Last verified: 28 September 2026

Audit Log Disclosure

Every audit event type we record and how long we retain it, auto-projected from the canonical registry. The append-only hash chain ensures no prior record can be silently mutated.

Hash-chain invariant

Every row in the audit log carries entry_hash = SHA-256(prev_hash ∥ canonical_row_jcs) computed inside the audit_record() SECURITY DEFINER function. A single-row mutation breaks the chain from that point forward. verifyAuditChainSegment() recomputes the chain; attestAuditChainIntegrity() substrate-attests the verification result (requires compliance-operator capability).

Restoration via restoreAuditChainFromBackup() NEVER mutates prior segments. It appends a new audit_chain_segments row whose prior_segment_terminal_hash links to the superseded segment. Restoration requires 2-of-2 attestation from distinct custody-operator and resolution-operator principals (§ZA-ii, G4).

Retention classes

Generated from lib/registry/audit-retention-classes-registry.ts · 4 closed classes (§ZA-iii, G5 — adding a 5th class requires a §Z amendment)

Per-jurisdictional compliance frameworks (§GG) may raise retention above the baseline via ComplianceFramework.auditRetentionMinDays. Frameworks set minimums, never reduce. expires_at = max(class baseline, jurisdictional floor) is computed at insert time inside audit_record().

`short` — Short (90 days)

Ephemeral operational events (auth flows, session events). Regulatory floor rarely exceeds 90 days for this class; GDPR Article 30 does not mandate retention for purely transient system events.

retention: 90 days · since: ZA-iii

`medium` — Medium (1 year)

Standard operational audit trail (identity changes, commerce lifecycle, integrity checks). Matches common EU/UK GDPR data-minimisation guidance for business-process audit records.

retention: 365 days · since: ZA-iii

`long` — Long (7 years)

Governance and regulatory events (organisation creation, stewardship grants, data subject requests, substrate-operator attestations). Matches EU VAT directive + DORA + NIS2 minimum retention floors for business-critical records. 2555 days = 7 × 365 days (leap-year rounding per telemetry-pattern).

retention: 2555 days · since: ZA-iii

`permanent` — Permanent (never expires)

Chain-structural events that must never be deleted: audit chain restoration anchors and partition-archival attestations. Sentinel value -1 maps to expires_at = NULL in audit_log. These rows outlive any partition-drop cycle.

retention: never expires (permanent) · since: ZA-iii

Personal data in audit payloads

Every audit event type declares a PII posture from the closed set none / anonymized / personal-retained. Kinds marked personal-retained deliberately keep direct personal data (raw email address, client IP) in the audit payload for forensic traceability — an explicit owner decision (OWNER-6). Every personal-retained kind is bound to a non-permanent retention class, so the personal data expires with the row; access is gated by row-level security (auth-tier rows are readable only by the service tier and substrate operators; org-scoped rows only by members of the owning org).

8 event type(s) currently declare personal-retained; 1 declare anonymized. The per-kind posture is listed with each event type below.

Audit event types

Generated from lib/registry/audit-event-types-registry.ts · 164 registered event types

Every event type written to audit_log.event_type is registered below with its retention class. guard:audit-event-retention-class-declared (BLOCKING-from-day-one) enforces no unregistered event type can be introduced without declaring a retention class from the closed 4-value enum (§ZA-iii, G5).

`auth.login`

User authenticated successfully (post-callback). V1-SEC-007 / OWNER-6: login audit payloads deliberately retain the raw email (federated-routing branch) and client IP for forensic traceability — bounded at the short (90-day) retention class; rows are auth-tier (org_id NULL) so they are readable only by the service tier and substrate operators.

retention: short (90 days) · PII posture: personal-retained · subject: auth_credential · source: system

`auth.callback`

Auth callback completed (token exchange).

retention: short (90 days) · PII posture: none · subject: auth_credential · source: system

`auth.password_changed`

Password changed by the signed-in account. Payload carries the account id only — never the password, and never the email address.

retention: short (90 days) · PII posture: none · subject: auth_credential · source: system

`auth.password_reset_requested`

Password reset email requested for an account. Payload carries the email DOMAIN only (never the raw address) — anonymized posture per V1-SEC-007.

