An automated review of #1189 flagged that review ownership audit events lose their correlation identifiers. The review ownership outbox records in crates/registry-casework/src/review.rs insert requestId and taskId, but published_audit_record in crates/registry-casework/src/runtime.rs copies a fixed allow-list (event, eventId, profileId, itemRevision, directoryRevision, actorRef, accountabilityEventId) and pseudonymizes only itemId, grantId, teamId and queueId. Neither requestId nor taskId is in either list, so both are dropped before the chained JSONL append.
Failure scenario: claim, assignment, delegation, release and cancellation records reach the durable journal as uncorrelated event/principal pairs. Once review history is erased, the journal cannot say which review responsibility changed, which is the reason those events were added.
Suggested fix:
- Add keyed
requestId -> requestPseudonym and taskId -> taskPseudonym mappings to the publisher, following the existing pseudonym pattern.
- Extend the publisher tests to assert both pseudonyms survive.
Filed from the review of #1189; not merge-blocking.
An automated review of #1189 flagged that review ownership audit events lose their correlation identifiers. The review ownership outbox records in
crates/registry-casework/src/review.rsinsertrequestIdandtaskId, butpublished_audit_recordincrates/registry-casework/src/runtime.rscopies a fixed allow-list (event,eventId,profileId,itemRevision,directoryRevision,actorRef,accountabilityEventId) and pseudonymizes onlyitemId,grantId,teamIdandqueueId. NeitherrequestIdnortaskIdis in either list, so both are dropped before the chained JSONL append.Failure scenario: claim, assignment, delegation, release and cancellation records reach the durable journal as uncorrelated event/principal pairs. Once review history is erased, the journal cannot say which review responsibility changed, which is the reason those events were added.
Suggested fix:
requestId->requestPseudonymandtaskId->taskPseudonymmappings to the publisher, following the existing pseudonym pattern.Filed from the review of #1189; not merge-blocking.