Module audit 

Audit Module

HIPAA §164.312(b) audit metadata for every persisted event.

Every event in the store carries an AuditMetadata value documenting who caused the change, when it happened, from where, and why (causation). The EventStore::append implementation rejects events whose audit fails AuditMetadata::validate.

Lifecycle

1. An aggregate’s handle() returns Vec<Event> with Event::audit == AuditMetadata::pending(). Aggregates do not deal with audit data.
2. The CommandBus builds one AuditMetadata from the request-scoped CommandContext (with timestamp_utc_us = now) and stamps it on every event before calling append.
3. Every store implementation calls audit.validate()? at the top of its append method as a defense-in-depth assertion.

Why typed, not free-form JSON

Field names cannot drift; required fields cannot be silently null; an auditor’s SELECT WHERE actor_id = ? query is reliable across every event ever written.

Reserved actor identifiers

• "system" — internal jobs, seeders, migrations
• "anonymous" — unauthenticated requests (e.g. self-registration)
• "legacy-pre-hipaa" — backfill sentinel for events written before this module existed (see migration add_hipaa_audit)

Structs

AuditMetadata

Audit fields stamped on every persisted event.

Enums

AuditError

Validation errors for AuditMetadata.

Constants

ANONYMOUS_ACTOR

Sentinel actor_id for unauthenticated requests.

LEGACY_ACTOR

Sentinel actor_id for events written before HIPAA-1 landed.

SYSTEM_ACTOR

Sentinel actor_id for system-internal commands (seeders, cron, migrations).