retention: short (90 days) · PII posture: anonymized · subject: auth_credential · source: system

`auth.password_reset_completed`

Password reset completed (new password set).

retention: short (90 days) · PII posture: none · subject: auth_credential · source: system

`auth.second_factor_succeeded`

Sign-in second factor accepted. Payload is the proof kind and the sign-in method only.

retention: short (90 days) · PII posture: none · subject: auth_credential · source: system

`auth.second_factor_failed`

Sign-in second factor rejected. Payload is the proof kind and the sign-in method only.

retention: short (90 days) · PII posture: none · subject: auth_credential · source: system

`auth.second_factor_locked`

Sign-in second factor locked after repeated failures. Payload is the proof kind and the sign-in method only.

retention: short (90 days) · PII posture: none · subject: auth_credential · source: system

`identity.participant_promoted`

Participant tier promoted (e.g., guest → member).

retention: medium (365 days) · PII posture: none · subject: participant · source: system

`identity.invitation_created`

Org invitation created. V1-SEC-007 / OWNER-6: payload deliberately retains the invitee's raw email for forensic traceability of who was invited into an org — bounded at the medium (1-year) retention class; rows are org-scoped so RLS limits reads to members of the inviting org.

retention: medium (365 days) · PII posture: personal-retained · subject: invitation · source: system

`identity.invitation_accepted`

Org invitation accepted.

retention: medium (365 days) · PII posture: none · subject: invitation · source: system

`identity.invitation_declined`

Org invitation declined by the invited participant (V066).

retention: medium (365 days) · PII posture: none · subject: invitation · source: system

`person_addresses.address_added`

Participant added a contact email address.

retention: medium (365 days) · PII posture: none · subject: person_email_address · source: person_addresses_service

`person_addresses.address_verified`

Participant verified a contact email address.

retention: medium (365 days) · PII posture: none · subject: person_email_address · source: person_addresses_service

`person_addresses.address_removed`

Participant removed a contact email address.

retention: medium (365 days) · PII posture: none · subject: person_email_address · source: person_addresses_service

`person_addresses.member_address_updated`

Participant changed the address an organisation uses.

retention: medium (365 days) · PII posture: none · subject: person_email_address · source: person_addresses_service

`identity.invitation_revoked`

Org invitation revoked.

retention: medium (365 days) · PII posture: none · subject: invitation · source: system

`identity.pin_lockout_cleared`

PIN lockout state cleared for the caller's pin_credentials row.

retention: short (90 days) · PII posture: none · subject: pin_credential · source: runtime_pin_lockout_cleared

`identity.pin_failure_recorded`

PIN failure recorded; lockout may have been (re)engaged.

retention: short (90 days) · PII posture: none · subject: pin_credential · source: runtime_pin_failure_recorded

`org.created`

Organization created.

retention: long (2555 days) · PII posture: none · subject: org · source: system

`expression.primitive.checked`

assertPrimitiveAllowed() outcome recorded — primitive create-path policy enforcement. E.sub4: payload includes manifestMaturity (aggregate) + dimensionMaturity (per-dimension) so audit consumers can reconstruct the tightening trajectory of any expression over time.

retention: long (2555 days) · PII posture: none · subject: expression · source: legacy_v283_expression_primitive_audit

`expression.manifest.tightened`

Manifest version published with one or more primitive dimensions narrowed from wildcard to finite, or finite list shortened. Payload carries (prevDimensions, newDimensions, proposingParticipantId, approvingParticipantIds[], changeRule) for audit-trail reconstruction of tightening trajectory.

retention: long (2555 days) · PII posture: none · subject: expression · source: system

`expression.manifest.published`

Manifest version published (any change). Complements the substrate-level expressions.version.published with steward-attestation payload (proposingParticipantId, changeRule). G.sub3.

retention: long (2555 days) · PII posture: none · subject: expression · source: system

`expression.manifest.rejected`

Manifest publish attempt rejected. Payload carries (reason, proposingParticipantId, changeRule) where reason ∈ steward_not_in_allowlist | maturity_gate_failed | version_bump_mismatch | manifest_invalid. G.sub3.

retention: long (2555 days) · PII posture: none · subject: expression · source: system

