Audit Trail System (SEC-001)

[vybe]

Comprehensive audit logging for user/agent actions with full actor attribution. Append-only audit_log table, MCP tool call tracking, hash chain for tamper evidence.

Status: Docs complete, partial PE integration exists.

Spec: docs/requirements/AUDIT_TRAIL_ARCHITECTURE.md

[vybe]

Actualization (2026-03-30)

Current state: Labeled status-in-progress but no core audit trail infrastructure has been merged.

What exists today (partial):

• routers/audit.py exists (audit-related endpoints)
• Execution origin tracking columns in schedule_executions (source_user_id, source_agent_name, etc.)
• Vector log aggregation captures structured logs
• Process Engine has its own event audit trail
• Security events logged via structured logging

What's missing (the core of this issue):

• No dedicated audit_log table with append-only immutability
• No centralized audit service capturing all event categories
• No hash chain for tamper evidence
• No query API with filters and export (CSV/JSON)
• No MCP tool call audit integration

Spec: docs/requirements/AUDIT_TRAIL_ARCHITECTURE.md is complete.

Recommendation: Remove status-in-progress label — this is still status-ready (design complete, implementation not started). The spec and architecture doc are done; the implementation work remains.

[dolho]

Picking this up — scoping to Phase 1 only for this PR per the spec's phasing.

Phase 1 deliverables (docs/requirements/AUDIT_TRAIL_ARCHITECTURE.md § Implementation Plan):

• audit_log table with schema, indexes, and immutability triggers
• AuditService class
• db/audit.py database operations
• DatabaseManager wiring
• /api/audit router with basic query endpoints
• Unit tests

Phases 2–4 (backend integration, MCP integration, hash chain/export/retention) will land as follow-up PRs. This issue stays open until all phases ship; PR description will note partial scope.