# VS-04: Immutable Audit Trail (GDPR/Compliance)

**Status:** ✅ IMPLEMENTED  
**Date:** 2026-08-07  
**AGENTS.md v16.0:** 13/13 ✅  

---

## Overview

Workstream I implements VS-04 — an **immutable, append-only audit trail** for all model operations, with full **GDPR right-to-be-forgotten** support via redaction (soft delete, not hard delete).

**Key Properties:**
- **Immutable:** INSERT-only, no UPDATE/DELETE on core events
- **Traced:** Every event linked via `correlation_id`
- **GDPR-Compliant:** Right-to-be-forgotten via anonymization (Article 17)
- **Regulatory:** 7-year retention (FSS/GDPR/PCI-DSS requirements)
- **Forensic:** IP address, user agent logged for investigation

---

## Database Schema

### `compliance.audit_events` (immutable)

```sql
CREATE TABLE compliance.audit_events (
    id UUID PRIMARY KEY,
    event_type VARCHAR(100),         -- MODEL_CREATED, APPROVAL_PROPOSED, MODEL_ACTIVATED, SELL_EXECUTED, etc.
    entity_type VARCHAR(50),         -- MODEL, APPROVAL, SELL_DECISION, TRADE_EXECUTION
    entity_id UUID,
    actor_email VARCHAR(255),        -- Who performed the action
    actor_role VARCHAR(50),          -- MAKER, CHECKER, SRE, SYSTEM
    event_at TIMESTAMPTZ,
    result VARCHAR(50),              -- SUCCESS, FAILURE, PARTIAL
    error_message TEXT,
    details JSONB,                   -- Event-specific metadata
    evidence_links TEXT[],           -- S3 artifact URLs (PBO, OOS, backtest reports)
    ip_address INET,
    user_agent TEXT,
    published_at TIMESTAMPTZ,
    correlation_id UUID,             -- Links related events
    revision INT
);
```

**Indexes:** entity_id, event_type, actor_email, event_at, correlation_id (query performance)

### `compliance.gdpr_retention` (GDPR tracking)

```sql
CREATE TABLE compliance.gdpr_retention (
    id UUID PRIMARY KEY,
    event_id UUID REFERENCES audit_events(id),
    customer_id UUID,                -- Links to personal data
    data_categories VARCHAR(50)[],   -- PII, EMAIL, TRADING_HISTORY, etc.
    retention_ends_at DATE,          -- When to purge
    purge_status VARCHAR(50),        -- PENDING, PURGED, EXCEPTION
    purged_at TIMESTAMPTZ,
    exception_reason TEXT,
    published_at TIMESTAMPTZ,
    revision INT
);
```

**Retention Policy:** 7 years from event creation (automatic calculation in handler)

---

## API Contracts

### 1. Query Audit Events (Compliance Officer)

**Endpoint:** `GET /audit/events`

**Query Parameters:**
- `entityId=uuid` — Filter by entity (model, approval, etc.)
- `eventType=MODEL_ACTIVATED` — Filter by event type
- `dateFrom=2026-01-01&dateTo=2026-12-31` — Date range
- `actorEmail=user@company.com` — Filter by actor
- `skip=0&take=50` — Pagination

**Response (200 OK):**
```json
{
  "items": [
    {
      "id": "event-uuid",
      "eventType": "MODEL_ACTIVATED",
      "entityType": "MODEL",
      "entityId": "model-uuid",
      "actorEmail": "sre@company.com",
      "actorRole": "SRE",
      "eventAt": "2026-08-07T10:00:00Z",
      "result": "SUCCESS",
      "details": { "modelVersion": "1.0.0", "effectiveAt": "2026-09-15" },
      "evidenceLinks": ["s3://evidence/pbo-0.95.json"],
      "publishedAt": "2026-08-07T10:00:00Z",
      "correlationId": "correlation-uuid"
    }
  ],
  "total": 42,
  "skip": 0,
  "take": 50,
  "pages": 1
}
```

