Module audit 

Structured audit trail (NIAP CA PP FAU family).

All EST and administrative operations that must be logged for Common Criteria evaluation call record. The function inserts one row into audit_events, enforces the overflow policy (FAU_STG.4), and maintains the rolling security-violation counter for the alarm response (FAU_ARP.1).

NIAP CA PP requirements implemented

SFR	Requirement	Implementation
FAU_GEN.1	Audit record generation	AuditEventType taxonomy covers all required events
FAU_STG.1(1)	Audit trail protection	Append-only + tamper-evident hash chain (verify_chain)
FAU_STG.4	Audit storage exhaustion	OverflowAction::Halt rejects EST operations
FAU_ARP.1	Security alarm	Alarm after N consecutive violations

Structs

AuditEvent

A single audit event ready for recording.

AuditState

Shared audit state (overflow flag, alarm counter).

ChainVerifyReport

Outcome of a full hash-chain verification pass (NIAP CA PP FAU_STG.1).

Enums

AuditEventType

Every auditable operation the server can perform.

Functions

record

Record an audit event to the database.

record_checked

Persist an event before a security-sensitive operation; propagate failure.

verify_chain

Re-walk the entire audit trail and verify the tamper-evident hash chain.