PHPackages                             kanvigo/audit-contracts - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [PSR & Standards](/categories/psr-standards)
4. /
5. kanvigo/audit-contracts

ActiveLibrary[PSR & Standards](/categories/psr-standards)

kanvigo/audit-contracts
=======================

Stable contracts for Kanvigo's pluggable audit layer: the immutable AuditEvent DTO and the AuditSink interface third-party sinks implement.

v0.2.1(1mo ago)01711MITPHPPHP ^8.4

Since Jul 4Pushed 1mo agoCompare

[ Source](https://github.com/Fanmade/kanvigo-audit-contracts)[ Packagist](https://packagist.org/packages/kanvigo/audit-contracts)[ Docs](https://github.com/Fanmade/kanvigo-audit-contracts)[ RSS](/packages/kanvigo-audit-contracts/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependencies (4)Versions (3)Used By (1)

kanvigo/audit-contracts
=======================

[](#kanvigoaudit-contracts)

Stable contracts for [Kanvigo](https://github.com/Fanmade/Kanvigo)'s pluggable audit layer. Both the Kanvigo core and every audit sink — official (e.g. the Chronicle bridge) or third-party — depend only on this tiny package, so sinks can be developed and versioned independently of the application (the PSR-3 / Flysystem-adapter pattern).

The contract
------------

[](#the-contract)

- **`AuditEvent`** — the immutable DTO for a single audited action: `action`, `category`, `subject{type,id}`, `actorId` (null = system actor), `metadata[]`, `tags[]`, `context{source, ip, userAgent, tokenName}`, `occurredAt`. Explicitly serializable via `toArray()` / `fromArray()` with a versioned (`v`) schema.
- **`AuditSink`** — what you implement: `accepts(AuditEvent): bool` (the taxonomy filter), `record(AuditEvent): void`, `policy(): SinkPolicy`.
- **`SinkPolicy`** — how a sink runs: `sync()` (inline, after commit, failures isolated), `queued()` (shipped by the outbox drain worker, at-least-once), `failClosed()`(synchronous, pre-commit, inside the domain transaction — a failure aborts the action). Queued + fail-closed is impossible by construction.
- **`AuditCategory`** — Content · Authn · Authz · Token · Security. The canonical event → category table lives in the enum's docblock.
- **`AuditSource`** — Ui · Mcp · Api · Queue · System.
- **`Exceptions\AuditIntegrityException`** — thrown by the emitting application when a fail-closed sink's guarantee cannot be honored (audited mutation outside a transaction).

Implementing a sink
-------------------

[](#implementing-a-sink)

```
use Kanvigo\Audit\Contracts\{AuditEvent, AuditCategory, AuditSink, SinkPolicy};

class SiemSink implements AuditSink
{
    public function accepts(AuditEvent $event): bool
    {
        return $event->category !== AuditCategory::Content;
    }

    public function record(AuditEvent $event): void
    {
        $this->client->ship($event->toArray());
    }

    public function policy(): SinkPolicy
    {
        return SinkPolicy::queued();
    }
}
```

Register the class in the application's `config/audit.php` `sinks` list — done. Sinks run alongside each other; each receives every event it accepts.

Stability & versioning
--------------------------

[](#stability--versioning)

This package follows semver with an **additive-only** policy inside a major version:

- `AuditEvent` fields and array-schema keys are only ever added, never renamed, retyped or removed. The `v` key identifies the schema generation.
- Enum cases are only added. Sinks must tolerate (ignore or generically handle) actions, categories and sources they don't know.
- The `AuditSink` interface gains no new required methods within a major version.

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance91

Actively maintained with recent releases

Popularity15

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity42

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~13 days

Total

2

Last Release

35d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/03ee7b67b9a5fc7e28528dcd9756394b83f8923c6592fde5aaa43189d0022f7b?d=identicon)[Fanmade](/maintainers/Fanmade)

---

Top Contributors

[![Fanmade](https://avatars.githubusercontent.com/u/2896491?v=4)](https://github.com/Fanmade "Fanmade (2 commits)")

---

Tags

contractsAuditcomplianceaudit-logkanvigo

###  Code Quality

TestsPest

Code StyleLaravel Pint

### Embed Badge

![Health badge](/badges/kanvigo-audit-contracts/health.svg)

```
[![Health](https://phpackages.com/badges/kanvigo-audit-contracts/health.svg)](https://phpackages.com/packages/kanvigo-audit-contracts)
```

###  Alternatives

[symfony/translation-contracts

Generic abstractions related to translation

2.6k765.3M772](/packages/symfony-translation-contracts)[symfony/cache-contracts

Generic abstractions related to caching

2.4k341.3M355](/packages/symfony-cache-contracts)[symfony/http-client-contracts

Generic abstractions related to HTTP clients

2.0k437.3M508](/packages/symfony-http-client-contracts)[symfony/contracts

A set of abstractions extracted out of the Symfony components

3.9k66.4M145](/packages/symfony-contracts)[facade/ignition-contracts

Solution contracts for Ignition

636151.1M168](/packages/facade-ignition-contracts)[dragon-code/contracts

A set of contracts for any project

1010.8M39](/packages/dragon-code-contracts)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)