Add an owner-restricted audit ledger with no secret or environment data #26

Goal

Add an owner-restricted audit ledger recording IDs, classifications, and required discovery context, never credentials, secrets, or environment snapshots.

Observations

• Recovery needs to know which mutations were attempted and their classification, including the discovery target and context.
• The ledger is owner-restricted (not world-readable); an authorized repository operator can read it without admin.
• It must not become a secret or environment store.

Decision gate

Approve ledger fields, access level, and redaction rules before writing any entry.

Acceptance criteria

• Each mutation has a stable ID, a classified outcome, and required discovery context.
• The ledger is owner-restricted and readable by an authorized repository operator without admin.
• No credential, secret, token, or environment snapshot is stored.

Verification

• Ledger write after a run -> IDs, classifications, and context only; secret scan finds nothing.
• Access check -> an authorized operator reads it without admin; an unauthorized reader cannot.

Release checkpoint

Remaining risk: retention policy is out of scope; no secret or environment data persists regardless.

Tracking

Roadmap item: B05-02. All acceptance criteria remain pending; publication does not grant approval or release authority.

Dependencies

• Depends on Classify failures versus unknown outcomes after partial apply #25 (B05-01).