Internal Audit

Hustle lifecycle records are an internal audit stream. They establish ownership, model identity, bounded terminal status, and restore evidence. They are not ordinary public Session events.

Audit event types

// package event
type HustleRunDescriptor struct {
	Definition hustle.DefinitionDescriptor
	RunID      hustle.RunID
	Runtime    ModelRuntime
}

type HustleStarted struct {
	Run HustleRunDescriptor
}
type HustleCompleted struct {
	Run      HustleRunDescriptor
	Duration time.Duration
	Usage    *content.Usage
}
type HustleFailed struct {
	Run        HustleRunDescriptor
	Duration   time.Duration
	Stage      hustle.Stage
	ReasonCode hustle.ReasonCode
	Usage      *content.Usage
}

The concrete events also carry the stamped event.Header. HustleStarted requires a zero Runtime, because model resolution has not happened. HustleCompleted requires a resolved runtime. HustleFailed may carry zero runtime only for failures before model resolution and must obey hustle.ReasonAllowed.

Proof: Hustle events and event validation.

Visibility and delivery

All three events have Visibility() == event.Internal, session scope, and an enduring lifecycle class. Ordinary event filters do not deliver them. A trusted audit consumer can correlate Run.RunID, descriptor policy revision, stage, reason, runtime, duration, and optional usage without receiving raw prompt, model endpoint, or provider response bytes.

%%{init: {"theme":"dark"}}%%
sequenceDiagram
    participant F as focused facility
    participant H as Hustle controller
    participant A as internal audit
    F->>H: supported invocation
    H->>A: HustleStarted, runtime zero
    H->>H: lane, model, inference, output validation
    H->>A: HustleCompleted or HustleFailed, exactly once
    H-->>F: finalizer outcome

Proof: audit publication and visibility tests.

Ownership ordering

HustleStarted is published before scheduler eligibility. Once it succeeds, the runtime owns a RunID and must publish one terminal lifecycle event even if queue admission, model resolution, inference, output validation, or finalization fails. Pre-ownership request rejection has no audit pair and does not invoke the finalizer.

Proof: ownership sequence and ownership tests.

Source and proof

• Event declarations
• Event validation rules
• Audit publisher
• Audit proof