Runtime configuration auditing#105
Open
gloskull wants to merge 2 commits into
Open
Conversation
…auditing Add runtime configuration drift auditing for meter-simulator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Provide a deterministic, low-latency runtime configuration auditing layer to detect drift between deployed baselines and live service configuration for system-wide observability and safer rollouts.
Ship an initial implementation for the meter simulator to define the pattern for other services and integrate with monitoring, canaries, and blue-green deploys.
Description
Add meter-simulator/src/runtime-config-auditor.js implementing canonicalization, stableStringify, hashConfig, secret redaction, flattenConfig, diffValues, and a RuntimeConfigAuditor class with createSnapshot, setBaseline, and audit methods.
Add unit tests meter-simulator/tests/runtime-config-auditor.test.js covering deterministic hashing, redaction, path-level drift detection, no-drift behavior, and additions/removals detection.
Add documentation docs/RUNTIME_CONFIG_AUDIT.md describing architecture, security model (redaction rules), runbook, monitoring expectations, and rollout guidance for drift-based gating.
Testing
Ran unit tests for the new auditor with npm test -- runtime-config-auditor.test.js --runInBand, which passed (4 tests).
Ran the full simulator test suite with npm test -- --runInBand, which failed due to pre-existing meter-device test issues (unrelated to this change) such as bad secret key size, peak-hour expectation mismatches, and message-length assertions.
Attempted cargo test -p utility_contracts for broader integration, which did not complete due to pre-existing Rust compile errors (e.g. duplicate MIGRATION_INSTRUCTION_BUDGET, overlong symbol_short! usage, and other compile-time issues) unrelated to the meter-simulator additions.
Closes #86