feat(spec)!: remove the dead AuditConfig cluster from @objectstack/spec/system (#1878) (#3593)

The entire system/audit.zod.ts module — AuditConfigSchema, AuditStorageConfig,
AuditRetentionPolicy, AuditEventFilter, SuspiciousActivityRule,
DEFAULT_SUSPICIOUS_ACTIVITY_RULES, and the AuditEvent* shape schemas — had
ZERO consumers repo-wide. The live audit path (plugin-audit) imports none of
it: capture is unconditional via engine hooks (compliance ledger), the row
shape is owned by plugin-audit's sys_audit_log object, retention rides the
object lifecycle `audit` category with per-org settings overrides, and the
authoring surface is object/field trackHistory. AuditConfigSchema.enabled
even advertised turning the compliance ledger OFF — a semantic the platform
deliberately rejects. Same ADR-0056 D8 family as the compliance.zod /
masking.zod / RLSAuditConfig / PolicySchema removals.

- Delete system/audit.zod.ts + audit.test.ts; drop the export from
  system/index.ts with a removal note (house pattern).
- Drop the 11 manifest ratchet keys; regenerate JSON schemas, reference docs
  (references/system/audit.mdx removed by regen), and the API surface
  (21 exports, pure removal).
- Fix the stale security-context.zod.ts module doc (audit joins the already
  removed compliance/masking bullets) and drop the PROTOCOL_MAP.md row
  (protocol-map gate caught the dangling link).
- Annotate the 2026-07 security recheck doc: loose-end #1 done (verified
  scope = whole module, not just AuditRetentionPolicy); #2 done via #3557.
- Changeset (minor per launch-window policy) carries the dead-knob → live-
  surface migration table.

Verified: 6679 spec tests green, tsc clean, check:docs/api-surface/skill-refs/
react-blocks in sync, downstream-contract typecheck clean (gate not pinning
any Audit export).

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

.changeset/prune-dead-audit-config-cluster.md

@@ -0,0 +1,38 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec)!: remove the dead `AuditConfig` cluster from `@objectstack/spec/system` (#1878 recheck loose-end)
+
+The entire `system/audit.zod.ts` module — `AuditConfigSchema`,
+`AuditStorageConfigSchema`, `AuditRetentionPolicySchema`,
+`AuditEventFilterSchema`, `SuspiciousActivityRuleSchema`,
+`DEFAULT_SUSPICIOUS_ACTIVITY_RULES`, and the `AuditEvent` /
+`AuditEventActor` / `AuditEventTarget` / `AuditEventChange` /
+`AuditEventType` / `AuditEventSeverity` shape schemas (plus all their
+type exports) — is removed. Verified zero consumers repo-wide: the live
+audit path (`plugin-audit`) imports none of it, defines its own
+`sys_audit_log` row shape, and captures **unconditionally** via engine
+hooks, so `AuditConfigSchema.enabled: false` advertised a semantic
+(turning the compliance ledger off) the platform deliberately rejects.
+Same ADR-0056 D8 family as the earlier `compliance.zod` / `masking.zod` /
+`RLSAuditConfig` / `PolicySchema` removals: security/compliance-shaped
+config must never merely look live.
+
+**Migration — every dead knob maps to a live surface (or is deliberately
+not configurable):**
+
+| Removed (never enforced) | Live replacement |
+| --- | --- |
+| `AuditConfigSchema.enabled` | none — audit capture is **always on** (compliance ledger; `object.zod` `trackHistory` contract) |
+| `eventTypes` / `excludeEventTypes` / `minimumSeverity` / `AuditEventFilterSchema` | none today — if event filtering ships it lands as an `audit` **settings** namespace (ADR-0069 pattern), not app metadata |
+| which fields/objects are summarized + History tab UI | object-level + field-level **`trackHistory`** (live, enforced by plugin-audit) |
+| `AuditRetentionPolicySchema` / `storage` | object **`lifecycle`** `audit` category (retain → archive → delete) + per-org settings overrides (ADR-0057) |
+| `SuspiciousActivityRuleSchema` / `DEFAULT_SUSPICIOUS_ACTIVITY_RULES` | none — no detection engine exists; security monitoring is org-operations tooling, not app-package metadata |
+| `AuditEvent*` shape schemas | the `sys_audit_log` object definition in `plugin-audit` is the row-shape source of truth |
+
+No first-party, example, or downstream-contract code imported any of
+these symbols; `defineStack` never accepted an `audit` key, so no stack
+config changes. Docs page `references/system/audit.mdx` is removed by
+regeneration; the security-context module doc now marks audit alongside
+the previously removed compliance/masking subsystems.

content/docs/references/system/audit.mdx

@@ -7,7 +7,6 @@ This section contains all protocol schemas for the system layer of ObjectStack.
 