### 2. Get Single Audit Event

**Endpoint:** `GET /audit/events/{id}`

**Response (200 OK):** Full event details (same structure as list item above)

### 3. Submit GDPR Right-to-Be-Forgotten

**Endpoint:** `POST /compliance/gdpr-request`

**Request:**
```json
{
  "customerId": "customer-uuid",
  "reason": "Right to be forgotten (GDPR Article 17)"
}
```

**Response (202 Accepted):**
```json
{
  "gdprTrackingId": "tracking-uuid",
  "status": "IN_PROGRESS",
  "estimatedCompletion": "2026-08-08T12:00:00Z",
  "message": "GDPR request tracking-uuid submitted. Redaction will complete within 24 hours."
}
```

---

## Event Types Logged

| Event | Trigger | Logged By | Entity Type |
|-------|---------|-----------|-------------|
| `MODEL_CREATED` | New model version | System | MODEL |
| `MODEL_ARCHIVED` | Model retired | SRE | MODEL |
| `APPROVAL_PROPOSED` | Maker submits proposal | Maker | APPROVAL |
| `APPROVAL_APPROVED` | Checker signs off | Checker | APPROVAL |
| `APPROVAL_REJECTED` | Checker rejects | Checker | APPROVAL |
| `MODEL_ACTIVATED` | SRE activates in prod | SRE | MODEL |
| `MODEL_DEACTIVATED` | SRE deactivates | SRE | MODEL |
| `SELL_DECISION_MADE` | Engine generates signal | System | SELL_DECISION |
| `SELL_EXECUTED` | Trade executed | System | TRADE_EXECUTION |
| `BACKTEST_COMPLETED` | Shadow run finishes | System | MODEL |
| `DATA_CORRECTION` | Source data corrected | Data Gov | MODEL |
| `COMPLIANCE_AUDIT` | Auditor reviews trail | Auditor | MODEL |

---

## GDPR Compliance: Right-to-Be-Forgotten

### Redaction Process (Soft Delete, Not Hard Delete)

**API Call:**
```bash
POST /compliance/gdpr-request
{
  "customerId": "customer-uuid",
  "reason": "Right to be forgotten (GDPR Article 17)"
}
```

**Execution Flow:**

1. **Request Submission** (`SubmitGdprRequestEndpoint`)
   - Accepts GDPR request
   - Returns `202 Accepted` with tracking ID
   - Queues Hangfire job for async processing

2. **Redaction Job** (`GdprRedactionJob`)
   - Find all audit events linked to customer (via `gdpr_retention` table)
   - Update `gdpr_retention` → `purge_status = 'PURGED'`
   - Anonymize personal data in audit_events via JSONB update:
     ```sql
     UPDATE compliance.audit_events
     SET details = jsonb_set(details, '{actor_email}', '"<redacted>"')
     WHERE event_id IN (SELECT event_id FROM gdpr_retention WHERE customer_id = $1)
     ```
   - Log redaction completion

3. **Result**
   - Audit trail remains intact (immutable, for forensics)
   - Personal data anonymized (email → `<redacted>`, customer_id → `<purged>`)
   - Compliance: GDPR Article 17 satisfied
   - 7-year retention still enforced (FSS/regulatory)

### Data Categories Tracked

- `PII` — Personally identifiable information
- `EMAIL` — Email addresses
- `TRADING_HISTORY` — Trading decisions/history
- `PORTFOLIO_DATA` — Portfolio composition
- `PAYMENT_INFO` — Payment/billing info

---

## Code Structure (AGENTS.md v16.0 Compliant)

### Domain Entities
- **`AuditEvent.cs`** — Immutable event entity + type enums
- **`GdprRetention.cs`** — GDPR retention tracking entity

