<!-- DOCUMENT CLASS: DEVELOPMENT | SOURCE: 31_OBSERVABILITY_AUDIT_EVENT_MODEL.md -->

Observability, Audit & Event Model

Event identity

Every consequential event should be traceable through:

event_id
tenant_id
work_id
correlation_id
causation_id
principal_id
timestamp
event_type
source
version

Event classes

Ingestion
Normalization
Context
Work
Assignment
Decision
Approval
Communication
Agent
Capability
Execution
Receipt
Reconciliation
Promotion
Projection
Memory

Audit record

Audit should answer:

• who acted;
• what Work was affected;
• what context was used;
• what policy applied;
• what capability was invoked;
• who approved;
• what execution occurred;
• what source system returned;
• how state was reconciled;
• what memory changed.

Observability

Monitor:

• ingestion failures;
• connector health;
• queue depth;
• workflow failures;
• agent latency;
• approval latency;
• execution latency;
• reconciliation drift;
• projection freshness;
• memory promotion;
• bridge delivery.

Audit principle

Audit is a continuity mechanism, not only a security log.