@mmerterden/multi-agent-pipeline 20.2.1 → 20.3.0

package/pipeline/scripts/_notices.mjs

@@ -0,0 +1,160 @@
+// Third-party attribution for pipeline/skills/shared/external.
+//
+// A vendored skill carries `metadata.source: "<upstream> (<license>)"` in its
+// frontmatter, and its upstream's NOTICE-*.md lists it in a `## Skills (N)`
+// section. The licenses involved (MIT, Apache 2.0, PolyForm Perimeter) require
+// the notice to travel with every copy, and build-stack-plugins.mjs ships a
+// NOTICE only beside the skills that section lists, so the two records are
+// checked against each other here: lint-skills fails on a mismatch and the
+// builder refuses to publish one.
+//
+// A skill whose header says only `metadata.source: community` came from a
+// community collection whose repository and license are not known. Content of
+// unknown license cannot ship verbatim, so such a skill is an attribution
+// problem whether or not a NOTICE lists it.
+
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+export const NOTICE_FILE = /^NOTICE-.*\.md$/;
+
+// A URL in the parentheses names a location, not a license.
+const LICENSED = /^"?(?<upstream>[^"(]+?)\s*\((?<license>(?!https?:)[^)]+)\)"?\s*$/;
+
+// Written on a skill authored in this repository.
+export const AUTHORED_SOURCE = "multi-agent-pipeline";
+
+// Written on a skill taken from a community collection with no named upstream.
+export const COMMUNITY_SOURCE = "community";
+
+/** `{ declared, skills }` from a NOTICE's `## Skills (N)` section; `declared` is null without one. */
+export function parseNoticeSkills(text) {
+  const src = String(text).replace(/\r\n?/g, "\n");
+  const head = src.match(/^##[ \t]+Skills[ \t]+\((\d+)\)[ \t]*$/m);
+  if (!head) return { declared: null, skills: [] };
+  const rest = src.slice(head.index + head[0].length);
+  const next = rest.search(/^##[ \t]/m);
+  const section = next === -1 ? rest : rest.slice(0, next);
+  return {
+    declared: Number(head[1]),
+    skills: [...section.matchAll(/`([a-z0-9][a-z0-9_-]*)`/g)].map((m) => m[1]),
+  };
+}
+
+/** The raw `metadata.source` value of a SKILL.md, unquoted, or "". */
+export function metadataSource(skillMd) {
+  const src = String(skillMd)
+    .replace(/^\uFEFF/, "")
+    .replace(/\r\n?/g, "\n");
+  const fm = src.match(/^---\n([\s\S]*?)\n---/);
+  if (!fm) return "";
+  let inside = false;
+  for (const line of fm[1].split("\n")) {
+    if (/^\S/.test(line)) {
+      inside = /^metadata:\s*(#.*)?$/.test(line);
+      continue;
+    }
+    const m = inside && line.match(/^\s+source:\s*(.*?)\s*$/);
+    if (m) return m[1].replace(/^(["'])(.*)\1$/, "$2");
+  }
+  return "";
+}
+
+/** `{ upstream, license }` when the skill is vendored from a licensed upstream, else null. */
+export function licensedSource(skillMd) {
+  const m = metadataSource(skillMd).match(LICENSED);
+  return m ? { upstream: m.groups.upstream.trim(), license: m.groups.license.trim() } : null;
+}
+
+const isDir = (p) => {
+  try {
+    return statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+
+function skillDirs(externalDir) {
+  return readdirSync(externalDir)
+    .filter((n) => isDir(join(externalDir, n)) && existsSync(join(externalDir, n, "SKILL.md")))
+    .sort();
+}
+
+/** Every NOTICE-*.md in the directory with its bytes and parsed Skills section. */
+export function readNotices(externalDir) {
+  if (!existsSync(externalDir)) return [];
+  return readdirSync(externalDir)
+    .filter((n) => NOTICE_FILE.test(n))
+    .sort()
+    .map((file) => {
+      const bytes = readFileSync(join(externalDir, file));
+      const { declared, skills } = parseNoticeSkills(bytes.toString("utf8"));
+      return {
+        file,
+        bytes,
+        text: bytes.toString("utf8"),
+        declared,
+        skills: new Set(skills),
+        listed: skills,
+      };
+    });
+}
+
+/** Why the NOTICE files and the skills' `metadata.source` lines disagree; empty when they agree. */
+export function noticeProblems(externalDir) {
+  const problems = [];
+  const skills = new Set(skillDirs(externalDir));
+  const owner = new Map();
+  const notices = readNotices(externalDir);
+  for (const n of notices) {
