docs(cpex-ocsf-audit): record Fred's changes-requested review on PR #84 in the in-tree plan

CHANGELOG.md

@@ -20,6 +20,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **Corrected two question citations in the WS4 #172 evidence-contract mapping.** `docs/cosai-ws4-ocsf-mapping/evidence-contract-ocsf-mapping.md` is linked from a CoSAI thread that now has named reviewers, and two of its citations did not survive a check against the issue text as filed. (1) The header claimed the document as the **Q14/Q15** deliverable, but WS4 #172 Q15 asks for the false-positive profile of normal agent behaviour and what cross-run correlation requires operationally — detection-side material the document explicitly defers in its own scope note. Header retitled to Q14 alone, and the scope note now says plainly that Q15 is out of scope and unclaimed, matching what the CHANGELOG entry for #493 already said. (2) The schema gap register cited **Q16** for cross-boundary causal binding; Q16 is reachability minimisation versus patch hygiene (§9). The resource owner's record naming the causing tool call is the evidence complement of §5 (Q9–Q10), where a permitted party acts on the agent's behalf — re-cited accordingly. No mapping row, status, or OCSF claim changes. Docs only — no product impact.
 
 ### Changed
+- **The in-tree port plan records Fred's changes-requested review on PR #84 and what it means for the sink.** Five findings on 2026-09-09; two touch the seam this crate consumes. Audit records are emitted before `apply_assertions` and route-resolution denials emit nothing, so a sink can record allow for a request the caller saw denied; the fix, one emit after routing and assertions, is the order AID-EMIT-1 already assumes and changes nothing in this crate. Sinks receive the unfiltered `Extensions`, transport and effect slot included; this crate reads only the typed fields, so a filtered view costs nothing unless it lands as a new type, in which case the `ppe` build follows the new `handle` signature. The other three (effect-log recovery on a torn final line, reconciliation results not reaching sinks, the delegator's idempotency key) sit behind `on_effect`, which this crate does not implement. `PRAXIS-INTREE-PLAN.md` carries the note under the gates: Teryl's next push moves the head, so re-pin and re-run the bar before gate 3 is called met. Docs only, no product impact.
 - **The OCSF audit plugin tracks PR #84 at `499ee91` and holds `base64` at 0.22 to match the PPE tree.** Teryl answered the two dependency findings on praxis-proxy/policy PR #84 on 2026-09-09: `sha2` is now a workspace dependency at `0.11` (`ef20d8f`), and `base64` stays at `0.22` across the tree because `jsonwebtoken` 11, which `identity-jwt` depends on, requires it, so `0.23` would put two majors in the build (verified against the PPE lock). The same head merges the #82 docs reorganisation, which moves the auditing guide to `docs/content/auditing.md`; nothing on the seam this crate consumes changed between `3e7734e` and `499ee91`. `integrations/cpex-ocsf-audit` moves its pin to that head and its `base64` requirement from `0.23` (a Renovate bump, #497) down to `0.22`, so the copy that lands under `reference/plugins/ocsf-audit` (`PRAXIS-INTREE-PLAN.md`) is a copy and the PPE build stays on one base64; a Renovate rule holds it there. Verified the way CI runs it, on toolchain 1.96.1 with a cpex sibling at `64c8eba`: warning-free `--locked` builds and 34 tests green on each host, `emit_sample` and `decision_sink_demo` byte-identical to the committed vectors, so the AID-EMIT-1 section 12 conformance vector is untouched. The in-tree plan drops `sha2` and `base64` from its list of workspace-table adds (only `p256` remains), records the `base64` answer as settled, and follows the auditing guide to its new path. He also repeated that the `plugin_settings:` load error predates #84 (praxis-proxy/policy #55), which `PRAXIS-PORT-RESULTS.md` observation 3 already records.
 
 ### Added

integrations/cpex-ocsf-audit/PRAXIS-INTREE-PLAN.md

@@ -31,6 +31,29 @@ Settled with Teryl on Slack, 2026-09-08, after he talked to Fred:
    green and `emit_sample` byte-identical. That is the baseline the in-tree
    copy is measured against.
 
+**Status 2026-09-09.** Fred requested changes on #84 with five findings.
+Two touch the sink seam this crate consumes; three are inside the effect
+log and the delegator, which the crate does not observe (`on_effect` is
+the default no-op).
+
+- *Emit once after routing and assertions.* Today `emit_audit` runs inside
+  `execute` and `apply_assertions` runs on its result (`engine.rs`), so a
+  sink can record allow for a request an assertion then denies, and a
+  route-resolution failure returns a denial with no record at all. The
+  fix is the order AID-EMIT-1 assumes, the record is the verdict the
+  caller got; it changes nothing in this crate. Route denials gaining a
+  record adds records to the decision stream and keeps it dense.
+- *Sinks get a filtered view of `Extensions`.* `emit_audit` and the effect
+  sink pass the unfiltered extensions, transport and effect slot included.
+  This crate reads only the typed fields (`request`, `mcp`, `security`,
+  `agent`, `completion`, `delegation`), so a filtered view costs nothing,
+  unless the view arrives as a new type rather than `&Extensions` with the
+  slots detached, in which case `AuditHandler::handle` changes shape and
+  the `ppe` build of this crate follows it.
+
+Either way, Teryl's next push moves the head: re-pin, re-run the bar, and
+re-read the sink signature before gate 3 is called met.
+
 ## PPE rules the copy must satisfy
 
 Read from `praxis-proxy/policy` at `3e7734e`, dependencies re-read at