`governance.steward.granted`

New steward row inserted into expression_stewards (or revoked row re-activated). Carries (stewardId, changeRule, participantId, role, grantedByParticipantId, grantedAt). G.sub6.

retention: long (2555 days) · PII posture: none · subject: expression · source: system

`governance.steward.revoked`

Steward row revoked (revoked_at set on expression_stewards). Carries (stewardId, changeRule, participantId, role, revokedByParticipantId, revokedAt). G.sub6.

retention: long (2555 days) · PII posture: none · subject: expression · source: system

`commons.stewardship.action`

Commons stewardship action recorded (rotation, audit, etc.).

retention: medium (365 days) · PII posture: none · subject: commons · source: legacy_v261_commons_stewardship_log

`integrity.snapshot`

Integrity snapshot generated for a participant or org.

retention: medium (365 days) · PII posture: none · subject: attestation · source: system

`integrity.attest`

Attestation issued.

retention: medium (365 days) · PII posture: none · subject: attestation · source: system

`integrity.verify`

Integrity verification request processed.

retention: medium (365 days) · PII posture: none · subject: attestation · source: system

`integrity.meter`

Integrity metering update.

retention: medium (365 days) · PII posture: none · subject: attestation · source: system

`data_request.submitted`

Data subject access / deletion request submitted.

retention: long (2555 days) · PII posture: none · subject: data_request · source: system

`p.audit_log.kernel_created`

V375 self-test seed event recorded by Phase 6 of the kernel migration.

retention: short (90 days) · PII posture: none · subject: audit_log · source: system

`commerce.entitlement.revoked`

Entitlement grant revoked (manual revocation or order-cancel cascade).

retention: medium (365 days) · PII posture: none · subject: entitlement_grant · source: runtime_commerce_entitlements

`commerce.order.cancelled`

Order cancelled — grants revoked, stock variants restored.

retention: medium (365 days) · PII posture: none · subject: order · source: runtime_commerce_order_lifecycle

`commerce.order.created`

Order created in the commerce module.

retention: medium (365 days) · PII posture: none · subject: order · source: runtime_commerce_order_lifecycle

`commerce.org_relationship.requested`

Org-to-org commerce relationship requested (e.g. supplier/customer pair).

retention: medium (365 days) · PII posture: none · subject: org_relationship · source: runtime_commerce_org_relationships

`org_relationship.requested`

B2B org-to-org relationship requested (kernel/org-relationships service).

retention: medium (365 days) · PII posture: none · subject: org_relationship · source: runtime_kernel_org_relationships

`org_relationship.approved`

B2B org-to-org relationship approved (status pending→active).

retention: medium (365 days) · PII posture: none · subject: org_relationship · source: runtime_kernel_org_relationships

`org_relationship.rejected`

B2B org-to-org relationship rejected (status pending→terminated).

retention: medium (365 days) · PII posture: none · subject: org_relationship · source: runtime_kernel_org_relationships

`org_relationship.suspended`

B2B org-to-org relationship suspended (status active→suspended).

retention: medium (365 days) · PII posture: none · subject: org_relationship · source: runtime_kernel_org_relationships

`org_relationship.terminated`

B2B org-to-org relationship terminated (status active/suspended→terminated).

retention: medium (365 days) · PII posture: none · subject: org_relationship · source: runtime_kernel_org_relationships

`procurement.requisition.status_changed`

Procurement requisition status transition (create/approve/patch/convert-to-PO).

retention: medium (365 days) · PII posture: none · subject: procurement_requisition · source: runtime_procurement_requisition_lifecycle

`procurement.po.status_changed`

Procurement purchase-order status transition (create/patch/receiving-reconcile).

retention: medium (365 days) · PII posture: none · subject: procurement_purchase_order · source: runtime_procurement_po_lifecycle

`procurement.receiving.recorded`

Procurement goods-receiving recorded for a PO line item (terminal status).

retention: medium (365 days) · PII posture: none · subject: procurement_receiving · source: runtime_procurement_receiving_lifecycle

`procurement.approval.status_changed`

Procurement product-approval status transition (submit/approve/decline/etc.).

retention: medium (365 days) · PII posture: none · subject: procurement_product_approval · source: runtime_procurement_approval_lifecycle