+    if (n.declared === null) {
+      problems.push(`${n.file}: no '## Skills (N)' section listing the skills it covers`);
+      continue;
+    }
+    if (n.declared !== n.listed.length) {
+      problems.push(`${n.file}: declares ${n.declared} skills but lists ${n.listed.length}`);
+    }
+    for (const s of n.listed) {
+      if (!skills.has(s)) problems.push(`${n.file}: lists '${s}', which is not a skill directory`);
+      if (owner.has(s)) problems.push(`${s}: listed by both ${owner.get(s)} and ${n.file}`);
+      else owner.set(s, n.file);
+    }
+  }
+  const byFile = new Map(notices.map((n) => [n.file, n]));
+  for (const s of skills) {
+    const md = readFileSync(join(externalDir, s, "SKILL.md"), "utf8");
+    const src = licensedSource(md);
+    const file = owner.get(s);
+    if (metadataSource(md) === COMMUNITY_SOURCE) {
+      problems.push(
+        `${s}: metadata.source '${COMMUNITY_SOURCE}' names no upstream or license, and content of unknown license cannot ship`,
+      );
+    } else if (src && !file) {
+      problems.push(
+        `${s}: vendored from ${src.upstream} (${src.license}) but no NOTICE-*.md lists it`,
+      );
+    } else if (src && !byFile.get(file).text.includes(src.upstream)) {
+      problems.push(`${s}: names upstream '${src.upstream}', which ${file} does not mention`);
+    } else if (!src && file) {
+      problems.push(
+        `${s}: listed by ${file} but carries no 'metadata.source: "<upstream> (<license>)"'`,
+      );
+    }
+  }
+  return problems;
+}
+
+/**
+ * Skills whose `metadata.source` is set but names no licensed upstream and is not
+ * the authored marker: attribution that cannot be checked against a NOTICE.
+ */
+export function unnamedUpstreams(externalDir) {
+  const out = [];
+  for (const s of skillDirs(externalDir)) {
+    const md = readFileSync(join(externalDir, s, "SKILL.md"), "utf8");
+    const source = metadataSource(md);
+    if (!source || source === AUTHORED_SOURCE || licensedSource(md)) continue;
+    out.push({ skill: s, source });
+  }
+  return out;
+}

package/pipeline/scripts/_phone-auth.mjs

@@ -0,0 +1,485 @@
+/**
+ * @file _phone-auth.mjs  -  device signatures for the phone routes of
+ * contract-server.mjs.
+ *
+ * A phone reaches the server through a forwarder (a private network or a
+ * relay; features/phone-api.md), so it cannot read the bearer token file and
+ * must not be handed a copy: a token is a bearer secret, valid from anywhere
+ * for as long as the server runs. A phone instead holds an Ed25519 private key
+ * that never leaves it, and signs every request. This machine keeps only the
+ * public halves, in a registry the enrolment CLI (phone-devices.mjs) writes.
+ *
+ * The signed text is canonical: seven fields joined by "\n", each one refused
+ * if it could carry a newline, so two different requests can never produce the
+ * same text.
+ *
+ *   MA-PHONE-SIG-1
+ *   <method>            GET or POST, as sent
+ *   <target>            the request target exactly as sent: path plus query
+ *   <body sha256 hex>   of the raw body bytes; the empty body has a digest too
+ *   <device id>
+ *   <timestamp>         Unix seconds
+ *   <nonce>             16 to 64 base64url characters, fresh per request
+ *
+ * A request is refused, in this order, when it is unsigned, names a device the
+ * registry does not hold, carries a timestamp more than WINDOW_SEC behind this
+ * machine's clock, more than FUTURE_SKEW_SEC ahead of it, or earlier than the
+ * server's own start, fails the signature, comes from a revoked device, or
+ * repeats a nonce inside the window.
+ *
+ * Seen nonces are kept on disk (nonces.json, 0600, bounded, pruned as their
+ * window closes), not only in memory, so a request accepted by one server
+ * process is still a replay to the next one. The start-time floor alone cannot
+ * do that: a timestamp ahead of the clock stays later than a restart for as
+ * long as it is ahead. The small future skew bounds that lead, and the floor
+ * still refuses anything signed before the process started, which covers a
+ * nonce file that was lost or could not be read. Only a hash of each nonce is
+ * stored.
