nordisk/gunnar

The account's audit log, the operator's aggregates, the name filter

Owner's enterprise list, 2026-10-05. Nothing here is bought: every account has it. The account model it sits on (owner, 2026-10-03): one account type; the person who starts it is its admin; employees are NEW users the admin enrolls; private by default; only the account admin makes things public.

1. The account admin's audit log

• What is in it — every security-relevant event in the account: logins (passkey; company SSO when that line lands) and refused logins, passkeys and SSH keys added, renamed and removed, invites made and withdrawn, enrolments completed, members added (and seats), removed and renamed, grants given and taken, the account gated, ungated or purged, repositories created, deleted, undeleted and purged, namespaces made and deleted, public/private changes (and a member's refused attempt), the namespace's settings, branch protection and ref-name policy, billing (an order, renewal or cancellation started at the console; the plan bought, prolonged or upgraded when monetize's fact lands), the operator's looks (asked, approved, refused, ended), names the filter refused or held and the admin's decision, and every export.
• Each entry carries who did it and what they are to the account — admin, member, operator, machine, outsider, system — decided by gunnar, not by whoever recorded it.
• Append-only and tamper-evident: one hash chain per account (gunnar_core::account_audit, SHA-256("gunnar-account-audit-v1" ‖ account ‖ prev ‖ seq ‖ …), every field length-prefixed). An edited, removed or reordered entry breaks the chain at that entry; an entry copied from another account does not verify. The page shows whether the chain holds and its tip; an admin who writes the tip down can later tell a cut tail too.
• Kept a year by default. The append that crosses the line, and a sweep every six hours, drop the days past it and keep the last dropped entry as the anchor, so a pruned log still verifies end to end.
• Stored as one control document per account (refs/gunnar/account-audit/<account>), so the twin holds it and a restore brings it back with everything else.
• Read ONLY by the account's admins — its own person, or a principal its admin made Admin over the namespace — filtered (kinds, who, time, text), paged, exported as CSV (formulas defused) or JSON: Enterprise.AuditLog, Enterprise.ExportAuditLog; console: Administration → Audit log (or Account → Audit log). A server-scope grant is not an admin of any account: the operator is refused, approved look or not.

2. The operator sees aggregates only

• The rule is in gunnar's ACL (AuthTable::may, may_namespace): inside a namespace whose first component is a PERSON's account, a PERSON's server-scope grant — held directly or through a group — counts for nothing. Every door asks that one function, so SSH, smart-HTTP and every gRPC verb refuse the operator alike: no clone, no Repos.Get, no ListEmployees, no making anything public, no repository created inside. The account's own person, its employees, a grant its admin made on its namespace or a repository, and a PUBLIC repository still reach as before. Namespaces no person owns (the operator's own forge, nordisk), the operator's own account, and the namespace of the box's FIRST identity — the one bootstrap enrolled, the installer's admin key, which is the estate itself as a machine is — are the operator's as before.
• Listings are narrowed by the same rule: Repos.List, ListNamespaces, ListDeleted, ListOrphans, Usage.ReadAll (a nested namespace's row), Events.Watch for a server reader, and the identity listings — an account's MEMBERS (its employees) are not listed, their keys, grants and invites are not shown, and their passkeys are shown by opaque id alone (the console's login offers them, nothing names them).
• The totals — Enterprise.Aggregates, server Read; console: Administration → Accounts: accounts, accounts with employees, members, repositories (public), storage used and sold, paid accounts, the looks, health.
• A look, only when the account admin grants it: the operator asks (Enterprise.RequestOperatorAccess: an account, a reason, minutes — at most a week); nothing changes until the ACCOUNT'S admin approves it with a fresh, user-verified step-up of their OWN passkey and the request's code (the machine enrolment's Approve flow), or refuses it. An approved look READS — never writes — until it ends on its own or the admin ends it. Every step is in the account's audit log. A request nobody answers lapses after three days.