`procurement.portal_token.minted`

Portal access token minted (vendor/customer/partner). Records metadata only — never the raw token or its hash. V1-SEC-007 / OWNER-6: payload deliberately retains the grantee's raw email for forensic traceability of external portal grants — bounded at the medium (1-year) retention class; rows are org-scoped so RLS limits reads to the issuing org's members.

retention: medium (365 days) · PII posture: personal-retained · subject: portal_access_token · source: runtime_portal_token_mint

`commerce.quote.accepted`

Quote accepted by recipient — quote lifecycle event.

retention: medium (365 days) · PII posture: none · subject: quote · source: runtime_commerce_quote_lifecycle

`commerce.quote.created`

Quote created in the commerce module.

retention: medium (365 days) · PII posture: none · subject: quote · source: runtime_commerce_quote_lifecycle

`commerce.quote.declined`

Quote declined by recipient — quote lifecycle event.

retention: medium (365 days) · PII posture: none · subject: quote · source: runtime_commerce_quote_lifecycle

`commerce.quote.sent`

Quote sent to recipient — quote lifecycle event.

retention: medium (365 days) · PII posture: none · subject: quote · source: runtime_commerce_quote_lifecycle

`communications.conversation.member_added`

A participant was added to a conversation (replaces V001 phase7_add_conversation_member).

retention: medium (365 days) · PII posture: none · subject: conversation · source: runtime_communications_conversation_membership

`communications.message.read`

A conversation message delivery was marked read by its recipient (replaces V001 phase7_mark_message_read).

retention: short (90 days) · PII posture: none · subject: message · source: runtime_communications_message_read

`communications.reminder.triggered`

A due reminder fired and fanned out notifications to its recipient(s) (replaces V001 process_due_reminders → due-reminders background worker).

retention: short (90 days) · PII posture: none · subject: reminder · source: runtime_communications_reminder_sweep

`communications.notification.enqueued`

A notification's per-channel delivery rows were materialised (in_app/email; pending or skipped-by-preference). Replaces the V001 phase7_notifications_after_insert trigger dispatch.

retention: short (90 days) · PII posture: none · subject: notification · source: runtime_communications_notification_dispatch

`communications.notification.sent`

A notification delivery was sent successfully (replaces V001 process_notification_deliveries → notification-delivery background worker).

retention: short (90 days) · PII posture: none · subject: notification_delivery · source: runtime_communications_notification_delivery

`communications.notification.failed`

A notification delivery failed (deterministic forced-fail / retry back-off; replaces V001 process_notification_deliveries failure branch).

retention: medium (365 days) · PII posture: none · subject: notification_delivery · source: runtime_communications_notification_delivery

`communications.message.sent`

A conversation message was sent + fanned out to its recipients (replaces the V001 phase7_messages_after_insert trigger's message_sent audit).

retention: short (90 days) · PII posture: none · subject: message · source: runtime_communications_message_send

`communications.message.delivered`

A conversation message's delivery fan-out completed (replaces the V001 phase7_messages_after_insert trigger's message_delivered audit).

retention: short (90 days) · PII posture: none · subject: message · source: runtime_communications_message_send

`substrate_operator.attestation.backed`

Universal substrate-operator attestation event — written by emitAttestationBacked() for all substrate-operator ceremonies (audit export bundle issued, chain restored, chain integrity attested, partition archived, etc.). Action-specific detail in payload.action.

retention: long (2555 days) · PII posture: none · subject: substrate_operator_attestation · source: system

`audit.chain.restored`

Audit chain restoration anchor event — written as the first row of the new segment opened by restoreAuditChainFromBackup(). Carries priorSegmentId + priorSegmentTerminalHash for continuity attestation. Phase 3d-ii §ZA-ii.

retention: permanent (permanent) · PII posture: none · subject: audit_chain_segment · source: system

`audit.chain.integrity_verified`

Audit chain integrity verification attestation — written by attestAuditChainIntegrity() via emitAttestationBacked() ceremony. Payload carries segmentId + outcome + optional failReason. Phase 3d-ii §ZA-ii.

retention: medium (365 days) · PII posture: none · subject: audit_chain_segment · source: system

