# GovOPlaN Audit

<!-- govoplan-repository-type:start -->
**Repository type:** module (platform).
<!-- govoplan-repository-type:end -->

`govoplan-audit` owns audit API route contributions and audit administration
WebUI sections during the GovOPlaN module split.

This repository owns the live `audit_log` table, audit API route
contributions, the `@govoplan/audit-webui` package, and the target boundary
for future audit sink/export capability work.

Audit now also owns versioned evidence-bundle export. Authorized auditors can
select a bounded tenant or system record set, attach module-owned external
evidence references, and download a redacted artifact with canonical hashes
and optional Ed25519 signatures. The `govoplan-audit-verify` command validates
the bundle offline and reports unsupported, incomplete, unverifiable, and
tampered evidence separately. See
[docs/EVIDENCE_BUNDLES.md](docs/EVIDENCE_BUNDLES.md) for API permissions,
signing configuration, module contribution rules, and verifier usage.

The WebUI package contributes the `system-audit` and `tenant-audit` admin
sections through the shared `admin.sections` UI capability. The admin shell
does not render audit panels unless this module is installed and enabled.

It also owns the audit command/event separation and production delivery
foundation:

- `govoplan_audit.backend.commands` defines an in-process command bus for
  requested work.
- `govoplan_audit.backend.outbox` persists governed platform events in
  `audit_outbox_events` and dispatches pending rows with retry metadata.

See [docs/AUDIT_TRACE_CONTEXT.md](docs/AUDIT_TRACE_CONTEXT.md) for the standard
operational context fields used by admin, installer, and module lifecycle audit
entries.

The administration surface archetypes, consequence classification, and
verification contract are recorded in
[docs/INTERFACE_PATTERN_MIGRATION.md](docs/INTERFACE_PATTERN_MIGRATION.md).