From 9812938582f7eff407e2790d874d3d3a65dd7fdd Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 18 Aug 2026 12:51:49 +0000 Subject: [PATCH] docs(kernel): point the runtime-services index at the audit slot's real registrant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `content/docs/kernel/runtime-services/index.mdx` listed the "Audit bridge" canonical source as `packages/services/service-settings/src/settings-service.types.ts`. That file declares `SettingsAuditSink`, a constructor-injected sink that `service-settings` holds directly (`settings-service.ts:578` ctor param, `:1461` `this.audit.record(...)`). It is never registered as, or resolved from, the kernel `audit` slot. The slot's only registrant is `AuditPlugin`, which registers `createAuthEventAuditSink(...)` at `audit-plugin.ts:117-118` — canonical source `packages/plugins/plugin-audit/src/auth-event-audit.ts`, whose surface is `recordAuthEvent`, not `record`. Repoints the entry and, rather than swapping it silently, keeps the other sink reachable: a callout names `SettingsAuditSink` as the constructor-injected thing it is, gives its real source, and says why the slot never returns it — mirroring the reconciliation the linked `audit-service` page received. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01XqDQYVU5smx29ts9pAErja --- content/docs/kernel/runtime-services/index.mdx | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/content/docs/kernel/runtime-services/index.mdx b/content/docs/kernel/runtime-services/index.mdx index f070f8ca23..20e7d022e5 100644 --- a/content/docs/kernel/runtime-services/index.mdx +++ b/content/docs/kernel/runtime-services/index.mdx @@ -43,4 +43,15 @@ Each page links the canonical TypeScript source used to derive signatures. - SMS: `packages/spec/src/contracts/sms-service.ts` - Storage: `packages/spec/src/contracts/storage-service.ts` - Settings: `packages/services/service-settings/src/settings-service.ts` -- Audit bridge: `packages/services/service-settings/src/settings-service.types.ts` +- Audit: `packages/plugins/plugin-audit/src/auth-event-audit.ts` + + +A second audit shape shares the word and is easy to reach for by mistake. +`SettingsAuditSink` — canonical source +`packages/services/service-settings/src/settings-service.types.ts` — is +**constructor-injected** into `service-settings`, which calls its `record()` after a +settings write lands. It is never registered as, or resolved from, the `services.audit` +slot: that slot's only registrant is `@objectstack/plugin-audit`, and the object it +returns exposes `recordAuthEvent`, not `record`. See +[`services.audit`](/docs/kernel/runtime-services/audit-service) for the full contrast. +