feat: Add persistent event logging (audit_events)

src/api/auth.ts

@@ -60,6 +60,15 @@ export function createAuthRouter(): Router {
         email: user.email,
       });
 
+      // Log login event
+      db.audit.log({
+        kind: "user_login",
+        message: `User ${user.email} logged in`,
+        userId: user.id,
+        severity: "info",
+        meta: { email: user.email, role: user.role },
+      });
+
       // Return tokens
       res.json({
         success: true,
@@ -98,6 +107,9 @@ export function createAuthRouter(): Router {
         });
       }
 
+      // Get user from token before revoking
+      const payload = verifyAccessToken(accessToken);
+
       // Get refresh token from body
       const { refreshToken } = req.body;
 
@@ -109,6 +121,17 @@ export function createAuthRouter(): Router {
         revokeToken(refreshToken);
       }
 
+      // Log logout event
+      if (payload) {
+        db.audit.log({
+          kind: "user_logout",
+          message: `User ${payload.email} logged out`,
+          userId: payload.userId,
+          severity: "info",
+          meta: { email: payload.email },
+        });
+      }
+
       res.json({
         success: true,
         message: "Logged out successfully",

src/api/tasks.ts

@@ -61,6 +61,16 @@ export function createTaskRouter(db: Database, queue: QueueAdapter, gate: Enforc
         // Task is BLOCKED - do NOT queue, require human approval
         db.updateTask(task.id, { status: "stopped", stop_score: gateDecision.stopScore });
 
+        // Log blocked task event
+        db.audit.log({
+          kind: "task_failed",
+          message: `Task "${task.title}" blocked by enforcement gate`,
+          taskId: task.id,
+          userId: (req as any).userId,
+          severity: "warn",
+          meta: { stopScore: gateDecision.stopScore, reasons: gateDecision.reasons },
+        });
+
         return res.status(202).json({
           id: task.id,
           status: "BLOCKED",
@@ -74,6 +84,16 @@ export function createTaskRouter(db: Database, queue: QueueAdapter, gate: Enforc
       // Task passed gate - queue for processing
       await queue.add("process_task", { taskId: task.id });
 
+      // Log task created event
+      db.audit.log({
+        kind: "task_created",
+        message: `Task "${task.title}" created`,
+        taskId: task.id,
+        userId: (req as any).userId,
+        severity: "info",
+        meta: { priority: task.priority, assignee: task.assignee },
+      });
+
       res.status(201).json({
         id: task.id,
         status: "pending",
@@ -111,6 +131,16 @@ export function createTaskRouter(db: Database, queue: QueueAdapter, gate: Enforc
         // Work is BLOCKED - cannot complete task
         db.updateTask(task.id, { status: "stopped", stop_score: gateDecision.stopScore });
 
+        // Log blocked submission event
+        db.audit.log({
+          kind: "task_failed",
+          message: `Task "${task.title}" submission blocked`,
+          taskId: task.id,
+          userId: (req as any).userId,
+          severity: "warn",
+          meta: { stopScore: gateDecision.stopScore, reasons: gateDecision.reasons },
+        });
+
         return res.status(202).json({
           id: task.id,
           status: "BLOCKED",
@@ -124,6 +154,16 @@ export function createTaskRouter(db: Database, queue: QueueAdapter, gate: Enforc
       // Work passed gate - mark as completed
       db.updateTask(task.id, { status: "completed", stop_score: gateDecision.stopScore });
 
+      // Log task completed event
+      db.audit.log({
+        kind: "task_finished",
+        message: `Task "${task.title}" completed`,
+        taskId: task.id,
+        userId: (req as any).userId,
+        severity: "info",
+        meta: { stopScore: gateDecision.stopScore },
+      });
+
       res.json({
         id: task.id,
         status: "completed",

src/chat/manager.ts

@@ -14,6 +14,7 @@ import { costTracker } from "../billing/costTracker.ts";
 import { selectModel } from "../billing/modelSelector.ts";
 import { agentTools, executeTool } from "./tools.ts";
 import { trackAICall, log, metrics } from "../monitoring/sentry.js";
+import { events } from "../lib/events.js";
 import Anthropic from "@anthropic-ai/sdk";
 import OpenAI from "openai";
 import { GoogleGenerativeAI } from "@google/generative-ai";
@@ -163,6 +164,9 @@ export class ChatManager {
       }
     }
 
+    // Log chat event for audit trail
+    events.chatSent(request.userId, request.agentName, request.message);
+
     return {
       chatId: chat.id,
       messageId: assistantMessage.id,