feat(accounts): add audit storage interface and journal delivery

.gitattributes

@@ -2,12 +2,30 @@
 # Keep normal whitespace checks everywhere else.
 module/services/frontend/code/src/gen/** whitespace=-blank-at-eof
 
-# Generated artifacts changed by the telemetry service removal.
-# Their owning generators remain responsible for the committed outputs.
-module/deployment/generated/** linguist-generated=true
+# Dedicated generator outputs; authored inputs and mixed source directories stay visible.
+module/contracts/api/** linguist-generated=true
 module/contracts/runnables/** linguist-generated=true
-module/services/telemetry/code/pkg/gen/** linguist-generated=true
-
-# Build recipes emitted by the pinned Go service agent.
+module/deployment/generated/** linguist-generated=true
+module/generated/** linguist-generated=true
 module/services/accounts/builder/** linguist-generated=true
+module/services/accounts/code/external/saas-starter/** linguist-generated=true
+module/services/accounts/code/pkg/gen/** linguist-generated=true
+module/services/accounts/code/python/gen/** linguist-generated=true
+module/services/accounts/generated/** linguist-generated=true
 module/services/auth-gateway/builder/** linguist-generated=true
+module/services/auth-gateway/code/pkg/gen/** linguist-generated=true
+module/services/auth-gateway/code/external/saas-starter/** linguist-generated=true
+module/services/frontend/code/packages/saas-sdk/generated/** linguist-generated=true
+module/services/frontend/code/src/gen/** linguist-generated=true
+module/services/frontend/code/src/generated/** linguist-generated=true
+module/services/frontend/generated/** linguist-generated=true
+module/services/marketing/code/src/generated/** linguist-generated=true
+module/services/policy-log/builder/** linguist-generated=true
+module/services/policy-log/code/pkg/gen/** linguist-generated=true
+module/services/telemetry/builder/** linguist-generated=true
+module/services/telemetry/code/pkg/gen/** linguist-generated=true
+
+# Keep dependency locks reviewable even inside exported generator snapshots.
+**/buf.lock linguist-generated=false
+**/package-lock.json linguist-generated=false
+**/go.sum linguist-generated=false

MODULE.md

@@ -611,6 +611,21 @@ content and disables a plan CTA when the catalog says checkout is unavailable.
 
 `UserService`, `APIKeyService`, `AuditService`, `AuditExportService`, `InvitationService`, `WebhookService`, `BillingService`, `PlatformAdminService`, `UsageService`, `SSOAdminService`, `MFAService`, `ConsentService`, `NotificationService`, `OnboardingService`, `GDPRService`, `UserSettingsService`, `AuthService`, `IdentityService`.
 
+### Audit storage
+
+`AuditService` owns where the audit trail is kept, chosen once at startup from
+the `audit-storage` configuration group (`AUDIT_STORAGE_BACKEND = postgres |
+warehouse`, plus dataset and table names only). Under `postgres`, the default,
+every entry is written to `audit_events` in the caller's transaction. Under
+`warehouse`, the entry is published to the journal as the internal event
+`saas.audit.recorded.v1` in that transaction (see [EVENTS.md](./module/EVENTS.md))
+and appended to the warehouse by a later task; the activity list and aggregation
+read the warehouse, which refuses the percentile metric. A module's audit through
+`ModuleEmitAuditEvent` takes the same path. A "platform principal" in these
+documents is a module principal with a `cross_tenant` grant. The warehouse backend
+is refused at startup until its storage exists in the build. See
+[ADR 0009](./module/docs/adr/0009-audit-store-swap.md).
+
 ## Usage metering
 
 `UsageService.ConsumeUsage` is an internal-only protobuf API for trusted product

configurations/local/audit-storage.env

@@ -0,0 +1 @@
+../../module/configurations/local/audit-storage.env

libraries/source-read-sdk/contract/catalog.codefly.json

@@ -10,7 +10,7 @@
       "kind": "protobuf",
       "package": "saas.accounts.v1",
       "path": "contract.binpb",
-      "digest": "sha256:30bfd77c270428933734b6ae35f5cca165db62fbe181c3f7717a663b1aa0ed73",
+      "digest": "sha256:06734c27a0cee5a6706f13e2776d72b8f61888b2a54b07cfc0e1e79cdffad7a8",
       "services": [
         {
           "name": "ModuleCapabilitiesService",
@@ -43,6 +43,7 @@
             "/saas.accounts.v1.ModuleCapabilitiesService/NotifyUser",
             "/saas.accounts.v1.ModuleCapabilitiesService/PlaceRecord",
             "/saas.accounts.v1.ModuleCapabilitiesService/PublishEvent",
+            "/saas.accounts.v1.ModuleCapabilitiesService/ReadJournal",
             "/saas.accounts.v1.ModuleCapabilitiesService/ReplayEvents",
             "/saas.accounts.v1.ModuleCapabilitiesService/RequestApproval",
             "/saas.accounts.v1.ModuleCapabilitiesService/ResolveWorkContextAuthority",