 <Cards>
   <Card href="/docs/references/system/app-install" title="App Install" description="Source: packages/spec/src/system/app-install.zod.ts" />
-  <Card href="/docs/references/system/audit" title="Audit" description="Source: packages/spec/src/system/audit.zod.ts" />
   <Card href="/docs/references/system/auth-config" title="Auth Config" description="Source: packages/spec/src/system/auth-config.zod.ts" />
   <Card href="/docs/references/system/book" title="Book" description="Source: packages/spec/src/system/book.zod.ts" />
   <Card href="/docs/references/system/cache" title="Cache" description="Source: packages/spec/src/system/cache.zod.ts" />

content/docs/references/system/index.mdx

@@ -29,7 +29,6 @@
     "translation",
     "worker",
     "---Observability---",
-    "audit",
     "logging",
     "metrics",
     "tracing",

content/docs/references/system/meta.json

@@ -9,15 +9,21 @@ Unified Security Context Protocol
 
 Provides a central governance layer that correlates and unifies
 
-the four independent security subsystems:
+the four independent security subsystems it was designed against. Three of
 
-- **Audit** (audit.zod.ts): Event logging and suspicious activity detection
+the four have since been REMOVED per ADR-0056 D8 (declared-but-never-enforced;
+
+see system/index.ts notes) — only encryption survives, marked experimental:
+
+- **Audit** (audit.zod.ts — REMOVED): the live audit path is plugin-audit's
+
+always-on capture + object/field `trackHistory` + lifecycle `audit` retention
 
 - **Encryption** (encryption.zod.ts): Field-level encryption and key management
 
-- **Compliance** (compliance.zod.ts): Regulatory framework enforcement (GDPR/HIPAA/SOX/PCI-DSS)
+- **Compliance** (compliance.zod.ts — REMOVED): GDPR/HIPAA/SOX/PCI-DSS configs
 
-- **Masking** (masking.zod.ts): PII data masking and tokenization
+- **Masking** (masking.zod.ts — REMOVED): PII data masking and tokenization
 
 This schema enforces cross-cutting security policies, ensuring compliance
 

content/docs/references/system/security-context.mdx

@@ -53,12 +53,20 @@ enterprise/cloud-enforced (agent `access`).
 
 ## Genuine remaining loose ends (actionable)
 
-1. **Prune `AuditRetentionPolicySchema`** (`packages/spec/src/system/audit.zod.ts`)
-   — a real parsed-only/dead spec schema with no runtime consumer; retention is
-   enforced on the `lifecycle` surface. Prune (or wire-rename to `lifecycle`).
-2. **SharingRule dead recipient types** — `owner`-type rules and `group`/`guest`
-   recipients are skipped by the bootstrap while criteria-type rules enforce.
-   Enforce-or-prune the dead subset so authored rules don't silently no-op.
+1. ~~**Prune `AuditRetentionPolicySchema`**~~ — **✅ Done (2026-07-27)**, and the
+   verified scope was larger: the **entire `audit.zod.ts` module** (AuditConfig /
+   AuditStorageConfig / AuditRetentionPolicy / AuditEventFilter /
+   SuspiciousActivityRule + the AuditEvent* shape schemas) had zero consumers —
+   the live audit path (plugin-audit) captures unconditionally via engine hooks
+   and defines its own `sys_audit_log` row shape, and `AuditConfigSchema.enabled`
+   contradicted the always-on compliance-ledger contract. Whole module removed;
+   the enforced authoring surface is object/field `trackHistory` + the object
+   `lifecycle` `audit` category, with per-org overrides in settings.
+2. ~~**SharingRule dead recipient types**~~ — **✅ Done (#3557)**: recipients
+   reconciled against the live identity model — `group` wired as `team`,
+   `business_unit` added, and the unenforceable `guest` recipient + `owner`-type
+   rules removed from the authoring surface (authored rules no longer silently
+   no-op).
 3. **Per-org / per-user IP allow-list** — global-only today; per-org
    `sys_organization.allowed_ip_ranges` is unimplemented (tracked **#2571**).
 4. **Doc / ledger drift** (non-code-behavior):

