M4: VSLSEC (security/authz S5) + VSLLOG (audit sink S3)

[rafael5]

VSL/MSL M4 — the security (S5) + audit (S3) seams

Binds the security and audit seams in v-stdlib. Dual-engine GREEN 11/11
(vehu YDB + foia-t12 IRIS) over the driver stack; full v-stdlib suite 33/33,
no regression. m-stdlib untouched.

VSLSEC — the VistA authorization decision (authz-only)

Grounded by probing both live engines that no portable Kernel generic-hash
entry point exists ($$SHAHASH^XUSHSH absent on vehu/older-FOIA; classic
top-level ^XUSHSH returns a constant on both engines), so portable crypto
stays in STDCRYPTO and VSLSEC binds none (architecture §3.4).

• $$hasKey(key,duz) = ''$D(^XUSEC(key,duz)) — the security-key decision (a
  DENY is a normal 0, not an error).
• $$duz() = +$G(DUZ) — the ambient principal (the #200 IEN binding).
• $$user(duz) = #200 NAME via VSLFS reuse (v→v; no DBS re-bind).
• Loud ,U-VSL-SEC-ARG, on a malformed call (empty key).
• ^XUSEC is the documented Supported reference (no numeric DBIA) → notional
  @icr (a $D read, not a set/kill — no-direct-global rule satisfied).

VSLLOG — the first v→v composition (audit sink)

Reuses VSLFS (no FileMan DBS re-bind), composing a $$now^STDDATE() (v→m)
timestamped line filed as .01; $$read reads it back; a VSLFS
,U-VSL-FS-DIERR, is caught and re-raised as ,U-VSL-LOG-WRITE,. No @icr
(no direct L4 call — DIQ/DIE live in VSLFS; STDDATE is m-layer).

Lane A no-op

M4 needed no MSL seam change → m-stdlib untouched, no v0.10.0 tag, pin stays
v0.9.0.

Gates (all green)

check-icr 9 · check-citations 9 (new XU/krn_8_0_dg_security_keys_ug#key-lookup
verified vs gold) · check-namespaces 5 · check-seams 0 · check-msl-pin v0.9.0;
make check-fast clean.

Fixtures

Existing low-risk entries probed read-only: a real ^XUSEC(key,duz) pair, #200
IEN 1, and a #8989.51 ZZ throwaway audit record. No keys granted/revoked.

Deferred (non-gating)

Optional MailMan alert (SETUP^XQALERT/EN^XMB — a real side effect) and
context-option authz $$inContext via CRCONTXT^XWBSEC (ICR 4053; needs the
encrypted option name + sets context — too fragile for a safe read-only probe).

🤖 Generated with Claude Code