`audit.export_bundle.issued`

Audit export bundle issued — written by exportAuditBundle() via emitAttestationBacked() ceremony. Payload carries bundleId + timeRange + jurisdiction + rowCount. Phase 3d-i §ZA.

retention: long (2555 days) · PII posture: none · subject: audit_export_bundle · source: system

`audit.partition.archived`

Audit log partition archived — emitted by archiveExpiredPartitions() after dropping a partition where all rows have expires_at < NOW(). Payload carries partitionName + rowCount + partitionStart + partitionEnd. Phase 3d-iii §ZA-iii. Retention class: permanent (the archival event itself must never expire).

retention: permanent (permanent) · PII posture: none · subject: audit_log_partition · source: system

`backup.bundle.issued`

Backup bundle issued — emitted by issueBackupBundle() after a substrate-attested backup bundle row is inserted and the Ed25519 signature ceremony completes. Payload carries bundleId + orgId + environmentId + bundleKind + retentionClass + issuedAt. Phase 3e-i §ZB-i. Retention class: long (7 years) — backup attestations are sovereign-critical governance records.

retention: long (2555 days) · PII posture: none · subject: backup_bundle · source: system

`backup.bundle.verified`

Substrate-attested 2-of-2 verification ceremony for a backup bundle. Custody + resolution operators ratified the JCS+Ed25519 signature against the historic signing key. Read-only ceremony per Phase 3e ratification H4 — no mutation of backup_bundles.state. Payload carries bundleId + orgId + environmentId + verifiedAt + custodyActorParticipantId + resolutionActorParticipantId. Phase 3e-ii §ZB-ii.

retention: long (2555 days) · PII posture: none · subject: backup_bundle · source: system

`identity.subject.revoked`

Identity subject revoked via service-layer cascade (§ZD-β R4). Emitted ONCE after all dependent primitives (mandates, devices, service-account credentials) are cascaded. Payload carries subjectId + subjectSubtypeKey + revokedBy + revokedAt + reason + cascadeCounts (per-primitive revocation tallies). Retention class: long (7 years) — identity revocations are governance-significant records per §ZA-iii G5.

retention: long (2555 days) · PII posture: none · subject: identity_subject · source: runtime_identity_subject_revoked

`fork.handoff.issued`

Fork handoff manifest issued — emitted by issueForkHandoffCeremony() after a substrate-attested fork handoff row is inserted and the Ed25519 signing ceremony completes (F1/F2). Payload carries handoffId + orgId + environmentId + backupBundleId + issuerActorId + issuedAt. Phase 3f-i §ZC-i. Retention class: long (7 years) — fork handoff attestations are customer-portability sovereign-critical governance records.

retention: long (2555 days) · PII posture: none · subject: fork_handoff · source: system

`fork.handoff.ratified`

Substrate-attested 2-of-2 ratification ceremony for a fork handoff manifest. Custody + resolution operators co-signed the fork handoff (F2 / C-EE-PRE-7 distinct-actor enforcement). Payload carries handoffId + orgId + environmentId + issuerActorId + ratifierActorId + ratifiedAt. Phase 3f-i §ZC-i.

retention: long (2555 days) · PII posture: none · subject: fork_handoff · source: system

`fork.trust_anchor.admitted`

Donor trust-anchor keys admitted to recipient cluster — emitted by admitDonorTrustAnchorKeys() after donor signing keys are inserted into cluster_signing_keys with provenance='fork-imported-trust-anchor' + status='retired' (F3). Payload carries admittedKidCount + kids + admitterActorId + admittedAt. Phase 3f-i §ZC-i. Domain: identity-coordination (donor key bootstrap on recipient).

retention: long (2555 days) · PII posture: none · subject: cluster_signing_keys · source: system

`agents.ai_agent.provisioned`

Substrate-canonical AI agent provisioning ceremony completed (§ZD-δ-2 R5 closure). Emitted by agentsService.provisionAiAgent() after all 3 cascade steps complete: (1) identity subject created (subtype_key='ai_agent', coordination-tier per T.sub9 + SS-8), (2) agent row instantiated with identitySubjectParticipantId FK bound, (3) memory store provisioned. Payload carries agentId + identitySubjectId + templateId + ownerOrgId + memoryStoreId + environmentId + provisionedAt. Rollback path: if step 2 fails, revokeIdentitySubject() undoes the orphaned subject and emits identity.subject.revoked before re-throwing. Retention class: medium (1 year) — agent provisioning lifecycle events are org-governance-significant but not jurisdiction-sovereign-critical.