+ *
+ * The registry is read on every request, so a revocation or a launch toggle
+ * takes effect on the next request. A registry that other users can write, or
+ * that another user owns, is treated as empty.
+ *
+ * The audit log records one line per phone request whose signature verified,
+ * accepted or not: time, device id, method, verb, status and outcome. Never the
+ * signature, the nonce, the query or the body. It keeps AUDIT_GENERATIONS
+ * rotated files. A refusal decided before a signature verified (unsigned,
+ * unknown device, stale timestamp, bad signature, unusable registry) costs an
+ * anonymous sender nothing to produce, so it goes to a separate refusals log,
+ * rate-limited per process, where a flood cannot rotate away the rows that
+ * record what an enrolled device did. A device id alone proves nothing: it
+ * travels in clear on every request.
+ *
+ * Zero runtime dependencies (ADR-0004): node:crypto and node:fs.
+ *
+ * @module pipeline/scripts/_phone-auth
+ */
+
+import { Buffer } from "node:buffer";
+import { createHash, createPublicKey, randomBytes, sign, verify } from "node:crypto";
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+import { autopilotRoot } from "../lib/pr-request-location.mjs";
+
+export const PHONE_PREFIX = "/v1/phone/";
+export const SIGNATURE_VERSION = "MA-PHONE-SIG-1";
+export const WINDOW_SEC = 60;
+export const FUTURE_SKEW_SEC = 5;
+export const SCOPES = ["read", "answer", "launch"];
+export const REGISTRY_VERSION = "1.0.0";
+export const NONCE_STORE_MAX = 4096;
+export const HEADERS = {
+  device: "x-ma-device",
+  timestamp: "x-ma-timestamp",
+  nonce: "x-ma-nonce",
+  signature: "x-ma-signature",
+};
+
+export const DEVICE_ID = /^d-[0-9a-f]{16}$/;
+const TIMESTAMP = /^[0-9]{1,12}$/;
+const NONCE = /^[A-Za-z0-9_-]{16,64}$/;
+const SIGNATURE = /^[A-Za-z0-9_-]{86}$/;
+const METHOD = /^[A-Z]{1,10}$/;
+const TARGET = /^\/[\x21-\x7e]{0,4095}$/;
+const DIGEST = /^[0-9a-f]{64}$/;
+const VERB = /^[a-z0-9-]{1,32}$/;
+const SPKI_ED25519_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+const AUDIT_MAX_BYTES = 256 * 1024;
+export const AUDIT_GENERATIONS = 5;
+export const REFUSAL_ROWS_PER_MINUTE = 30;
+/** Outcomes decided before any signature verified; they go to the refusals log. */
+export const UNAUTHENTICATED_OUTCOMES = [
+  "unsigned",
+  "unknown-device",
+  "stale-request",
+  "bad-signature",
+  "registry-insecure",
+  "registry-unreadable",
+];
+
+/**
+ * Where the phone files live: under the autopilot root, which an unattended
+ * run may not write (unattended-policy.json, protectedHostEntries).
+ */
+export function phoneDir(env = process.env) {
+  return join(autopilotRoot(env), "phone");
+}
+export const registryPath = (env = process.env) => join(phoneDir(env), "devices.json");
+export const auditPath = (env = process.env) => join(phoneDir(env), "audit.jsonl");
+export const refusalsPath = (env = process.env) => join(phoneDir(env), "refusals.jsonl");
+export const noncesPath = (env = process.env) => join(phoneDir(env), "nonces.json");
+
+/** SHA-256 of the raw body bytes, lowercase hex. */
+export const bodyDigest = (buf) =>
+  createHash("sha256")
+    .update(buf ?? Buffer.alloc(0))
+    .digest("hex");
+
+/** The text a device signs. Throws on any field that could break the framing. */
+export function canonicalPayload({
+  method,
+  target,
+  bodyDigest: digest,
+  deviceId,
+  timestamp,
+  nonce,
+}) {
+  const checks = [
+    [METHOD, method, "method"],
+    [TARGET, target, "target"],
+    [DIGEST, digest, "body digest"],
+    [DEVICE_ID, deviceId, "device id"],
+    [TIMESTAMP, timestamp, "timestamp"],
+    [NONCE, nonce, "nonce"],
+  ];
+  for (const [re, v, name] of checks) {
+    if (typeof v !== "string" || !re.test(v)) throw new Error(`${name} is not canonical`);
+  }
+  return [SIGNATURE_VERSION, method, target, digest, deviceId, timestamp, nonce].join("\n");
+}
+
+/** A raw 32-byte Ed25519 public key (base64url) as a KeyObject. */
+export function publicKeyObject(raw) {
+  const bytes = Buffer.from(String(raw), "base64url");
+  if (bytes.length !== 32) throw new Error("an Ed25519 public key is 32 bytes");
+  return createPublicKey({
+    key: Buffer.concat([SPKI_ED25519_PREFIX, bytes]),
+    format: "der",
+    type: "spki",
+  });
+}
+
+/**
+ * Normalize what a person pastes at enrolment: a raw base64url key or an SPKI
+ * PEM block. Returns the raw key as base64url; throws on anything that is not
+ * an Ed25519 public key.
