Audit Log Service · View 34 of 40 · 6 · Operations
Decisions
- Degradation has a declared order and the operator does not choose it: accept and durably buffer first, seal and verify second, index for query third. Query freshness is spent before durability, never the reverse.
- Repair goes in one direction only — the index is rebuilt from segments, and segments are never reconstructed from the index. An operator who reaches for the second is in an incident, not a repair.
- Every operator action, including break-glass elevation, is an audit event in this log. The people who run the service are inside the threat model, and their loop closes through the same record everyone else's does.
What is watched
- Seal age and unsigned interval — the two numbers that say whether custody is keeping up.
- min.insync.replicas and partition lag — the two that say whether the acknowledgement is still honest.
- Divergence count and the weekly sweep's result — the two that say whether the evidence still holds.
Risks
- An operator cannot debug a data-shaped problem by looking at the data. Investigating a poison record means reading the quarantine metrics and the structured rejection reason, never the record — which is correct and will be unpopular, and should be said clearly during handover.
