audit

type AuditEvent struct {
	ID        string    `gorm:"primaryKey"`
	CreatedAt time.Time `gorm:"autoCreateTime"`
	Agent     string
	Tool      string
	Operation string
	Targets   string // JSON array of entity/relation names
	Count     int
	Outcome   string // "ok" | "error"
	ErrorMsg  string
}

type AuditFilter struct {
	Agent     string
	Tool      string
	Operation string
	Outcome   string
	Since     time.Time
	Limit     int
}

type AuditReader interface {
	Query(ctx context.Context, f AuditFilter) ([]AuditEvent, int64, error)
	Summary(ctx context.Context, window time.Duration) (AuditSummary, error)
}

type AuditStore interface {
	AuditWriter
	AuditReader
}

type AuditSummary struct {
	TotalMutations int
	ByAgent        map[string]int
	ByOperation    map[string]int
	ErrorRate      float64
	RiskyEvents    []AuditEvent
}

type AuditWriter interface {
	Write(ctx context.Context, e AuditEvent) error
}