Rhythm 2.0 Specifications

Appearance

DOM-PFM-OPS-002Record Activity Event

Markdown

DOM-PFM-OPS-002

Record Activity Event

Markdown
  • DocumentDraft
  • ImplementationObserved

Planning

Specified by
CON-PFM-OPS-002

Design

Owned by
SVC-PFM-OPS-audit

KindDomain objectProduct areaPlatformModuleOperational RecordsRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

Record Activity Event ​

What It Models ​

A record activity event preserves a small account of something a person did to a record. Visits share the store with supported mutation events from other modules. Security decisions have a separate history and purpose.

Identity and Attributes ​

The database assigns a time-based event identity. Each event names its workspace, person, type, target and occurrence key, with a millisecond timestamp supplied by the execution context. Metadata holds bounded tokens rather than record content. A visit key is unique within a person’s workspace history.

Relationships ​

Target references retain the record type and identity without requiring the business record to survive. Contacts and organizations are examples of cross-service targets; committee visits are registered too. The query layer uses visits to find current readable records, whereas raw history can retain references to removed records.

Invariants ​

The application role can insert and read but cannot modify or remove stored events. Workspace isolation and metadata shape are database concerns. Visit reporting resolves the target under current authority before the insert transaction, then returns the earlier event for a duplicate key or refuses a changed target.

How It Is Stored and Shared ​

Audit owns the activity table and writer functions. Mutation writers share a business transaction only when their caller supplies that transaction. Raw visit-history reads page by timestamp and identity; Recently Viewed results belong to Queries. The protected workspace purge path removes events in bounded batches. No custom fields are declared.

Open Design Questions ​

The retention period is still undecided. Current history APIs read visits only, and neither a person nor an administrator has a dedicated raw-history screen here.

Relationships

ToCardinalityOwnershipCrosses a serviceOn archive or delete
DOM-CRM-ENT-001one contact to many visit eventsThe link belongs to this object; the event names the contact by type and identity, with no constraint on the contactyes
DOM-CRM-ENT-002one organization to many visit eventsThe link belongs to this object; the event names the organization by type and identity, with no constraint on ityes

Invariants

InvariantProtectsEnforced atProvenance
INV-DOM-PFM-OPS-002-01
Ordinary application privileges prohibit updates and deletion; workspace purge is the supported removal path.
databasetest
services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an UPDATE of the event by the application role, so a trail cannot be rewritten
INV-DOM-PFM-OPS-002-02
Workspace policies restrict event insertion and reading to the session’s workspace.
databasetest
services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses a row written for another tenant from this tenant’s session, by the policy’s WITH CHECK
INV-DOM-PFM-OPS-002-03
Database checks admit only declared event types, their permitted metadata keys and at most one kilobyte of metadata.
databasetest
services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an event type the store does not hold, by audit_events_event_type_check
INV-DOM-PFM-OPS-002-04
An occurrence key is unique for a person within a workspace; an identical target returns the old event and a different target causes conflict.
database, servicetest
services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#reports the retry as a duplicate rather than refusing it, because the client has nothing to fix
INV-DOM-PFM-OPS-002-05
Public visit attribution and time come from verified execution context instead of the request body.
api, servicetest
services-platform:modules/audit/tests/unit/aws/api/audit-api-mapper.spec.ts#refuses a body naming the actor, which is how a trail would be written in somebody else’s name
INV-DOM-PFM-OPS-002-06
The public visit writer records a target only after resolving it under current record and dataset authority.
servicetest
services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#writes nothing at all for any of those refusals
INV-DOM-PFM-OPS-002-07
Millisecond precision and event identity provide stable ordering for history pagination.
databasetest
services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an instant finer than a millisecond, by audit_events_occurred_at_precision_check
INV-DOM-PFM-OPS-002-08
Mutation activity commits with the business change only when the owning caller provides that transaction.
serviceobserved
services-platform:modules/audit/services/persistence/audit-events.ts:recordEligibilityChange
INV-DOM-PFM-OPS-002-09
The query-reader role receives read privileges under the same workspace isolation.
databasetest
services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an INSERT by that role, because the grant is SELECT and nothing else

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software