/vzymsu5B9NWwdhWRtlU+68VcVEVDmeZNChRCXAUwlE=
-github.com/codefly-dev/core v0.5.11-0.20260926231217-d481a2d49683/go.mod h1:SVF+t040X+9pAXAqBnNE/JkXwmw9peVuKnHKFSOzyzk=
+github.com/codefly-dev/core v0.14.0 h1:rpLFxeHSf2PrbxsRSp/NcZt8htMRM38JV2Oc8RKievU=
+github.com/codefly-dev/core v0.14.0/go.mod h1:rp4YZkCJEOufliWQAgK3sv8YlO7Xcva7+cN7hIlAR0I=
 github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
 github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=

libraries/source-read-sdk/contract/catalog.codefly.json

@@ -10,13 +10,15 @@
       "kind": "protobuf",
       "package": "saas.accounts.v1",
       "path": "contract.binpb",
-      "digest": "sha256:b8ef1ba87e5d9b96c067194fa0fb07892c2ba937c623e54a8c5290cc6609cab8",
+      "digest": "sha256:a6154d416ce1783b41b02bdddf7daecc77d61501337f2e1ad556ae3f35d8fbe2",
       "services": [
         {
           "name": "ModuleCapabilitiesService",
           "fullName": "saas.accounts.v1.ModuleCapabilitiesService",
           "procedures": [
             "/saas.accounts.v1.ModuleCapabilitiesService/AckJob",
+            "/saas.accounts.v1.ModuleCapabilitiesService/ApproveExecutableArtifact",
+            "/saas.accounts.v1.ModuleCapabilitiesService/AuthorizeExecutableArtifact",
             "/saas.accounts.v1.ModuleCapabilitiesService/CancelApproval",
             "/saas.accounts.v1.ModuleCapabilitiesService/CheckWorkContextRecordAccess",
             "/saas.accounts.v1.ModuleCapabilitiesService/ClaimJobs",
@@ -28,6 +30,7 @@
             "/saas.accounts.v1.ModuleCapabilitiesService/FetchDatasourceBlob",
             "/saas.accounts.v1.ModuleCapabilitiesService/FetchDatasourceFiles",
             "/saas.accounts.v1.ModuleCapabilitiesService/GetApproval",
+            "/saas.accounts.v1.ModuleCapabilitiesService/GetCurrentInstallation",
             "/saas.accounts.v1.ModuleCapabilitiesService/HeartbeatJob",
             "/saas.accounts.v1.ModuleCapabilitiesService/ListReadableSourceCollections",
             "/saas.accounts.v1.ModuleCapabilitiesService/ListSubjectVisibility",
@@ -44,6 +47,7 @@
             "/saas.accounts.v1.ModuleCapabilitiesService/PublishEvent",
             "/saas.accounts.v1.ModuleCapabilitiesService/ReplayEvents",
             "/saas.accounts.v1.ModuleCapabilitiesService/RequestApproval",
+            "/saas.accounts.v1.ModuleCapabilitiesService/RevokeExecutableArtifact",
             "/saas.accounts.v1.ModuleCapabilitiesService/Subscribe",
             "/saas.accounts.v1.ModuleCapabilitiesService/Unsubscribe"
           ]