Document audit outcome semantics for asynchronous notebook persistence

Co-Authored-By: Erik Rozi <erik.rozi@cognition.ai>

Author: devin-ai-integration[bot]

API.md

@@ -1388,6 +1388,13 @@ Each record has the shape:
 }
 ```
 
+`outcome` describes the operator action as carried out by the application. For
+actions that persist through `openmct.objects.mutate` (notebook entries), the
+write is queued in the active transaction or saved asynchronously, so a later
+provider failure is reported through the persistence error path rather than by
+rewriting the audit record. Import and export await their writes and report
+`'failure'` when a write is rejected.
+
 Providers receive every completed record and may return a promise. A provider
 that throws or rejects is logged and does not affect the originating action or
 other providers:

docs/security/asd-stig-nist-800-53-review.md

@@ -95,7 +95,7 @@ used across this organization's repositories.
 | F-10 | `innerHTML` sites: `src/ui/inspector/InspectorViews.vue:63`, `src/ui/components/ObjectView.vue:171`, `src/ui/preview/PreviewContainer.vue:115`, `src/plugins/inspectorViews/styles/SavedStylesInspectorView.vue:48,56`, `src/plugins/summaryWidget/src/SummaryWidget.js:209`, `.../TestDataItem.js:177`, `.../Condition.js:197`, `.../input/Select.js:88`, `src/plugins/notebook/components/NotebookSnapshotIndicator.vue:100`, `src/plugins/imagery/components/ImageryTimeView.vue:329`, `src/plugins/performanceIndicator/plugin.js:88`, `src/plugins/plot/chart/MctChart.vue:561` | Each site assigns an empty string or a static developer-authored template literal with no interpolated user data. `NotebookEntry.vue:318` returns sanitized output from F-05. | CWE-79 | V-222602 | SI-10 | CAT I | V-220632 | `satisfied` (no untrusted data reaches these sinks). Reviewer note: `MctChart.vue:561` and `performanceIndicator/plugin.js:88` interpolate only constants; re-review if they are ever given object-derived values. |
 | F-11 | `src/plugins/formActions/CreateAction.js:94` | Object-creation failure interpolated the raw error object into the operator notification (`Error saving objects: ${err}`). Same pattern as F-02/F-04/F-06; `EditPropertiesAction.js:76` and `BrowseBar.vue:440` already used the generic form. | CWE-209 | V-222610 | SI-11(a) | CAT II | V-220641 | `not-satisfied` -> remediated: generic message, raw error logged. |
 | F-12 | `src/ui/layout/AboutDialog.vue:30` | `v-html="branding.aboutHtml"`: content is the deployer's static `Branding` configuration (`src/api/Branding.js:29`), not end-user data. | CWE-79 | V-222602 | SI-10 | CAT I | V-220632 | `satisfied` (configuration-only sink). Deployers must treat `aboutHtml` as trusted markup. |
-| F-13 | `src/api/user/UserAPI.js:135`, `src/api/faultmanagement/FaultManagementAPI.js:122-171`, `src/plugins/importFromJSONAction/ImportFromJSONAction.js:107,350,366`, `src/plugins/exportAsJSONAction/ExportAsJSONAction.js:107,391`, `src/plugins/notebook/utils/notebook-entries.js:242,266,335,356`, `src/plugins/notebook/components/NotebookComponent.vue:586` | No audit records were produced for operator actions that already carry a user context (import, export, role change, notebook entry create/delete, fault acknowledge/shelve). | CWE-778 | V-222471 Log user actions involving access to data; V-222472 Log user actions involving changes to data; V-222476 Audit records establish outcome; V-222477 Audit records establish identity. | AU-2, AU-3, AU-12 | CAT II | V-220635 | `not-satisfied` -> remediated: `src/api/audit/AuditLogger.js` registered as `openmct.audit` (`src/MCT.js:205`) emits `{id, source, timestamp, action, outcome, actor{id,username,role}, target, details}` to in-process subscribers; hooks at the listed sites, including policy-rejected imports (`ImportFromJSONAction.js` composition-policy branch). Role changes mirrored from another browsing context (`ActiveRoleSynchronizer`) are not re-recorded, so one selection yields one record. Public contract documented in `API.md` ("Audit API"). No external sink is configured (see F-20). |
+| F-13 | `src/api/user/UserAPI.js:135`, `src/api/faultmanagement/FaultManagementAPI.js:122-171`, `src/plugins/importFromJSONAction/ImportFromJSONAction.js:107,350,366`, `src/plugins/exportAsJSONAction/ExportAsJSONAction.js:107,391`, `src/plugins/notebook/utils/notebook-entries.js:242,266,335,356`, `src/plugins/notebook/components/NotebookComponent.vue:586` | No audit records were produced for operator actions that already carry a user context (import, export, role change, notebook entry create/delete, fault acknowledge/shelve). | CWE-778 | V-222471 Log user actions involving access to data; V-222472 Log user actions involving changes to data; V-222476 Audit records establish outcome; V-222477 Audit records establish identity. | AU-2, AU-3, AU-12 | CAT II | V-220635 | `not-satisfied` -> remediated: `src/api/audit/AuditLogger.js` registered as `openmct.audit` (`src/MCT.js:205`) emits `{id, source, timestamp, action, outcome, actor{id,username,role}, target, details}` to in-process subscribers; hooks at the listed sites, including policy-rejected imports (`ImportFromJSONAction.js` composition-policy branch). Role changes mirrored from another browsing context (`ActiveRoleSynchronizer`) are not re-recorded, so one selection yields one record. Import and export await their writes and record `failure` when a write is rejected; notebook hooks record the operator action at mutation time because `ObjectAPI.mutate()` queues the write in the active transaction or saves asynchronously and exposes no persistence result, so a later provider failure is reported through the persistence error path (F-06/F-07) rather than by rewriting the audit record. Public contract documented in `API.md` ("Audit API"). No external sink is configured (see F-20). |
 | F-14 | `src/plugins/URLIndicatorPlugin/URLIndicator.js:78,100` | The indicator polls a deployer-configured URL with `fetch()` and reports reachability only; the response body is not rendered. Whether the configured URL uses TLS is a deployment setting. | CWE-319 | V-222596 Protect confidentiality and integrity of transmitted information. | SC-8 | CAT I | V-220634 | `needs-input` (URL scheme is configuration). Input handling: `satisfied` (no body rendering). |
 | F-15 | `src/plugins/persistence/couch/plugin.js:36-68`, `CouchObjectProvider.js:39,218,464` | CouchDB base URL is deployer configuration; the client uses `fetch()` and inherits browser cookies. TLS termination and TLS version policy are not visible in source. | CWE-319 | V-222596; V-222597 Cryptographic mechanisms during transmission. | SC-8, SC-8(1), SC-13 | CAT I | V-220634 | `needs-input`. |
 | F-16 | `src/plugins/persistence/couch/CouchObjectProvider.js:218` | No credentials are embedded in source (`satisfied` for V-222642 / IA-5(7)). Authentication to CouchDB (proxy auth, cookie session, IdP) is external to this code. | CWE-306 | V-222522 Uniquely identify and authenticate organizational users; V-222642 No embedded authentication data. | IA-2, IA-5(7), AC-3 | CAT I | V-220629 | `needs-input` for IA-2/AC-3; `satisfied` for IA-5(7). |