docs/audits/2026-07-security-props-liveness-recheck.md

@@ -136,7 +136,6 @@ This document serves as the **Grand Map** of the ObjectStack specification. It l
 | [`auth-config.zod.ts`](src/system/auth-config.zod.ts) | | **Auth Configuration**. SSO, OIDC, SAML settings. |
 | [`http-server.zod.ts`](src/system/http-server.zod.ts) | | **HTTP Server**. Server port, CORS, and middleware settings. |
 | [`logging.zod.ts`](src/system/logging.zod.ts) | | **Logging**. Log levels and output formats. |
-| [`audit.zod.ts`](src/system/audit.zod.ts) | | **Audit Trail**. Audit logging configuration. |
 | [`cache.zod.ts`](src/system/cache.zod.ts) | | **Caching**. Redis/Memory cache strategies. |
 | [`metrics.zod.ts`](src/system/metrics.zod.ts) | | **Observability**. Prometheus/OpenTelemetry metrics. |
 | [`tracing.zod.ts`](src/system/tracing.zod.ts) | | **Tracing**. Distributed tracing configuration. |

packages/spec/PROTOCOL_MAP.md

@@ -610,24 +610,6 @@
     "AppTranslationBundleSchema (const)",
     "AudienceBook (interface)",
     "AudienceCaller (interface)",
-    "AuditConfig (type)",
-    "AuditConfigSchema (const)",
-    "AuditEvent (type)",
-    "AuditEventActor (type)",
-    "AuditEventActorSchema (const)",
-    "AuditEventChange (type)",
-    "AuditEventChangeSchema (const)",
-    "AuditEventFilter (type)",
-    "AuditEventFilterSchema (const)",
-    "AuditEventSchema (const)",
-    "AuditEventSeverity (type)",
-    "AuditEventTarget (type)",
-    "AuditEventTargetSchema (const)",
-    "AuditEventType (type)",
-    "AuditRetentionPolicy (type)",
-    "AuditRetentionPolicySchema (const)",
-    "AuditStorageConfig (type)",
-    "AuditStorageConfigSchema (const)",
     "AuthConfig (type)",
     "AuthConfigSchema (const)",
     "AuthPluginConfig (type)",
@@ -732,7 +714,6 @@
     "CursorStyleSchema (const)",
     "CursorUpdate (type)",
     "CursorUpdateSchema (const)",
-    "DEFAULT_SUSPICIOUS_ACTIVITY_RULES (const)",
     "DashboardLike (interface)",
     "DataClassification (type)",
     "DataClassificationPolicy (type)",
@@ -1174,8 +1155,6 @@
     "SupplierSecurityPolicySchema (const)",
     "SupplierSecurityRequirement (type)",
     "SupplierSecurityRequirementSchema (const)",
-    "SuspiciousActivityRule (type)",
-    "SuspiciousActivityRuleSchema (const)",
     "SystemFieldName (type)",
     "SystemObjectName (type)",
     "SystemUserId (type)",

packages/spec/api-surface.json

@@ -1263,16 +1263,6 @@
     "system/AppInstallResult",
     "system/AppManifest",
     "system/AppTranslationBundle",
-    "system/AuditConfig",
-    "system/AuditEvent",
-    "system/AuditEventActor",
-    "system/AuditEventChange",
-    "system/AuditEventFilter",
-    "system/AuditEventSeverity",
-    "system/AuditEventTarget",
-    "system/AuditEventType",
-    "system/AuditRetentionPolicy",
-    "system/AuditStorageConfig",
     "system/AuthConfig",
     "system/AuthPluginConfig",
     "system/AuthProviderConfig",
@@ -1533,7 +1523,6 @@
     "system/SupplierSecurityAssessment",
     "system/SupplierSecurityPolicy",
     "system/SupplierSecurityRequirement",
-    "system/SuspiciousActivityRule",
     "system/Task",
     "system/TaskExecutionResult",
     "system/TaskPriority",