retention: medium (365 days) · PII posture: none · subject: agent · source: runtime_agents_ai_agent_provisioned

`identity.vc_issuer_key.admitted`

External VC issuer trust anchor admitted via 2-of-2 substrate-operator ceremony — emitted by vcIssuerKeysService.admitIssuerKey() after emitAttestationBacked() 3-step ceremony + vc_issuer_keys INSERT. Payload carries issuerUri + issuerLabel + kid + admittedBy + cosignedBy + validUntil + reason + attestationRowId. §ZD-β Phase β-5 / T1.1 / R6. Retention class: long (7 years) — trust anchor admission decisions are governance-significant records per §ZA-iii G5.

retention: long (2555 days) · PII posture: none · subject: vc_issuer_key · source: runtime_vc_issuer_key_admitted

`identity.vc_issuer_key.revoked`

External VC issuer trust anchor revoked via 2-of-2 substrate-operator ceremony — emitted by vcIssuerKeysService.revokeIssuerKey() after emitAttestationBacked() 3-step ceremony + soft-revoke UPDATE. Payload carries issuerUri + kid + revokedBy + cosignedBy + reason + revokedAt + attestationRowId. §ZD-β Phase β-5 / T1.1 / R6. Retention class: long (7 years) — trust anchor revocation decisions are governance-significant records per §ZA-iii G5.

retention: long (2555 days) · PII posture: none · subject: vc_issuer_key · source: runtime_vc_issuer_key_revoked

`programs.phase_advanced`

A company-relationship advanced to a new program phase — emitted by programsService.advancePhase() after applyProgramPhaseAdvance() succeeds. Replaces the V001 advance_program_phase SECURITY DEFINER function. Payload carries programId + newPhase + unlockedLayers + unlockedSections. Retention class: medium (1 year) — program lifecycle progression records.

retention: medium (365 days) · PII posture: none · subject: program_company_relationship · source: runtime_programs_phase_advanced

`strategy.bmv.current_changed`

Business model version singleton-current invariant flipped — emitted by strategyBusinessVersionsService.recordBusinessModelVersionCurrentChanged() after the BMV repository atomically demoted sibling rows and flipped the target row's is_current=true. Replaces the V001 ensure_single_current_bmv trigger. Payload carries version_id + demoted_version_ids. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: business_model_version · source: runtime_strategy_bmv_current_changed

`strategy.bmv.default_changed`

Business model version singleton-default invariant flipped — emitted by strategyBusinessVersionsService.recordBusinessModelVersionDefaultChanged() after the BMV repository atomically demoted sibling rows and flipped the target row's is_default=true. Replaces the V001 ensure_single_default_bmv trigger. Payload carries version_id + demoted_version_ids. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: business_model_version · source: runtime_strategy_bmv_default_changed

`strategy.bpv.current_changed`

Business plan version singleton-current invariant flipped — emitted by strategyBusinessVersionsService.recordBusinessPlanVersionCurrentChanged() after the BPV write-path atomically demoted sibling rows and flipped the target row's is_current=true. Replaces the V001 unset_other_current_bpv trigger. Payload carries version_id + demoted_version_ids. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: business_plan_version · source: runtime_strategy_bpv_current_changed

`entitlements.org_type.changed`

Org-type change applied — emitted by entitlementsService.applyOrgTypeChange() after the substrate revoked the from-type's default entitlements and granted the to-type's defaults (and inserted the org_type_transitions audit row). Replaces the V001 auto_grant_org_type_entitlements trigger. Payload carries targetOrgId + fromType + toType + granted[] + revoked[] + environmentId. Retention class: long (7 years) — org-type lineage is governance-significant.

retention: long (2555 days) · PII posture: none · subject: org · source: runtime_entitlements_org_type_changed