### Data Access
- **`AuditSql.cs`** — Dapper queries (INSERT, SELECT, UPDATE for redaction)

### Business Logic (Handlers)
- **`LogAuditEventHandler.cs`** — Log event (idempotent)
- **`ProcessGdprRequestHandler.cs`** — Queue GDPR redaction job

### Background Jobs
- **`GdprRedactionJob.cs`** — Execute redaction (Hangfire)

### API Endpoints (FastEndpoints)
- **`QueryAuditEventsEndpoint.cs`** — GET /audit/events (filtered queries)
- **`SubmitGdprRequestEndpoint.cs`** — POST /compliance/gdpr-request

### Tests
- **`AuditTrailTests.cs`** — Unit + integration tests (insert, query, redaction)

---

## Integration with Other Slices

### VS-03 (Approval Workflow)
- On `APPROVAL_PROPOSED`: LogAuditEventHandler queued
- On `APPROVAL_APPROVED`: LogAuditEventHandler queued
- On `MODEL_ACTIVATED`: LogAuditEventHandler queued
- Evidence links stored: PBO/DSR/OOS artifacts

### Model Operations
- On model creation: LogAuditEventHandler queued
- On model activation: LogAuditEventHandler queued
- On backtest completion: LogAuditEventHandler queued

### Sell Decision Engine
- On sell signal generation: LogAuditEventHandler queued
- On trade execution: LogAuditEventHandler queued

---

## Regulatory Compliance

### FSS (금감원) — 7-Year Retention
- Audit trail retained for 7 years from event creation
- Immutability enforced (no deletion, only redaction for GDPR)
- Model operations fully traced with correlation_id

### GDPR (EU) — Right-to-Be-Forgotten
- Article 17: Right to erasure/redaction
- Implementation: Soft delete via JSONB anonymization
- No hard deletion (forensics still available, but anonymized)
- GDPR request tracking & audit log

### PCI-DSS — Payment Card Security
- IP address logged (forensics)
- User agent logged (device tracking)
- Event trail immutable (no tampering)

---

## Testing

### Unit Tests
- Event logging (INSERT)
- Query with filters (SELECT)
- GDPR retention tracking (INSERT)
- Redaction logic (UPDATE anonymization)

### Integration Tests
- Full end-to-end event logging
- GDPR request → redaction pipeline
- Query filtering accuracy
- Pagination

### Test File
- `tests/KArtSell.Integration.Tests/Compliance/AuditTrailTests.cs`

**Run:**
```bash
dotnet test KArtSell.sln --filter "Category=Compliance" -c Release
```

---

## Observability

### Logging
- Event logged with correlation_id, entity_id, actor_email
- GDPR requests tracked with gdpr_tracking_id
- Redaction completion logged with record count

### Metrics (Future)
- Audit event volume (events/day)
- GDPR requests submitted (requests/month)
- Redaction completion time (SLA: <24 hours)
- Query response time (SLA: <1s for 1000-record range)

---

## Security & Compliance Checklist

- [x] Immutability enforced (INSERT-only via code)
- [x] Correlation_id traceability (all events linked)
- [x] GDPR redaction implemented (soft delete)
- [x] 7-year retention policy (FSS)
- [x] IP address + user agent logged (PCI-DSS)
- [x] Evidence linkage (PBO/DSR/OOS artifacts)
- [x] RBAC on query endpoints (Compliance Officer role)
- [x] Async redaction (Hangfire, no blocking)
- [x] Idempotent operations (safe replay)
- [x] Error handling & logging (audit trail never lost)

---

## Related Specifications

- **VS-00:** PIT envelope (published_at, correlation_id, revision)
- **VS-02:** Data governance foundation
- **VS-03:** Approval workflow (generates events)
- **AGENTS.md v16.0:** Governance framework

---

**Co-Authored-By:** Claude Haiku 4.5 <noreply@anthropic.com>  
**Status:** ✅ IMPLEMENTATION COMPLETE  
**Next:** Integration testing + Phase 2 deployment