44195cd7af
Sprint SPRINT_20260408_004 AUDIT-004 documentation criterion. docs/modules/timeline/audit-retention.md covers: - Four-rung classification ladder and the "narrowest wins" rule - Retention table structure, platform defaults, per-tenant overrides, and legal holds via compliance_hold - AuditRetentionPurgeService config + operator recommendations - Right-to-erasure endpoint contract, hash-chain integrity guarantees, and the idempotency semantics via pii_redacted_at - Sequence-chain gap behaviour after purge and how chain verification should window its checks - Compliance checklist for operators Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Timeline
Unified event timeline service with HLC-ordered queries, critical path analysis, and deterministic replay.
Purpose
Timeline is the query and presentation layer for cross-service event correlation and auditing. It provides Hybrid Logical Clock (HLC)-ordered event queries, critical path analysis for latency diagnosis, and deterministic replay capabilities. Timeline reads events that have been indexed by the separate TimelineIndexer module, serving as the read-side of the event timeline infrastructure.
Quick Links
Status
| Attribute | Value |
|---|---|
| Maturity | Production |
| Source | src/Timeline/ |
Key Features
- HLC-based causal event ordering
- Correlation ID queries
- Critical path analysis (latency stages)
- Service-filtered timeline views
- Event export and deterministic replay
Dependencies
Upstream
- Eventing infrastructure (StellaOps.Eventing) - event storage and indexing
- HybridLogicalClock library - causal timestamp generation and comparison
Downstream
- Platform - timeline views for operator dashboards
- CLI - event query commands
- Web - timeline UI components
- Replay - deterministic replay of event sequences
Note: Timeline is the query/presentation service. TimelineIndexer (separate module) handles event ingestion and indexing. They are independently deployable services.
Runtime Contract
- Outside
Testing, Timeline ingestion must have at least one real transport enabled:Ingestion:Nats:Enabled=trueorIngestion:Redis:Enabled=true. - The null ingestion subscriber is reserved for explicit test harnesses and is not a live fallback.