+ */
+export function parsePublicKey(input) {
+  const text = String(input ?? "").trim();
+  if (/PRIVATE KEY/.test(text)) throw new Error("that is a private key; paste the public half");
+  let key;
+  if (text.startsWith("-----BEGIN")) {
+    key = createPublicKey({ key: text, format: "pem" });
+  } else {
+    if (!/^[A-Za-z0-9_-]{43}=?$/.test(text)) throw new Error("not a base64url Ed25519 key");
+    key = publicKeyObject(text.replace(/=$/, ""));
+  }
+  if (key.asymmetricKeyType !== "ed25519") throw new Error("the key is not Ed25519");
+  const der = key.export({ format: "der", type: "spki" });
+  return der.subarray(SPKI_ED25519_PREFIX.length).toString("base64url");
+}
+
+/** Short, stable identifier of a public key, for listing and the audit trail. */
+export const fingerprint = (raw) =>
+  createHash("sha256").update(Buffer.from(raw, "base64url")).digest("hex").slice(0, 16);
+
+export const newDeviceId = () => `d-${randomBytes(8).toString("hex")}`;
+
+const emptyRegistry = () => ({
+  schemaVersion: REGISTRY_VERSION,
+  launchEnabled: false,
+  devices: [],
+});
+
+/**
+ * The registry, or an empty one when it is missing, unreadable, or writable by
+ * anyone but its owner. `insecure` says which of those it was.
+ */
+export function readRegistry(env = process.env) {
+  const file = registryPath(env);
+  if (!existsSync(file)) return { ...emptyRegistry(), insecure: null };
+  try {
+    const st = statSync(file);
+    const uid = typeof process.getuid === "function" ? process.getuid() : st.uid;
+    if ((st.mode & 0o022) !== 0 || st.uid !== uid) {
+      return { ...emptyRegistry(), insecure: "registry-insecure" };
+    }
+    const doc = JSON.parse(readFileSync(file, "utf8"));
+    if (!doc || !Array.isArray(doc.devices))
+      return { ...emptyRegistry(), insecure: "registry-unreadable" };
+    return {
+      schemaVersion: doc.schemaVersion ?? REGISTRY_VERSION,
+      launchEnabled: doc.launchEnabled === true,
+      devices: doc.devices,
+      insecure: null,
+    };
+  } catch {
+    return { ...emptyRegistry(), insecure: "registry-unreadable" };
+  }
+}
+
+/** Replace the registry: a 0600 file written beside it and renamed over it. */
+export function writeRegistry(reg, env = process.env) {
+  const dir = phoneDir(env);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(dir, 0o700);
+  const file = registryPath(env);
+  const tmp = `${file}.${process.pid}.tmp`;
+  const doc = {
+    schemaVersion: REGISTRY_VERSION,
+    launchEnabled: reg.launchEnabled === true,
+    devices: reg.devices,
+  };
+  rmSync(tmp, { force: true });
+  writeFileSync(tmp, JSON.stringify(doc, null, 2) + "\n", { mode: 0o600, flag: "wx" });
+  renameSync(tmp, file);
+  chmodSync(file, 0o600);
+  return file;
+}
+
+function readNonceFile(file) {
+  try {
+    const doc = JSON.parse(readFileSync(file, "utf8"));
+    return doc && typeof doc.seen === "object" && doc.seen !== null ? doc.seen : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeNonceFile(file, seen) {
+  try {
+    const dir = dirname(file);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    rmSync(tmp, { force: true });
+    writeFileSync(tmp, JSON.stringify({ seen: Object.fromEntries(seen) }) + "\n", {
+      mode: 0o600,
+      flag: "wx",
+    });
+    renameSync(tmp, file);
+    chmodSync(file, 0o600);
+  } catch {
+    // The in-memory copy still refuses a replay to this process.
