[Foundation] Complete Record Revision History, Reliable Audit Trail, Auditor Access and Archive Readiness #10

New issue

Open

opened 2026-09-08 14:06:23 +02:00 by JackPrince · 0 comments

JackPrince commented

2026-09-08 14:06:23 +02:00

Owner

Problem

The application already records several trip changes, requires correction reasons and protects audit records using database triggers and a tenant-specific hash chain. However, revision coverage, auditor access and human-readable change history are incomplete. Receipt replacement can remove previous files, period closure changes records without individual revisions, and the exported offline verifier does not match the current audit payload.

Adding S3 Object Lock alone would preserve these gaps.

Objective

Establish complete, attributable and inspectable record history in the application before introducing external WORM storage. Preserve legitimate corrections while ensuring that original records, subsequent changes and supporting documents remain available.

Required capabilities

Immutable revisions for trips, expenses, supporting documents and relevant reference data.
Transactional updates linking the current record, its revision and its audit event.
A versioned audit format with tenant-local sequence numbers, protected timestamps and consistent verification.
Read-only auditor access to all relevant records and their history within the assigned tenant.
Visible change indicators and readable before/after comparisons in the UI and exports.
Immutable period-closure manifests, with subsequent corrections recorded as separately authorized amendments.
A durable archive outbox and portable revision format for future S3/WORM integration.
An explicit migration baseline that preserves existing evidence without inventing missing history.

Acceptance criteria

A tenant auditor can independently identify, inspect and export corrections and historical attachments. Every supported write path produces a corresponding revision and audit event. Concurrent edits cannot silently overwrite one another. Period amendments preserve the original closure. Backend and offline verification agree and detect tested tampering and missing evidence.

Boundaries

S3 Object Lock integration belongs to issue #8. Database backups, snapshots and disaster recovery belong to issue #9. This issue establishes application-level evidence and WORM readiness; it does not claim external WORM protection or automatic legal certification.

## Problem The application already records several trip changes, requires correction reasons and protects audit records using database triggers and a tenant-specific hash chain. However, revision coverage, auditor access and human-readable change history are incomplete. Receipt replacement can remove previous files, period closure changes records without individual revisions, and the exported offline verifier does not match the current audit payload. Adding S3 Object Lock alone would preserve these gaps. ## Objective Establish complete, attributable and inspectable record history in the application before introducing external WORM storage. Preserve legitimate corrections while ensuring that original records, subsequent changes and supporting documents remain available. ## Required capabilities - Immutable revisions for trips, expenses, supporting documents and relevant reference data. - Transactional updates linking the current record, its revision and its audit event. - A versioned audit format with tenant-local sequence numbers, protected timestamps and consistent verification. - Read-only auditor access to all relevant records and their history within the assigned tenant. - Visible change indicators and readable before/after comparisons in the UI and exports. - Immutable period-closure manifests, with subsequent corrections recorded as separately authorized amendments. - A durable archive outbox and portable revision format for future S3/WORM integration. - An explicit migration baseline that preserves existing evidence without inventing missing history. ## Acceptance criteria A tenant auditor can independently identify, inspect and export corrections and historical attachments. Every supported write path produces a corresponding revision and audit event. Concurrent edits cannot silently overwrite one another. Period amendments preserve the original closure. Backend and offline verification agree and detect tested tampering and missing evidence. ## Boundaries S3 Object Lock integration belongs to issue #8. Database backups, snapshots and disaster recovery belong to issue #9. This issue establishes application-level evidence and WORM readiness; it does not claim external WORM protection or automatic legal certification.

JackPrince added the

Priority

Critical

Kind/Feature

labels

2026-09-08 14:06:23 +02:00

JackPrince self-assigned this

2026-09-08 14:06:23 +02:00

JackPrince added a new dependency

2026-09-08 14:06:44 +02:00

#8 [Feature] Storage Driver Abstraction (S3-Compatible & WebDAV / Nextcloud)

JackPrince changed title from [Foundation] Complete Record Revision History, Reliable Audit Trail and Auditor Access — Prerequisite for WORM Storage** to [Foundation] Complete Record Revision History, Reliable Audit Trail, Auditor Access and Archive Readiness

2026-09-08 14:25:04 +02:00