0043 — Workspace audit log is a workspace domain
The reviewable log of workspace changes lives in workspace, not in a second service.
Decided. The reviewable log of workspace changes lives in the workspace service, as the audit
domain. A workspace process (workspaceAuditListener) subscribes to every workspace domain fanout
and stores one human-readable row per event in the same Postgres database.
This is not reconstructing workspace state from events. Each consumed event creates a new audit
row. That row is the source of truth for the log. The unique key is (source_domain, source_event_id),
so a redelivery inserts nothing.
A separate deployable service was considered and rejected: the events are workspace's, the reviewers are workspace admins, and a second database would be a local copy without a reason beyond "it is a different binary."
Reads are GET /v1/audit on the workspace API, platform admins only. Payloads stay identifiers only
(0005).
Canonical source: docs/decisions/0043-workspace-audit-log.md.