Add audit and session log record types to proto

Implemented-By: Laguna S 2.1 (OpenCode)

crates/proto/src/audit.rs

@@ -0,0 +1,36 @@
+//! Audit log record types. One JSON object per line, hash-chained by the exact bytes of each line.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{CallId, DataClass, DenyReason, Hash32, SessionId, Timestamp};
+
+// JSON: {"outcome":"allowed","grant":"…"} ; the tag sits beside the fields; outcomes are snake_case
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "outcome", rename_all = "snake_case", deny_unknown_fields)]
+pub enum DecisionRecord {
+    Allowed {
+        grant: String,
+    },
+    Approved {
+        grant: String,
+        approver: String,
+        post: Option<String>,
+    },
+    Denied {
+        reason: DenyReason,
+        grant: Option<String>,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AuditRecord {
+    pub seq: u64,
+    pub time: Timestamp,
+    pub prev: Hash32,
+    pub session: SessionId,
+    pub call: CallId,
+    pub tool: String,
+    pub arguments: String,
+    pub session_taint: DataClass,
+    pub decision: DecisionRecord,
+}