modules/audit.mdEngineering, modules~1 min read

Module: audit

Part of the Travi AI Agent monolith (app/modules/audit/). Read 00-overview.md §3 (hard rules) before changing anything here.
Purpose The append-only ledger of everything: every PHI access, state transition, agent action, config publish, and export.
Owns (data) audit_event (monthly partitions, own schema, INSERT-only role)
Public surface audit.emit() facade; admin lineage-replay query API
Depends on none (everything depends on it)
Requirements owned SEC-003, DQS-001
Constraining ADRs ADR-018
Key references adr/ADR-018.md, reference/security.md

Rules that must never break

  1. Writers: every PHI-reading API call, every state transition, every agent tool call, every consent action, every export, one event each, with purpose and trace_id.
  2. Fields: actor_type/id, on_behalf_of, action, object_type/id, purpose, context (diff hash), ip, user_agent, trace_id, occurred_at.
  3. Immutability: INSERT-only DB role; partitions export nightly to S3 Object-Lock (compliance mode, 6 y); runtime roles are denied delete on the archive.
  4. The 5-minute drill (DQS-001): any instruction shown to a patient must be reproducible to its source span and gate trail in ≤5 minutes using admin tools, this is rehearsed, not aspirational.