Auditable LB changes, evidence export, and console fixes (F1–F3)

[henleda]

Adds an end-to-end audit trail for every change made to a load balancer, an evidence
export, and two console fixes. Also carries four earlier apply commits that were sitting
unmerged on this branch — see Also in this PR at the bottom.

Why

An audit entry could not answer the questions an auditor asks. Of the 15 actions the
codebase emits, not one apply_* recorded a finding_id — every apply function had it
in scope and dropped it — and nothing recorded the XC namespace, the operator, or which run
a change belonged to. /api/audit existed but nothing in the UI ever called it.

What changed

F3 — auditable LB changes (76e29f9)

• audit.record stamps run_id / actor / host / tool_version centrally, so no
  mutating path can forget it and a caller cannot override it.
• finding_id + namespace on all 19 record sites. apply_waf / apply_data_guard /
  apply_api_schema also record kept — "was it rolled back" alone cannot say whether a
  change is still live.
• ApplyContext carries finding_id, so a rollback failure raised deep in the spine is
  still attributable.
• New runmeta.py: <out>/run.json provenance manifest (repo commit/branch, per-agent
  models, caps, counts) keyed by a run_id every entry joins back to. Fail-soft — it never
  fails a completed scan.
• New export.py: normalizes the heterogeneous append-only log into one reviewable row per
  event, and packages a .zip whose manifest SHA-256s every member. vpcopilot export is
  the CLI twin.

F1 + F2 + F3 console (f5017a7)

• /api/scan was truncating to the last 40 lines (/api/action: 60) — the full transcript
  never reached the client. Both now serve the whole log with a ?since= tail, in a bounded
  scrollable box that sticks to the tail unless you scroll up to read.
• The HTML report is now reachable from ② Review, plus a stamped ?download=1.
• ⑤ Retire shows the audit trail before you can export it, so you can check what leaves
  the machine.

Docs + fixture (806717d) — new docs/AUDIT.md, README rewrite, USAGE §7 rewritten (it
described tabs that no longer exist), all five screenshots regenerated.

Verification

• ruff check src tests demo clean; 186 tests pass, coverage 73% (floor 65%).
• 30 new tests across test_export.py, test_audit_provenance.py, test_console_*.py.
• The bundle-verification snippet in docs/AUDIT.md was run verbatim against a real
  bundle: 18 members, 0 hash mismatches.
• Console changes verified in a real browser, not just unit-tested.

Honest limits (stated in the docs, not just here)

• The log is written by the process making the change, to a local file. It is not
  tamper-evident. The manifest's SHA-256s prove a bundle was not altered after export;
  they say nothing about the log before it.
• actor is self-asserted — attribution, not authentication.
• Dry runs are not recorded (nothing changed), and apply_timing only exists for
  console-driven live applies. The bundle manifest states both in-band.
• Entries written by older builds lack the new fields; the exporter recovers what it can via
  the legacy finding key and the policy index, and leaves cells blank rather than guessing.
• No backfill of historic audit.log files. Tracked in BACKLOG.md along with bundle
  signing and export --verify.

Review notes

• The audit record schema change is additive; every existing reader uses .get(), so
  report.py and bench_model are unaffected.
• demo/out is regenerated. build_demo_out.py now curates actor/host/out_dir so no
  real machine identity or home directory lands in a committed, screenshotted fixture — that
  curation lives in the builder, deliberately not in runmeta, which the audit trail
  depends on being honest.
• Screenshots were captured against a credential-free .env: with XC creds loaded the hero
  band renders a deep link carrying the tenant hostname and namespace, which would otherwise
  ship in the image. docs/DEMO.md documents that for whoever regenerates them next.

Also in this PR

Four commits that predate this work and were already unmerged on the branch:
4c7aadb per-agent malicious_user + rate_limit via user_identification (A2–A4) ·
eea6c78 api_schema validates headers + query params · 0f506fb --finding threads a
probe id into service-policy apply/refine · 38eeebc data_guard reuses the attached WAF.
Happy to split them onto their own branch if you'd rather review them separately.

🤖 Generated with Claude Code