audit: state that the log is volatile, and trim CLAUDE.md

[douglasmun]

Finishes the two items left open from the EDR/kprintf work: the audit-log persistence question, and the CLAUDE.md trim.

1. Audit log: decided to stay volatile, and now says so

The Check Point BTR Reforged write-up (root-level attacker blinds the EDR) raised the follow-up: would our audit log show it afterwards? It would not — reboot erases it — which makes persistence look like the fix. It isn't, for two reasons I verified rather than assumed:

The HMAC key is regenerated every boot. audit_init() (src/audit.c:81) draws it from the CSPRNG and stores it nowhere, so records persisted across a reboot cannot be authenticated afterwards. Persistence would ship a tamper-evident log whose tamper-evidence is void exactly across the boundary persistence exists to cross — and [OK] integrity verified would print either way, which is the status-surface lie class. Fixing it needs a key root cannot read, i.e. sealed storage. No TPM here.

The one persistence precedent has never persisted anything. entropy.c:442 targets /boot/entropy.seed via ramfs_open; nothing creates /boot, and ramfs is RAM. Confirmed from three live boot logs that every boot prints Cannot create seed file / Entropy will reset on next reboot. Copying that model reproduces the bug more quietly.

Neither is a small change, so the interim fix is to stop the volatility being a surprise:

• auditlog -s printed Total events logged, which reads as an all-time figure this counter structurally cannot report → Events logged (this boot), remaining labels re-aligned, plus an explicit Log is VOLATILE: held in RAM, cleared on reboot.
• auditlog --help now states the log is not written to disk.

doc/AUDIT_LOG_PERSISTENCE.md records the decision and the three things that would have to be true to revisit it.

Verification

Both surfaces driven live under QEMU rather than read off the diff:

=== Audit Log Statistics ===
Events logged (this boot): 3
Events in buffer:          3
...
Log is VOLATILE: held in RAM, cleared on reboot.

and the --help note renders. Full rebuild rc=0, zero diagnostics under -Werror.

2. CLAUDE.md: 426 → 378

The split rule is "constraints stay inline, history moves out", so this cuts narrative that doc/ already carries and leaves the rules alone. Mechanically verified nothing was lost — no rule heading, doc/ pointer, harness name or build flag present before is absent after (comm against the base on all four axes). Rule count went 21 → 23 because su and edit became their own bullets.

Also: added index rows for NETWORK_ISOLATION.md and NETDAEMON_DESIGN.md (cited by the rules but never listed); dropped the inline EDR grep/sed incantations, which are superseded by verify/edr-rejoin.sh and whose reproduction here invites a sixth hand-copy (all five earlier ones had defects that FAILed a correct kernel); noted verify/run-all.sh; and checked every harness filename it names exists — one was wrong.

Still above the ~150 target. Getting there means deleting rules rather than prose, and each is the residue of a real bug, so I stopped rather than buy the line count with content.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CEkhAhgTxbE5TgifyYf8v4