[alliscode]

Why

A provider key accepted by Hub's canonical parser could still be rejected while building a typed security audit when its opaque value resembled credential text, such as secret:workforce. Identity creation and provider revision operations could then roll back, and their terminal failure audit could fail for the same reason. This is a focused follow-up to #163.

What changes

Canonical provider keys now carry a branded type from parseProviderKey() into the audit layer. Typed identity audit events use a narrow provider-key encoder that preserves the exact key for correlation and retains the existing string, byte, entry, and context limits, while bypassing only the generic credential-value heuristic that is inappropriate for this already-validated field. Generic untyped audit context still rejects credential-shaped values, secret-bearing fields, bearer tokens, and private-key material.

Regression coverage exercises representative opaque and Unicode provider keys through the public audit boundary, identity creation and provider revision success, post-rollback failure audits, invalid keys, generic credential rejection, context limits, and raw-error leakage. This changes no provider-key acceptance rules, database schema or migrations, product behavior outside identity auditing, or UI.

[Copilot]

🟡 Changes recommended

The oversized fixture never exercises the final byte-limit check, and the new encoder lacks tests confirming rejection of credential-shaped values outside provider.

1 open issue

• Test byte limits after restoration and provider credential rejection · New

What changed in this PR

Preserves canonical provider keys in Hub’s identity audits so credential-shaped keys no longer cause identity or provider-revision transactions to roll back. This follows up on the identity transaction foundation in #163.

Changes:

• Carries a branded provider-key type from parsing into typed audit events.
• Adds provider-specific context encoding while retaining context limits and generic credential protections.
• Adds regression coverage for exact key preservation, successful transactions, and post-rollback failure audits.

File	Description
hub/​server/​utils/​parse-provider-key/​index.ts	Brands validated provider keys without changing acceptance rules.
hub/​server/​utils/​parse-provider-key/​index.test.ts	Covers a credential-shaped canonical key.
hub/​server/​repositories/​security-audits/​parse-security-audit-event/​types.ts	Defines parsed events with branded provider keys.
hub/​server/​repositories/​security-audits/​parse-security-audit-event/​index.ts	Returns the branded event type.
hub/​server/​repositories/​security-audits/​get-security-audit-data/​index.ts	Uses provider-specific encoding for identity audits.
hub/​server/​repositories/​security-audits/​create-security-audit/​index.test.ts	Checks exact key preservation through the public audit boundary.
hub/​server/​repositories/​security-audits/​create-security-audit-context/​index.ts	Adds bounded encoding for canonical provider keys.
hub/​server/​repositories/​security-audits/​create-security-audit-context/​index.test.ts	Covers credential rejection and context limits.
hub/​server/​domains/​identity/​validate-and-persist-provider-revision/​index.db.test.ts	Exercises provider-key preservation across selection and rollback audits.
hub/​server/​domains/​identity/​resolve-or-create-external-identity/​index.db.test.ts	Exercises credential-shaped keys in creation and rollback audits.

_{Review effort: Max (auto)}

[Copilot]

🔵 Needs a closer look

Exempting provider keys from the security audit's credential-value filter is a security-policy tradeoff that requires confirmation from a human owner.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Move provider-key context helper into its own function module

hub/​server/​repositories/​security-audits/​create-security-audit-context/​index.ts:26

This adds a second exported function to the module, contrary to hub/docs/coding-conventions.md:11. Move createSecurityAuditContextWithProviderKey and its tests into a dedicated function directory with a matching describe("createSecurityAuditContextWithProviderKey()") block, and update the audit mapper's import.

1 resolved since last review

• Test byte limits after restoration and provider credential rejection

_{Review effort: Max (auto)}