@damn-dev/cli 0.19.2 → 0.19.4

package/runtime/apps/backend/prisma/schema.prisma

@@ -786,3 +786,47 @@ model SupportAccessGrant {
 
   @@index([workspaceId, createdAt])
 }
+
+// Tamper-evident audit log — the operator/CISO "Trace" surface. Append-only by
+// discipline + hash-chained per workspace (each row's `hash` covers its content
+// + the previous row's hash), so any tampering with a past row breaks the chain
+// and is detectable. Distinct from AgentEvent (mutable telemetry): this is
+// governance-grade, immutable, exportable. Int autoincrement id = monotonic
+// ordering for the chain. See lib/audit.ts.
+model AuditEvent {
+  id          Int      @id @default(autoincrement())
+  workspaceId String
+  actorType   String   // 'user' | 'agent' | 'system'
+  actorId     String
+  actorName   String?
+  action      String   // 'shell_exec' | 'config_change' | 'approval_decision' | 'policy_change' | 'agent_invoke' | ...
+  category    String   // 'activity' | 'config' | 'approval' | 'policy' | 'security'
+  targetType  String?
+  targetId    String?
+  summary     String   // plain-language one-line for the timeline
+  detail      String?  // JSON: raw payload / scopes / model / cost / decision
+  inputHash   String?
+  outputHash  String?
+  decision    String?  // 'allowed' | 'denied' | 'escalated' | 'approved' | 'rejected'
+  prevHash    String?
+  hash        String
+  createdAt   DateTime @default(now())
+
+  @@index([workspaceId, id])
+  @@index([workspaceId, category, id])
+  @@index([workspaceId, actorId, id])
+}
+
+// The CISO-configurable governance policy — one per workspace, all dimensions in
+// policyJson (validated by the Zod schema in lib/governancePolicy.ts). Seeded
+// from a template at setup; editable by operators anytime. Absent row = the
+// secure Regulated baseline default. See lib/governancePolicy.ts.
+model GovernancePolicy {
+  id          String   @id @default(cuid())
+  workspaceId String   @unique
+  template    String   @default("regulated")
+  policyJson  String
+  updatedBy   String?
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+}