efc3500f20
Sprint SPRINT_20260408_004 AUDIT-004 (retention enforcement). AuditRetentionPurgeService BackgroundService enumerates tenants that have any rows in timeline.unified_audit_events, then calls timeline.purge_expired_audit_events(tenantId, dryRun) per tenant. The SQL function honours per-classification retention windows and the compliance_hold flag (legal holds pass through unaffected). AuditRetentionPurgeOptions bound from the AuditRetentionPurge config section: Enabled (default true), DryRun (default false), InitialDelay (default 5 min), Interval (default 6h). Failures on a single tenant are logged and do not stop the rest of the cycle. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Timeline
Container(s): stellaops-timeline-web
Slot: 24 (timeline) | Port: 8080 | Consumer Group: timeline
Resource Tier: light
Network aliases: timeline.stella-ops.local, timelineindexer.stella-ops.local (backwards compat)
Purpose
The Timeline module provides a unified, HLC-ordered event timeline across the entire platform. It aggregates audit events from Authority, JobEngine, Policy, Evidence Locker, and Notify via HTTP polling and direct ingestion. It also serves timeline indexer query and evidence linkage endpoints (previously in separate timeline-indexer-web and timeline-indexer-worker containers, now merged).
API Surface
/api/v1/audit/*— unified audit aggregation, anomaly detection, export/api/v1/timeline/*— timeline indexer event CRUD, indexed queries, evidence linkage/api/v1/timeline/hlc/*— HLC-ordered event queries, replay, export/timeline/*— bare-prefix indexer endpoints (direct access)
Storage
PostgreSQL schema timeline (via Postgres:Timeline:ConnectionString); Valkey for eventing
Background Workers
TimelineIngestionWorker(hosted service) — background event ingestion from NATS/Redis (transports disabled by default)
Merge History
- Timeline Indexer (Slot 23) was merged into Timeline (Slot 24). The
timelineindexer.stella-ops.localnetwork alias is preserved on the timeline-web container for backwards compatibility.