minco-plugin-audit

Append-only audit events for security-relevant and business-relevant actions. The port keeps operational logs separate from durable audit history.

The legacy AuditEvent and AuditSink remain available. The additive V2 contract adds bounded semantic records, idempotent batch append, cursor-based resource history, explicit related-resource gathering, size/rotation/retention policy and inspectable storage health.

Permanent history belongs in a physically separate ledger. PostgreSQL and SQLite adapters use a bounded transactional source journal before delivering to that ledger. A DynamoDB source may commit its domain mutation and a canonical record in a separate audit table through one cross-table transaction. Neither a relay nor an archive schedule is implicit.

AuditSizePolicy::sqlite_100_mib is an initial finite-disk segment policy, not a universal storage limit. PostgreSQL partitions and DynamoDB hot/archive horizons remain provider-specific. Audit queries use a stable record cursor, so sealed or archived segments do not appear in application resource identities.

Production applications inject explicit PostgreSQL, SQLite, DynamoDB, object-storage or other append-only adapters and retain authorization in their application use cases.