3tears-agent-audit
Unified audit envelope + fire-and-forget publish helper for the 3tears platform.
Purpose
Single AuditEvent envelope + single publish_audit helper used by every
domain (workspace, rbac, memory, custom tools) so the audit pipeline is
one subject tree, one consumer, one table, one admin query API. Replaces
domain-specific envelopes (WorkspaceAuditEnvelope,
RbacAuditEnvelope) that produced slightly-different wire shapes per domain
and made cross-domain audit queries require a UNION.
The package is pure Python with no NATS consumer code and no Postgres code. Publish is the only direction: a consumer-side audit consumer owns persistence to the audit events table.
Public API
from threetears.agent.audit import AuditEvent, publish_audit
AuditEvent-- pydanticBaseModelwithextra='forbid', timezone-awaretimestampvalidator, closedevent_typestring family (dotted verb, e.g.workspace.fs_write,rbac.assignment.create). All common identity fields are typed columns on the envelope; event-type-specific extras live indetails: dict[str, Any].publish_audit(event, nats_client, namespace)-- fire-and-forget async helper. Serializes the envelope viamodel_dump_json()and awaits onenats_client.publishon{namespace}.audit.{event_type}. On any publish failure logs at WARN and returns; never raises.
Design commitments
- Fire-and-forget. Audit publish failures must never break the producing call. The helper catches every exception, logs at WARN, and returns.
- Typed wire contract.
extra='forbid'+ timezone-aware validator catch publisher-side drift at construction time, not at the consumer's decode. - No domain-specific envelope types. Every domain publishes the same
model;
event_typeconveys the domain. - No dual-emit. There is no legacy envelope the consumer still accepts in parallel. Emission sites migrate in the same PR that deletes the legacy envelope module.
Subject naming
{namespace}.audit.{event_type} where event_type is the dotted event
name (e.g. {namespace}.audit.workspace.fs_write). The consumer
subscribes to {namespace}.audit.> so new event types route automatically
without consumer-side changes.
1 maintainer
Release files for 3tears-agent-audit 0.48.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| 3tears_agent_audit-0.48.0.tar.gz | 14.3 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| 3tears_agent_audit-0.48.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 24.9 kB
Release files / 3tears_agent_audit-0.48.0.tar.gz
| Download URL | 3tears_agent_audit-0.48.0.tar.gz |
|---|---|
| Size | 14.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
91fc721833b5740a0da4a29d1816089757d46f258ec543749e3c2a33f2863003
|
|
BLAKE2b-256 checksum How to use checksums |
bdc70e046e92a51aea8a60bf5897b21a8f8a777f8c377a39c56fba3b6acded29
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 22, 2026.
Transparency logRelease files / 3tears_agent_audit-0.48.0-py3-none-any.whl
| Download URL | 3tears_agent_audit-0.48.0-py3-none-any.whl |
|---|---|
| Size | 10.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
cf18034882118f1f385d25e9a6ce06fe193e145cd23fa10d24dbf017631b9c32
|
|
BLAKE2b-256 checksum How to use checksums |
d6e56970d9fa2e1fbee09c05b3f7c53c3645935377a89a56a3f792e2a73ff227
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 22, 2026.
Transparency log