`entitlements.org_type.retriggered`

Org-type entitlements re-applied across a type cohort — emitted by entitlementsService.retriggerOrgTypeEntitlements() after iterating every org of a given type and calling applyOrgTypeChange(fromType=toType). Replaces the V001 retrigger_org_type_entitlements SECURITY DEFINER. Payload carries typeKey + orgsAffected. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: org_type · source: runtime_entitlements_org_type_retriggered

`entitlements.plan.granted`

Plan entitlements granted — emitted by entitlementsService.grantPlanEntitlements() after iterating plan_entitlement_mappings and calling grant() per mapping. Replaces the V001 grant_plan_entitlements SECURITY DEFINER. Per-grant entitlements.grant.created events still fire; this carries the bulk summary. Payload: targetOrgId + planKey + stripePriceId + grantsApplied + environmentId. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: org · source: runtime_entitlements_plan_granted

`entitlements.plan.revoked`

Plan entitlements bulk-revoked — emitted by entitlementsService.revokePlanEntitlements() after the substrate bulk-UPDATE'd subscription-source grants for the org. Replaces the V001 revoke_plan_entitlements SECURITY DEFINER. Per-grant events are NOT emitted by the bulk path (V001 didn't either). Payload: targetOrgId + grantsRevoked + environmentId. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: org · source: runtime_entitlements_plan_revoked

`commerce.order.status_changed`

Order status transition recorded — emitted by commerceService.updateOrderStatus() after the substrate UPDATEd store_orders.status. Replaces the inline audit_events insert in V001 phase10_update_order_status SECURITY DEFINER. Payload carries order_id + order_number + old_status + new_status. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: order · source: runtime_commerce_order_lifecycle

`commerce.order.fulfillment_changed`

Order fulfillment-status transition recorded — emitted by commerceService.updateOrderFulfillment() after store_orders.fulfillment_status UPDATE. Mirrors the lifecycle-audit trigger's payload shape so downstream consumers see the same surface they would have seen via the V001 trigger. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: order · source: runtime_commerce_order_lifecycle

`commerce.quote.viewed`

Quote marked viewed by recipient — emitted by commerceService.markQuoteViewed() after store_quotes.status UPDATE to 'viewed'. Replaces the inline notification side-effect of V001 notify_quote_viewed (the audit row also moves to TS at v1). Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: quote · source: runtime_commerce_quote_lifecycle

`commerce.quote.expired`

Quote expired by valid_until cutoff — emitted by commerceService.markQuoteExpired() after store_quotes.status UPDATE to 'expired'. Replaces the inline notification side-effect of V001 notify_quote_expired. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: quote · source: runtime_commerce_quote_lifecycle

`commerce.quote.converted`

Quote converted to order — emitted by commerceService.convertQuoteToOrder() after the substrate inserted a store_orders row + line items + entitlement grants from the accepted quote. Replaces the V001 phase10_convert_quote_to_order SECURITY DEFINER inline audit_events insert. Payload carries quote_id + order_id + order_number + invoice_id + payload_sha256. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: quote · source: runtime_commerce_quote_lifecycle

`commerce.product.status_changed`

Product status transition recorded — emitted by commerceService.recordProductStatusChanged() after a products.update mutation flips products.status. Replaces the inline notification side-effect of V001 notify_product_status_changed trigger. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: product · source: runtime_commerce_product_lifecycle

`document.ai.generated`

AI-generated document body — emitted when an AI authoring action produces new content for a format='dox' org_content_artifact. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: content_artifact · source: runtime_document_ai_authoring

`document.ai.rewritten`

AI-rewritten document body — emitted when an AI authoring action rewrites existing content for a format='dox' org_content_artifact. Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: content_artifact · source: runtime_document_ai_authoring

`document.collab_session.started`

Collaborative editing session opened on a format='dox' org_content_artifact (pairs with federation document.collab.session topic + V007). Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: content_artifact · source: runtime_document_collab_session

`document.collab_session.ended`

Collaborative editing session closed on a format='dox' org_content_artifact (pairs with federation document.collab.session topic + V007). Retention class: medium (1 year).

retention: medium (365 days) · PII posture: none · subject: content_artifact · source: runtime_document_collab_session

`engineering_work.unit.created`

Control-plane engineering work unit opened (question/Q&A at Stage 3). Operator-plane; not a tenant work item. Retention class: medium (1 year).