Audit Log

Every module records its activity here instead of scattering audit rows through its own database. Events are append-only, and each one’s SHA-256 hash covers both its own content and the previous event’s hash, so the log is a chain: rewriting, removing or reordering any past event breaks every hash after it. The chain head is recorded with each append, which also catches events deleted from the end — the edit a hash chain alone cannot see. GET /api/verify recomputes the whole chain and reports how it broke. Retention pruning re-anchors the chain rather than severing it.

Responsibilities

• Append-only events: actor, org, action, resource, before/after, metadata
• SHA-256 hash chain over content and predecessor
• Integrity verification that detects rewrites, deletions, reordering and truncation
• Idempotent recording, so a retried emit is not a second entry
• Retention pruning that re-anchors the chain instead of breaking it

API surface

• POST /api/events · GET /api/events
• GET /api/verify
• GET /api/export
• GET /api/health · GET /api/ready · GET /api/metrics

CONSUMED BY Every module that needs a defensible record of what happened. A Platform Service never depends on a Business Module.