Add local decision log

internal/decision/engine.go

@@ -23,6 +23,12 @@ type Engine struct {
 	policy  *policy.Package
 	mu      sync.RWMutex
 	history map[string]api.DecisionEnvelope
+	log     DecisionRecorder
+}
+
+// DecisionRecorder persists decision envelopes.
+type DecisionRecorder interface {
+	Append(api.DecisionEnvelope) error
 }
 
 // ListAllowedRequest describes a deterministic list_allowed call.
@@ -69,6 +75,13 @@ func NewEngine(store *registry.Store, policyPackage *policy.Package) (*Engine, e
 	}, nil
 }
 
+// SetDecisionLog attaches a local decision recorder to the engine.
+func (e *Engine) SetDecisionLog(log DecisionRecorder) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.log = log
+}
+
 // Check evaluates one subject/action/resource request.
 func (e *Engine) Check(ctx context.Context, request api.CheckRequest) (api.DecisionEnvelope, error) {
 	normalized, facts := e.normalizeRequest(request)
@@ -79,7 +92,9 @@ func (e *Engine) Check(ctx context.Context, request api.CheckRequest) (api.Decis
 	}
 
 	decision := e.envelope(normalized, expectation, facts)
-	e.recordDecision(decision)
+	if err := e.recordDecision(decision); err != nil {
+		return api.DecisionEnvelope{}, err
+	}
 	return decision, nil
 }
 
@@ -286,10 +301,14 @@ func (e *Engine) envelope(request api.CheckRequest, expectation api.DecisionExpe
 	return envelope
 }
 
-func (e *Engine) recordDecision(decision api.DecisionEnvelope) {
+func (e *Engine) recordDecision(decision api.DecisionEnvelope) error {
 	e.mu.Lock()
 	defer e.mu.Unlock()
 	e.history[decision.ID] = decision
+	if e.log != nil {
+		return e.log.Append(decision)
+	}
+	return nil
 }
 
 func (e *Engine) caringDecisionMetadata(descriptor *api.CaringAccessDescriptor, findings []api.CaringConformanceFinding) *api.CaringDecisionMetadata {