stzSecurityEvent

(no comment in the source: the name reads as a sentence) initno extension

readsno extension

(no comment in the source: the name reads as a sentence) severityno extension

(no comment in the source: the name reads as a sentence) techniqueno extension

(no comment in the source: the name reads as a sentence) meaningno extension

(no comment in the source: the name reads as a sentence) actorno extension

(no comment in the source: the name reads as a sentence) postureno extension

(no comment in the source: the name reads as a sentence) actor kindsno extension

(no comment in the source: the name reads as a sentence) actionno extension

(no comment in the source: the name reads as a sentence) riskno extension

(no comment in the source: the name reads as a sentence) subjectno extension

(no comment in the source: the name reads as a sentence) originno extension

(no comment in the source: the name reads as a sentence) outcomeno extension

(no comment in the source: the name reads as a sentence) reasonno extension

(no comment in the source: the name reads as a sentence) at wallno extension

(no comment in the source: the name reads as a sentence) at monono extension

(no comment in the source: the name reads as a sentence) trace idno extension

"granted" and "observed" are not refusals; "refused" and "failed" are. Written as an explicit list rather than `!= "granted"` because a fourth outcome arrived later (see Observed) and the negative form would have silently swept it in -- an expired session would have counted as a refusal in every pivot.no extension

building (fluent; every setter returns This) --------------- WHO: an stzSystemActor contributes its own facts -- name, posture, capability kinds. Nothing is invented here.no extension

For a caller with no actor object yet (an unauthenticated request, a username at the login door).no extension

WHICH thing. THE REDACTION LAW lives here: an object contributes its DESCRIPTOR (stzSecret.Descriptor() is the redacted form), never its value -- this class never calls Reveal(). A string is taken as already-safe; callers pass descriptors like "user:admin", "key:billing", "route:/pay".no extension

(no comment in the source: the name reads as a sentence) doingno extension

(no comment in the source: the name reads as a sentence) at riskno extension

(no comment in the source: the name reads as a sentence) from originno extension

The deterministic form (the house "...At(now)" convention): an event that did not happen NOW carries its own wall clock -- a replayed or imported record, or a guard that needs exact window arithmetic instead of machine speed. The monotonic stamp is left alone: it orders THIS process's events and cannot be borrowed.no extension

outcomesno extension

(no comment in the source: the name reads as a sentence) refusedno extension

The gate admitted it and the act still did not complete.no extension

NOT A VERDICT -- something simply happened (incident I2's session seams). A session reaching its expiry was neither granted nor refused: no gate ran, nobody was told no. Forcing such a fact into "refused" would have made every pivot that counts refusals over-count, and would have taught an investigator that routine housekeeping was an attack. The ledger's job is to witness, and some of what it witnesses carries no judgment at all.no extension

severity (the catalog's default, overridable)no extension

(no comment in the source: the name reads as a sentence) as warningno extension

(no comment in the source: the name reads as a sentence) as errorno extension

the native recordno extension

The separator is reserved: a field's own pipes fold to "/" so the ledger can split the line back into fields without a field's content (a reason quoting a message, say) shifting every field after it. Sanitizing at the source beats parsing bravely later.no extension

interop: OCSF (the SIEM schema) ---------------------------- OCSF severity_id: 1 Informational, 3 Medium, 4 High.no extension

OCSF status_id: 1 Success, 2 Failure.no extension

Best-effort class mapping, honestly bounded: auth/sso/oauth are Identity & Access Management (category 3, class 3002 Authentication); http.* is Network Activity (4 / 4002 HTTP Activity); everything else is Application Activity (6 / 6003 API Activity). Facts that do not map cleanly ride in "unmapped", which is what that OCSF field is for.no extension

(no comment in the source: the name reads as a sentence) ocsf category uidno extension

(no comment in the source: the name reads as a sentence) to ocsf jsonno extension

legibility ------------------------------------------------- One line, human first: who did what to which, how it ended, why.no extension

(no comment in the source: the name reads as a sentence) explainno extension

(no comment in the source: the name reads as a sentence) showno extension