Summary

Audit follow-up for review item #21 (cross-cutting audit-attribution bugs). Two problems fixed across budget mutation endpoints:

1. Caller attribution: Rows used to either omit the caller (update_budget, update_agent_budget emitted no audit at all) or, where the row was emitted, lose the diff context.
2. Old → new diff: update_user_budget previously logged only the forward state (hourly=X daily=Y monthly=Z alert=A). Forensics had to correlate multiple rows to see what was rotated.

Both are now self-describing in a single row.

Call sites changed

The require_admin / require_admin_for_user_budget paths in routes/audit.rs, routes/authz.rs, and routes/budget.rs already pass Some(u.user_id) for the user_id field — agent_id="system" there is correct because the action wasn't an agent invocation, it was a request denial. Left those alone per task notes.

Audit detail samples

Before (update_user_budget):

user_budget updated for Alice: hourly=5 daily=10 monthly=100 alert=0.8

Reader cannot tell what changed without correlating with the previous row.

After (update_user_budget, second PUT bumping hourly 1.0 → 5.0):

user_budget updated for Alice: hourly: 1→5 daily: 10→10 monthly: 100→100 alert: 0.8→0.8

After (update_user_budget, first-time configuration):

user_budget updated for Alice: hourly: none→1 daily: none→10 monthly: none→100 alert: none→0.8

After (delete_user_budget):

user_budget cleared for Alice: hourly: 5→none daily: 10→none monthly: 100→none alert: 0.8→none

After (update_budget global):

global_budget updated: hourly: 0→2 daily: 0→20 monthly: 0→200 alert: 0.8→0.8 tokens/h_default: 0→0

After (update_agent_budget):

agent_budget updated for {agent-uuid}: hourly: 1→5 daily: 10→10 monthly: 100→100 tokens/h: none→1000

Implementation notes

• Diff helpers (fmt_user_budget_diff, fmt_agent_resources_diff, fmt_global_budget_diff) live at the top of crates/librefang-api/src/routes/budget.rs. None renders as the literal none so a missing cap is distinguishable from 0.0 (which means "explicitly unlimited").
• f64 default Display is used (no rounding); 1.0_f64.to_string() == "1".
• Hash-chain integrity is preserved — only the detail string changed; the chain re-hashes the entire entry.
• The agent_id field in update_agent_budget's audit row is the target agent (the one whose cap is being mutated), not the actor. The actor is in user_id. This matches the existing convention used by other agent-scoped writes.

Test plan

• test_user_budget_put_audit_records_old_new_diff_and_caller (new): two sequential PUTs to /api/budget/users/Alice, then queries /api/audit/query?action=ConfigChange and asserts:
  • first PUT row contains hourly: none→1 and alert: none→0.8
  • second PUT row contains hourly: 1→5
  • user_id field is the calling admin's UUID (Alice)
  • agent_id field is "system" (config mutations are not agent-scoped)
  • detail is prefixed "user_budget updated for " for grep-friendly forensics
• CI runs cargo build --workspace --lib, cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings (skipped locally per repo policy)

Linked review item

Follow-up to review item #21 from the audit-attribution review.