Filament Activity Log Laravel Package

Product Decisions This Supports

• Ship an audit-trail / "who changed what" feature without a design or front-end sprint. This is a thin Filament presentation layer over spatie/laravel-activitylog. It turns a well-understood but unglamorous data layer into a readable timeline inside resource pages. Realistic saving: 1–3 engineering days, not a quarter. The decision it informs is "do we spend that time here or on the core roadmap?"
• Build vs. buy, split into two separate calls. Buy the engine (spatie/laravel-activitylog is effectively the Laravel standard; do not hand-roll this). Treat this package as a cosmetic adapter that is cheap to adopt and cheap to discard. Low blast radius is the key property — it should never become an architectural commitment.
• Compliance and trust posture. Audit history underpins SOC 2 / HIPAA / GDPR "accountability" narratives, internal control reviews, and dispute resolution ("who changed this invoice and when"). This package supports the internal visibility half of that story. It does not support the evidentiary half — no immutability, no hash chaining, no tamper evidence.
• Support-cost reduction. Back-office and CS teams currently file tickets asking engineering to query the DB for change history. A visible timeline in the admin panel removes a recurring, low-value engineering interrupt. Easy to quantify: tickets-per-month × cost-per-ticket.
• Roadmap sequencing / de-scoping. If audit history is a "nice to have" for internal admins, this lets you close that item in an afternoon and reallocate the sprint to revenue-facing work. If it is a contractual or regulatory requirement, this is a starting point only and you must scope a real audit design.
• Use cases where it fits: internal admin/back-office panels, multi-tenant SaaS ops consoles, order/invoice/record change histories, admin-side "what happened to this account" investigations, internal QA of data mutations.
• Diligence signal to record, not ignore: 72 stars, 0 dependents, single visible maintainer, low opportunity score. That is not a production-scale endorsement. It is acceptable for a convenience dependency; it is not acceptable as a load-bearing compliance control.

When to Consider This Package

Consider it when:

• You are already on Filament 3 + Laravel and the admin surface is internal-facing.
• You are on, or are about to adopt, spatie/laravel-activitylog — this package adds no meaningful value without it.
• The requirement is "admins can see history," not "auditors can rely on history."
• You want to validate demand for audit visibility before investing in a proper audit store, retention policy, and export pipeline.
• Your team is small enough that a one-day fork-and-own is an acceptable fallback, and you are comfortable pinning the version.

Look elsewhere when:

• The audit log is a compliance artifact — you need append-only storage, tamper evidence, hash chaining, WORM retention, legal hold, or auditor-facing export. Neither this package nor plain spatie gives you that.
• You need retention policies, PII redaction, field-level masking, or SIEM/warehouse export. Those are design decisions the wrapper does not make for you.
• You are not on Filament, or you are on a Filament version this has not been tested against. The UI is the entire value proposition.
• You need a support contract, security review, or SLA. A 72-star single-maintainer package cannot supply them; if procurement requires vendor accountability, budget for a fork.
• The audience is customer-facing. Activity logs leak internal identifiers, user emails, and before/after values; exposing them externally is a privacy decision, not a UI decision.
• You need proof of scale. Zero dependents means no public evidence of production hardening.

Mitigation if you adopt: pin the version, keep spatie as the sole source of truth so the wrapper stays swappable, and write the timeline view as a replaceable component. Budget half a day to fork if maintenance stalls.

How to Pitch It (Stakeholders)

To executives: Audit visibility is a trust-and-compliance checkbox, not a differentiator — but it currently costs us engineering interrupts every week and shows up in security questionnaires. This package is MIT-licensed, free, and lets us close that checkbox in roughly a day instead of a sprint, on top of the Laravel-standard logging library. The risk is deliberately contained: it is a display layer, so if it goes stale we fork it or replace it in a day, and our underlying audit data is unaffected. Caveat to set expectations: this gives us internal visibility, not auditor-grade evidence. If a customer or auditor requires tamper-proof logs, that is a separate, larger scoping item — flag it now rather than after we promise it.

To engineering: waseet/filament-activity-log is a presentation adapter over spatie/laravel-activitylog — a relation manager and a timeline view, not a new subsystem. Adoption cost is config plus wiring; no new persistence model, no new query patterns, no lock-in beyond the view. Keep spatie models and migrations as the contract so the adapter is disposable. Known concerns: single maintainer, no dependents, so pin the version and expect to own a fork. Do not let anyone describe this as our audit system — it is the UI on top of our audit system, and the difference matters the first time legal asks.