What still reaches the operator — said plainly

"We don't look, and the system doesn't show us." It is not secrecy from the people who run the box. What remains:

1. Names in clone URLs. https://git.gunnar.rs/<account>/<repo>.git and the SSH path pass through the operator's front and gunnar's own process; the account and repository names are in those requests and in gunnar's own log lines (the journal, /serialdat) that whoever holds the box can read. The domain itself says whose forge it is.
2. The box's own logs and trails. gunnar's tracing records name repositories and principals on transfers and decisions. The control plane's server-wide audit trail (GUN-044) is served over the API as its shape only (Admin.AuditTrail carries no entry), but the file is on the operator's disk.
3. Timing and size. When an account is active, how long its requests take, how much it moves.
4. Totals. The account's share of the aggregate figures, its own size and room (Usage.ReadAll's row for the account itself), and what it bought (the entitlement facts monetize pushes are the operator's to bill by).
5. The account's own name. An account is addressed by its id — its namespace and its owner's principal — to gate, bill or recover it. Its members' names are not shown.
6. Root on the box. The control store holds every repository, every name and every audit entry — pruned days included, in old document versions, until the store is compacted — and the twin and the backups hold copies. True secrecy from the operator needs keys the customer holds (the encrypted-repos line), not an API rule.
7. The identity verbs are still the operator's. A server admin can add a passkey, an SSH key or an invite to an account's person (account recovery). Each such act is written into THAT account's audit log as done by an operator, which the operator cannot read and cannot rewrite without breaking the chain the admin sees.
8. Machine keys, and the box's first identity. The shield binds people. A MACHINE principal's server grant — the replicator that pushes a tenant's data to its standby, the console's relay, an ops kit approved as a machine — keeps its reach, because a standby that refused a lapsed tenant's push would diverge from its primary. The same holds for the box's first identity (the installer's admin key bootstrap enrolled). Whoever holds such a key (the operator does, on its own boxes) can use it; the console's break-glass admin token signs with the console's own machine key. The operator's PASSKEY session in the console is a person and is shielded.
9. monetize's narrowed principal calls its listed verbs (Entitlement.*, Accounts.EnrollEmployee with an order, Usage.ReadAll, Accounts.Purge) without consulting grants, by design; a server-scope caller delivering a PAID order may enrol the new user the order names. Both land in the account's audit log.
10. Public is public — a repository or an account's events its admin made public are readable by the operator as by anybody.

3. The name filter

• Account, namespace, member and repository names are put to it where gunnar makes them: AddPrincipal, RenamePrincipal, EnrollEmployee, CreateNamespace, Repos.Create (gunnar_core::name_filter).
• Folding before matching: zero-width characters dropped, unicode confusables (Cyrillic, Greek, fullwidth, mathematical, circled, accented) folded, leetspeak (0 1 3 4 5 6 7 8 9 @ $ !, ph), separators removed, each letter stretchable (fuuuck). Words of four letters or fewer match a whole word only (the Scunthorpe rule), and an allow list names words that contain a listed one and are fine.
• Blocked → refused with a sentence that does not repeat the word; noted in the account's review queue and its audit log. Reserved (machine names kit-, console-, twin-…, brands — gunnar, vetra, ignalina, nordisk — and staff roles — admin, support, security, root…) → refused for a PERSON's name or an account's namespace; the operator (a person with server Admin) may still name the estate's own, and machines, groups and deploy keys are gunnar's machinery. Borderline → held for the ACCOUNT ADMIN's review (Enterprise.ListNameReviews, DecideNameReview; console: the Names panel of the Audit log), never the operator's; allowed, the same name passes in that account from then on. A borderline name for a NEW account (no admin yet to ask) is refused unless the operator names it.
• The lists are gunnar's configuration (refs/gunnar/name-filter, Enterprise.GetNameLists / SetNameLists, a server admin's), with gunnar's defaults until set — never hard-coded in the console.