docs(integrations): link CPEX audit Epic

CHANGELOG.md

@@ -18,6 +18,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **The OCSF audit plugin refuses `signing: dsse` with `chain: false` instead of emitting unsigned records.** The signature covers the chained record, so with the chain off the chain wrapper returned before the signer ever ran and a config that promised signatures produced none. `integrations/cpex-ocsf-audit` now fails construction for the pair with an error naming the fix, pinned by a new test. The second round adds `#[serde(deny_unknown_fields)]` on the config, since every field has a default and a misspelled `authority_uid` was silently dropped (a test pins the rejection), and the canonicalizer now writes object keys without cloning them (37 tests on each host, vectors byte-identical). Found by the first review round on praxis-proxy/policy #171; the same guard is staged for the in-tree copy in `praxis-port/review/0003-review-171.patch`, with the `read_subject` capability for `panic_drive` (PPE only) and a reworded key-ordering note in SAMPLE-OUTPUT.md, which this crate also takes. `praxis-port/review/0004-review-173.patch` carries the two accepted findings on the #166 spike document (praxis #173): a stream gap is loss evidence rather than a verification failure, and digests of low-entropy content are keyed where the host provides a key; `0005-review-173-tail.patch` answers the second round: a dense sequence from 0 shows no leading or interior gap but cannot show a trailing loss, so tail completeness needs a trusted terminal sequence or checkpoint from the host. (#591)
 
 ### Changed
+- **The integrations page and CPEX plugin README link the upstream OCSF audit Epic.** They identify praxis-proxy/policy Epic #12 as tracking the Praxis Policy Engine reference-plugin work, and keep the status clear: the PPE port is prepared as patches in this repository, not described as merged upstream. (#599)
 - **`capture-modes.md` is marked implemented, and records what the build decided where the spec was open.** Every item of section 10 is now built on the platform (AI-66). Section 7 records how redaction works:
   - an item's `redact_after` comes from the rule matching the row that carries its digest, so responses can be redacted on a different clock from requests;
   - an item whose rule cannot be evaluated is never redacted;

integrations/cpex-ocsf-audit/README.md

@@ -190,8 +190,10 @@ Honest inventory of what's solid vs. open:
   `framework`, monotonic labels, workload identity), and the mapped objects (`ai_agent`,
   `delegation`, `message_context`). See the test module in `src/emitter.rs` and the runnable
   `examples/emit_sample.rs` / `SAMPLE-OUTPUT.md`.
-- **Praxis in-tree port staged (2026-10-02):** [`praxis-port/`](praxis-port/README.md)
-  holds the crate adapted to praxis-proxy/policy as `reference/plugins/ocsf-audit`,
+- **Praxis in-tree port staged (2026-10-02; upstream work tracked in
+  [Epic #12](https://github.com/praxis-proxy/policy/issues/12)):**
+  [`praxis-port/`](praxis-port/README.md) holds the crate adapted to
+  praxis-proxy/policy as `reference/plugins/ocsf-audit`,
   built on the praxis-proxy/policy#84 merge commit and verified against every PPE gate
   (35 tests, the three vectors byte-identical), as two patches the maintainer applies
   and pushes himself. `PRAXIS-INTREE-PLAN.md` records where the result departs from

landing-page/src/app/integrations/page.tsx

@@ -123,6 +123,37 @@ export default function Integrations() {
         </div>
       </section>
 
+      {/* OCSF audit plugin */}
+      <section className="pb-20 px-6 md:px-12">
+        <div className="max-w-[900px] mx-auto">
+          <div className="rounded-xl border border-white/10 bg-white/[0.03] p-6 md:p-8">
+            <h2 className="text-2xl font-bold text-white mb-3">OCSF Audit Plugin</h2>
+            <p className="text-sm text-gray-400 leading-relaxed mb-5">
+              This repository includes a CPEX audit plugin that emits OCSF AI Operation events,
+              with optional hash-chain protection and DSSE signing. The Praxis Policy Engine
+              reference-plugin port is prepared as patches here, with upstream work tracked in{" "}
+              <a
+                href="https://github.com/praxis-proxy/policy/issues/12"
+                target="_blank"
+                rel="noopener noreferrer"
+                className="text-[rgb(166,218,255)] hover:underline"
+              >
+                PPE Epic #12
+              </a>
+              .
+            </p>
+            <a
+              href="https://github.com/Levaj2000/AI-Identity/tree/main/integrations/cpex-ocsf-audit"
+              target="_blank"
+              rel="noopener noreferrer"
+              className="text-sm text-[rgb(166,218,255)] hover:underline"
+            >
+              View plugin source
+            </a>
+          </div>
+        </div>
+      </section>
+
       {/* CTA */}
       <section className="pb-24 px-6 md:px-12">
         <div className="max-w-[800px] mx-auto">