feat(review): structured audit event when --force-tier bypasses the classifier
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Quiet
- Tech stack
- typescript
- Domain
- cli, observability
Research direction
Start with the altimate review --force-tier=<tier> entry point and inspect the existing handling of the warning and signed verdict envelope. Read format.ts to understand the current forced-tier rendering. This is not ready to implement until product input selects the delivery surfaces and precedence; done means the selected structured audit event behavior and payload are specified.
Written by the indexing model from the issue text.
Description
Deferred from the v0.9.3 pre-release review.
Current behavior
altimate review --force-tier=<tier> writes a warning to stderr and stamps tierForced: true + tierClassified (the classifier's original decision) into the signed verdict envelope. format.ts also renders "forced (was )" in the PR-comment headline.
Gap
Pipelines that don't archive the full JSON envelope have no durable trail of the bypass. Stderr is easily lost to CI log rotation, and a compliance auditor months later cannot confirm whether a governance bypass occurred without the archived JSON.
Proposal
Emit a structured audit event when --force-tier is applied. Delivery-surface options to weigh:
- Webhook — configurable target, JSON payload including tier, classifier tier, actor, commit SHA, envelope signature.
- OTEL span — piggybacks on existing tracing, but only useful when a collector is running.
- Local append to
.altimate/audit.log— always-on, but relies on the runner preserving the file.
Requires product input on which surfaces to support and precedence.
Why deferred
Delivery-surface decision required before the code change makes sense; the in-envelope signal is already durable for consumers that archive envelopes.
- Dominant language
- TypeScript
- Stars
- 813
- Forks
- 134
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 67
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from AltimateAI/altimate-code
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
AltimateAI/altimate-code#1359 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
AltimateAI/altimate-code#1323 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
AltimateAI/altimate-code#1288 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
AltimateAI/altimate-code#1285 ·
-
privacy: Altimate Base consent dialog no longer discloses persistent per-installation identifier Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
AltimateAI/altimate-code#1284 ·
All issues in AltimateAI/altimate-code
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
bcgov/bc-wallet-mobile#4761 · 1 comment ·
-
external-issue to-triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
refactor
Difficulty 2/5 1-3 hours Newbie friendliness 84/100