+  }
+}
+
+const nonceKey = (key) => createHash("sha256").update(String(key)).digest("hex").slice(0, 32);
+
+/**
+ * Nonces seen inside their window. Bounded: when full after dropping expired
+ * entries it answers "full" instead of forgetting a live nonce, because
+ * eviction is exactly what a replay would need. With `file`, every check first
+ * merges what other processes recorded there and every acceptance is written
+ * back, so the store outlives a restart.
+ */
+export function createNonceStore({ max = NONCE_STORE_MAX, file = null } = {}) {
+  const seen = new Map();
+  const prune = (now) => {
+    for (const [k, exp] of seen) if (exp < now) seen.delete(k);
+  };
+  const merge = () => {
+    if (!file) return;
+    for (const [k, exp] of Object.entries(readNonceFile(file))) {
+      if (typeof exp !== "number") continue;
+      if (!(seen.get(k) >= exp)) seen.set(k, exp);
+    }
+  };
+  return {
+    remember(key, expiresAt, now) {
+      const k = file ? nonceKey(key) : key;
+      merge();
+      const exp = seen.get(k);
+      if (exp !== undefined && exp >= now) return "replayed";
+      if (exp !== undefined) seen.delete(k);
+      if (seen.size >= max) prune(now);
+      if (seen.size >= max) return "full";
+      seen.set(k, expiresAt);
+      if (file) {
+        prune(now);
+        writeNonceFile(file, seen);
+      }
+      return "ok";
+    },
+    size: () => seen.size,
+  };
+}
+
+const header = (headers, name) => {
+  const v = headers[name];
+  return Array.isArray(v) ? null : (v ?? null);
+};
+
+const refuse = (status, code, deviceId = null) => ({ ok: false, status, code, deviceId });
+
+/**
+ * Decide whether a phone request is authentic. Pure apart from the nonce store
+ * it is handed.
+ *
+ * @returns {{ok: true, device: object} | {ok: false, status: number, code: string, deviceId: string|null}}
+ */
+export function verifyRequest({
+  method,
+  target,
+  headers,
+  body,
+  registry,
+  nonces,
+  nowSec,
+  notBeforeSec,
+}) {
+  const deviceId = header(headers, HEADERS.device);
+  const ts = header(headers, HEADERS.timestamp);
+  const nonce = header(headers, HEADERS.nonce);
+  const sig = header(headers, HEADERS.signature);
+  if (
+    !DEVICE_ID.test(deviceId ?? "") ||
+    !TIMESTAMP.test(ts ?? "") ||
+    !NONCE.test(nonce ?? "") ||
+    !SIGNATURE.test(sig ?? "")
+  ) {
+    return refuse(401, "unsigned", DEVICE_ID.test(deviceId ?? "") ? deviceId : null);
+  }
+  const device = registry.devices.find((d) => d && d.id === deviceId);
+  if (!device) return refuse(401, "unknown-device", deviceId);
+  const t = Number(ts);
+  if (nowSec - t > WINDOW_SEC || t - nowSec > FUTURE_SKEW_SEC || t < notBeforeSec) {
+    return refuse(401, "stale-request", deviceId);
+  }
+  let text;
+  try {
+    text = canonicalPayload({
+      method,
+      target,
+      bodyDigest: bodyDigest(body),
+      deviceId,
+      timestamp: ts,
+      nonce,
+    });
+  } catch {
+    return refuse(401, "bad-signature", deviceId);
+  }
+  let good;
+  try {
+    good = verify(
+      null,
+      Buffer.from(text, "utf8"),
+      publicKeyObject(device.publicKey),
+      Buffer.from(sig, "base64url"),
+    );
+  } catch {
+    good = false;
+  }
+  if (!good) return refuse(401, "bad-signature", deviceId);
+  if (device.revokedAt) return refuse(401, "revoked-device", deviceId);
+  const seen = nonces.remember(`${deviceId}:${nonce}`, t + WINDOW_SEC, nowSec);
+  if (seen === "replayed") return refuse(401, "replayed", deviceId);
+  if (seen === "full") return refuse(503, "replay-store-full", deviceId);
+  return { ok: true, device };
+}
+
+/**
+ * The headers a device sends. The reference for a client implementation, and
+ * what the tests and smokes sign with.
