[Levaj2000]

What

Stages the in-tree port of this crate into praxis-proxy/policy, per integrations/cpex-ocsf-audit/PRAXIS-INTREE-PLAN.md, as two patches under integrations/cpex-ocsf-audit/praxis-port/ with the pull request body and a hand-over README beside them. The maintainer applies and pushes them under his own identity, since praxis gates merges on a CLA; nothing in this PR posts to praxis.

• 0001-import.patch: verbatim copy of this crate at AI-Identity 395d64e into reference/plugins/ocsf-audit.
• 0002-adapt.patch: the adaptation to that tree: workspace member and workspace dependencies, the PPE lint set, edition 2024, file headers and the comment convention, a rewritten crate README, the three sample-output files with their output blocks kept byte for byte, a second sink block in docs/content/auditing.md, and the root README layout note.
• PRBODY.md: the praxis pull request description.
• README.md: the routing split and three paste-able blocks (apply, push and open the PR, and the history-preserving alternative from praxis's docs/dev/port-provenance.md).

PRAXIS-INTREE-PLAN.md moves to "prepared" and records where the result departs from the plan. The crate README gets a status bullet.

Verification

Built on praxis main at da22e0a (the praxis-proxy/policy#84 merge commit) with the pinned toolchain (1.96.0, nightly rustfmt):

Gate	Result
make lint (fmt check, clippy -D warnings, both feature sets)	clean
make test (both feature sets)	green; the crate's suite is 35 tests
make doc (both feature sets)	clean
cargo deny check	passes
cargo check --workspace --all-targets, with and without --all-features	clean
typos, markdownlint on added and touched files	clean (one pre-existing MD001 in auditing.md, untouched)
emit_sample, decision_sink_demo, provenance_demo	byte-identical to the committed vectors and to the PPE outputs recorded for the da22e0a pin
panic_drive	plugin_panic deny on gw-1:decision at stream_seq 0

Both landing shapes were dry-run on fresh checkouts of da22e0a and produce the same tree (6b682de4): the squash copy via git am -s of both patches, and the filter-repo import (28 commits, 16 files, tip tree identical to the import commit) merged with unrelated histories plus 0002 on top. In both, author, committer and sign-off are Jeff Leva <120221487+Levaj2000@users.noreply.github.com> and no Claude trailer is present.

Departures from the plan, recorded in the plan file

• base64 is 0.23: at da22e0a the builtins declare 0.23 directly and the lock already carries both majors.
• provenance_demo resolves its demo keys through the file secret backend: std::env::set_var is unsafe in edition 2024 and the workspace forbids unsafe. Same digests.
• ocsf::apply_decision drops its payload parameter (only the removed cpex path used it).
• tokio-util is gone; typos.toml gains an ignore for the W3C trace-context span id and cose.
• The provenance vector (feat(cpex-ocsf-audit): keyed content provenance vector (AID-EMIT-1 1.1.2) #586) postdates the plan and is carried: 35 tests, not 34.

No source change to this crate; nothing hashed moves.

🤖 Generated with Claude Code

https://claude.ai/code/session_019BKU46zuw1Yu8E8yBQj4DP

---

Generated by Claude Code