Feature [Needs Review]: Append-only EPOS audit event log foundation (main/core/audit.ts)

[khaira777]

Important

Status: Needs Feature Review
This issue outlines a proposed operational feature. It requires product/security review and approval before deciding whether to implement or adopt.

Extracted from fork richanonymous22/FloCafe (branch: claude/plemmo-epos-audit-fro8v9):

Overview

Add a structured, append-only audit event logging subsystem (main/core/audit.ts) to maintain an immutable record of sensitive POS actions for anti-fraud and EPOS regulatory compliance.

Key Features & Technical Details

1. Immutable Audit Event Table:
   • Stores actor_id, action, resource_type, resource_id, payload_json, and ISO UTC timestamps.
2. Tracked Sensitive Operations:
   • ORDER_VOID, PRICE_OVERRIDE, DISCOUNT_APPLIED, REFUND_ISSUED, REGISTER_DRAWER_OPEN, SHIFT_START, SHIFT_END.
3. Reference Implementation:
   • main/core/audit.ts & tests/plemmo-audit.test.ts.

[khaira777]

Verdict: VALID ENHANCEMENT — needs product/security review and rescoping

Findings:

• No general append-only audit table exists. What does exist: tax_config_audit (main/db.ts:4351), loyalty_ledger (:4244), print_logs (:2305), payment_idempotency/order_idempotency (:3292, :3347), and support/diagnostics outboxes. Voids mutate order_items.status (main/routes/order-items.ts:116) without an actor/action record.
• Precedent: tax packs already require an audit trail (tax_config_audit + audit route in main/routes/tax-packs.ts), so an audit subsystem fits FloCafe's compliance direction.

Suggested scope: minimal append-only audit_events table + recorder for the highest-risk actions (item void, price override, discount, refund, master-PIN actions), owner-only read API, and retention policy. Coordinate with #278 (refunds), #279 (shift events), #280 (inventory ledger) so we don't build four parallel ledgers. Maintainer decision needed: event list + retention.