[Epic] Audit Logging

[2witstudios]

Overview

Operationalize tamper-evident audit logging for enterprise compliance requirements.

Dependencies

• None - Can start immediately (P2 compliance work)

Tasks

• [Audit] Operationalize SecurityAuditService #535 - Operationalize tamper-evident SecurityAuditService across core request flows
• [Audit] Log rate-limit denials #536 - Log login rate-limit denials (429) as immutable security audit events
• [Audit] Admin read coverage #537 - Add immutable audit coverage for privileged admin reads and denials
• [Audit] Hash-chain GDPR fix #541 - Fix activity-log hash-chain integrity conflict with GDPR anonymization
• [Audit] Hash-chain concurrent write race — activity_logs can fork #542 - Serialize activity-log hash-chain writes and harden failure semantics
• [Audit] Verification alerting #544 - Route audit-chain verification failures to durable alerting

Acceptance Criteria

• SecurityAuditService wired to runtime flows
• All security-relevant events logged immutably
• Hash-chain integrity maintained with GDPR compliance
• Verification failures routed to alerting

Notes

P2 enterprise compliance. Can run in parallel with other Phase 1 work.