Ledger

WEB-030

DB audit: append-only hash-chained audit_log, row trigger with reason + redaction, verify_audit_chain, log_action RPC + pgTAP

← Ledger

donestatus · web-db

1✓ tests passed / failed

2.32Mtokens · 2 min

0evidence files

Evidence

From logs/evidence/WEB-030/. Click a thumbnail for the full image.

No evidence files in logs/evidence/WEB-030/.

Tests

pass pgTAP surface + RBAC + audit (append-only, chain, tamper detect, reason, redact, RLS) · 24.4 s · raw log$ node packages/db/scripts/sb.mjs db reset && pnpm db:test

Notes

2026-10-04 14:09 UTC · Migration 20261004140200_admin_audit: audit_log (actor types incl. claude_local/claude_cloud/site), BEFORE INSERT chain trigger (advisory lock; sha256 over prev hash + epoch-µs + fields — timezone-independent), immutability triggers (update/delete/truncate), private.audit_row(trigger args reason_required, redact:<col>; reason from zoen.reason GUC or x-zoen-reason header), admin.log_action, admin.verify_audit_chain (audit.read), staff/staff_roles audited. pgTAP 030_audit 10 checks incl. tamper detection.