This repository owns the live audit_log table, audit API route contributions, the @govoplan/audit-webui package, and the target boundary for future audit sink/export capability work.

Audit now also owns versioned evidence-bundle export. Authorized auditors can select a bounded tenant or system record set, attach module-owned external evidence references, and download a redacted artifact with canonical hashes and optional Ed25519 signatures. The govoplan-audit-verify command validates the bundle offline and reports unsupported, incomplete, unverifiable, and tampered evidence separately. See docs/EVIDENCE_BUNDLES.md for API permissions, signing configuration, module contribution rules, and verifier usage.

The WebUI package contributes the system-audit and tenant-audit admin sections through the shared admin.sections UI capability. The admin shell does not render audit panels unless this module is installed and enabled.

It also owns the audit command/event separation and production delivery foundation:

govoplan_audit.backend.commands defines an in-process command bus for requested work.
govoplan_audit.backend.outbox persists governed platform events in audit_outbox_events and dispatches pending rows with retry metadata.

See docs/AUDIT_TRACE_CONTEXT.md for the standard operational context fields used by admin, installer, and module lifecycle audit entries.

The administration surface archetypes, consequence classification, and verification contract are recorded in docs/INTERFACE_PATTERN_MIGRATION.md.