+ */
+export function signRequest({
+  method,
+  target,
+  body = Buffer.alloc(0),
+  deviceId,
+  privateKey,
+  timestamp,
+  nonce,
+}) {
+  const ts = String(timestamp ?? Math.floor(Date.now() / 1000));
+  const n = nonce ?? randomBytes(18).toString("base64url");
+  const text = canonicalPayload({
+    method,
+    target,
+    bodyDigest: bodyDigest(Buffer.isBuffer(body) ? body : Buffer.from(String(body), "utf8")),
+    deviceId,
+    timestamp: ts,
+    nonce: n,
+  });
+  return {
+    "X-MA-Device": deviceId,
+    "X-MA-Timestamp": ts,
+    "X-MA-Nonce": n,
+    "X-MA-Signature": sign(null, Buffer.from(text, "utf8"), privateKey).toString("base64url"),
+  };
+}
+
+/** The verb a phone path names, or "unknown" when it is not a plain word. */
+export function verbOf(pathname) {
+  const seg = String(pathname).slice(PHONE_PREFIX.length).split("/")[0];
+  return VERB.test(seg) ? seg : "unknown";
+}
+
+function rotate(file, generations) {
+  if (!existsSync(file) || statSync(file).size <= AUDIT_MAX_BYTES) return;
+  for (let i = generations - 1; i >= 1; i--) {
+    if (existsSync(`${file}.${i}`)) renameSync(`${file}.${i}`, `${file}.${i + 1}`);
+  }
+  renameSync(file, `${file}.1`);
+}
+
+/** Per-process budget for the refusals log: rows written and dropped this minute. */
+const refusalBudget = { minute: -1, written: 0, dropped: 0 };
+
+/** Reset the refusals budget; for tests that call appendAudit directly. */
+export function resetRefusalBudget() {
+  refusalBudget.minute = -1;
+  refusalBudget.written = 0;
+  refusalBudget.dropped = 0;
+}
+
+/**
+ * One audit line. Only fixed-shape fields: nothing a caller controls reaches
+ * the file unless it matched a strict pattern first. A refusal decided before
+ * a signature verified goes to the refusals log instead, at most
+ * REFUSAL_ROWS_PER_MINUTE rows a minute; the first row written after rows were
+ * dropped carries `suppressed`, their count. Best effort: a log that cannot be
+ * written never turns a refusal into an acceptance or the reverse.
+ */
+export function appendAudit(
+  { deviceId, method, verb, status, outcome },
+  env = process.env,
+  nowMs = Date.now(),
+) {
+  try {
+    const dir = phoneDir(env);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const row = {
+      at: new Date(nowMs).toISOString(),
+      deviceId: DEVICE_ID.test(deviceId ?? "") ? deviceId : null,
+      method: METHOD.test(method ?? "") ? method : "?",
+      verb: VERB.test(verb ?? "") ? verb : "unknown",
+      status,
+      outcome: VERB.test(outcome ?? "") ? outcome : "unknown",
+    };
+    let file = auditPath(env);
+    let generations = AUDIT_GENERATIONS;
+    if (UNAUTHENTICATED_OUTCOMES.includes(row.outcome)) {
+      const minute = Math.floor(nowMs / 60000);
+      if (minute !== refusalBudget.minute) {
+        refusalBudget.minute = minute;
+        refusalBudget.written = 0;
+      }
+      if (refusalBudget.written >= REFUSAL_ROWS_PER_MINUTE) {
+        refusalBudget.dropped++;
+        return;
+      }
+      refusalBudget.written++;
+      if (refusalBudget.dropped) {
+        row.suppressed = refusalBudget.dropped;
+        refusalBudget.dropped = 0;
+      }
+      file = refusalsPath(env);
+      generations = 1;
+    }
+    rotate(file, generations);
+    appendFileSync(file, JSON.stringify(row) + "\n", { mode: 0o600 });
+    chmodSync(file, 0o600);
+  } catch {
+    // The request's answer does not depend on the log.
+  }
+}