Audit Log Laravel Package

Product Decisions This Supports

• Build vs. buy for audit/change-history: adopting this package replaces a bespoke "who changed what" implementation with a maintained one, freeing roadmap capacity for differentiated features instead of compliance plumbing.
• Compliance and accountability roadmap: supports decisions to ship audit trails for regulated or high-trust workflows (finance, healthcare, admin actions, GDPR data-access logging) where "who did what, when, and what changed" must be demonstrable.
• Feature-level change history: enables product surfaces like per-entity revision timelines, admin activity feeds, and "last modified by" trust signals using RecordReader (with new indexed filtering on channel, actor_label, subject_label for responsive dashboards).
• Data-integrity guarantees for audited operations: the 6.0.0 fix rejecting non-JSON-encodable values (NAN, INF, invalid UTF-8) before recording means a malformed audit payload can no longer fail the flush and roll back the audited business change — a key product decision that audit must never break core transactions.
• Reliability/observability commitments: the new error logging on kernel.terminate/console.terminate for recorded-but-unflushed records closes a silent-data-loss risk, making it safer to promise "every action is logged" to customers.
• Export and integration decisions: AuditEntry::fromRecord() allows building detached audit entries for exports, external SIEM feeds, or customer-facing reports without coupling to the persistence layer.

When to Consider This Package

Consider adoption when:

• You need a durable audit trail for compliance (SOX, HIPAA, GDPR access logging) or accountability (admin/moderation actions) in a Laravel or Symfony application.
• You want entity change history surfaced in the product, not just raw logs.
• You operate multi-tenant systems and need channel-based separation and efficient filtered reads (new indexes directly support this).
• You value ADR-backed design (the flush lifecycle is documented) and active maintenance — 6.0.0 shows ongoing hardening, not a frozen library.
• You need framework-agnostic recording with first-class Laravel/Symfony lifecycle integration.

Look elsewhere when:

• You require immutable, cryptographically verifiable ledgers (tamper-evident chains, WORM storage) rather than an application-level audit table.
• You need full event sourcing with replayable state reconstruction — audit logging is not a substitute.
• Your stack is outside Laravel/Symfony with no bridge, or throughput demands exceed a relational audit table's capacity.
• Your team cannot accommodate semantic-version breaking changes: 6.0.0 changes RecordReader::actors() labeling behavior and relocates NullSubjectLabeller (namespace move). The SubjectLabeller alias is preserved, but the actor-labeling change can shift reporting output and should be validated against existing dashboards.

How to Pitch It (Stakeholders)

To executives: This package gives us a credible, maintained audit trail — the "who changed what and when" record regulators and enterprise buyers expect — without a costly custom build. The 6.0.0 release hardens it in two ways that matter commercially: audit records can no longer be silently lost at shutdown (errors are now logged), and malformed audit data can no longer break a customer's transaction by rolling it back. That translates to lower compliance risk and fewer "we lost the log" incidents.

To engineering: Mature, ADR-documented audit log with Laravel/Symfony lifecycle hooks. 6.0.0 adds terminate-time detection of unflushed records, upfront JSON-encodability validation (prevents flush-time rollbacks), reader indexes on channel/actor_label/subject_label, and AuditEntry::fromRecord() for detached entries. Two changes require attention on upgrade: RecordReader::actors() now labels actors by most-recent record (verify against existing reports) and NullSubjectLabeller moved to the Recording namespace (alias unchanged). Treat it as the audit primitive, not an event-sourcing engine.

To product/design: Unlocks change-history timelines, admin activity feeds, and "last modified by" affordances, backed by indexed queries that keep those views fast.