Audit Log

The audit log is the contract behind every other guarantee on the platform. Each row in `sys_audit_entries` carries the operator (`actor_id`), the underlying user when impersonating (`actual_user_id`), the action, target type and id, tenant, impersonation id, reason, IP, user agent, request id, sys session id, and an action-specific metadata blob. After 24 hours the row is sealed: a SHA-256 hash chain links each sealed row to its predecessor (`worm_sealed`, `worm_hash`, `prev_hash`, `seal_sequence`), and a mutation guard rejects any write to a sealed row with `409 audit_worm_sealed`.

The hourly `audit-worm-seal` cron is what advances the chain. Search supports actor, target, action, tenant, time range, and free-text reason with cursor pagination (timestamp DESC, then `_id` DESC, encoded as base64url JSON) so the UI can scroll through millions of rows without hitting an offset wall. Per-operator saved searches are isolated by owner.

Export streams sync for ≤100 000 rows; larger sets queue a `SysAuditExportJob`, persist the artefact through `AuditExportSink` (Azure Blob SAS in production, in-memory in dev/test), and return a 7-day signed URL. The impersonation sub-view aggregates rows by `impersonation_id` into distinct sessions with start/end/target/reason and read/write counts, and clicking drills into the audit list pre-filtered to that session. The daily `audit-integrity-check` cron walks the chain end to end, persists a `SysAuditIntegrityDigest`, and opens a SEV1 `SysIncident` if any link is broken; the dashboard surfaces the latest `latest_ok` digest so an on-call engineer can see at a glance that the chain is intact.

Manual integrity runs are gated on `sys_security` plus fresh-auth. SIEM export is per-tenant configurable via `SysSiemConfig` (Azure Monitor, Splunk, Datadog, or mock); the 15-minute `audit-siem-push` cron ships the delta since `last_pushed_at` through a pluggable transport, and a test endpoint pushes a probe payload through the configured sink to confirm the credentials work.