---
status: walked + e2e-covered
coverage_depth: deep
last_walked:
  '2026-07-02 by Codex — reconciled against current Playwright coverage:
  tenant-audit-log-investigation.spec.ts.'
specs:
  - apps/oshun/web/e2e/tenant-audit-log-investigation.spec.ts
source: WALKTHROUGH/journeys/tenant-audit-log-investigation.md
---

# Journey result: Tenant audit log investigation

- **Walked**: 2026-05-29 by Claude (Opus 4.8) against commit `bf12b0f7d8`;
  coverage reconciled 2026-07-02 by Codex against current real-dev-infra
  Playwright.
- **Verdict**: **pass / deep E2E covered for shipped audit explorer** —
  `/operator/audit`, the audit investigation BFF, export paths, and meta-audit
  lifecycle are covered against the real dev stack.
- **Walker**:
  `/tmp/claude-oshun-lt-2-walkthrough/walk.mjs tenant-audit-log-investigation`

## Observations

- `/operator/audit` → 200 (authed); renders the table (when / actor / action /
  target) sorted newest-first, spanning incident.acknowledge,
  sso.connection.activated, tenant.member.added (rebuilt goal `9ba3d0823d`;
  prior 404 **fixed**).
- Current Playwright pins the direct `/operator/audit` surface: generatedAt,
  cursor, masthead/table counts, column identifiers, newest-first row ids/cells,
  footer targets, and anonymous redirect-before-render.
- `/operator/incidents` exposes the Audit log entry point and normal navigation
  into `/operator/audit`.
- The real `/v1/admin/audit-log/*` BFF is covered over HTTP: missing bearer 401,
  non-admin 403, event-feed filter echo, invalid payload 400, and investigation
  create → list → export JSON → export Markdown → delete → list-gone.
- The explorer UI drives the same BFF with an admin bearer bridge: filters land
  on the wire, a named investigation is saved/listed, Export JSON and Export
  Markdown produce real Blob downloads, and Delete removes the row plus store
  record.
- Investigation meta-audit events are read back from
  `/v1/admin/audit-log/events?eventTypePrefix=audit.investigation`; invalid
  create and duplicate delete do not mint phantom audit rows, and share tokens
  are not leaked in payloads.

## Current boundaries

- Chain-of-custody export hashes, UI bookmark/share controls, tenant-admin
  cross-tenant scoping, share-token revocation semantics, optimistic
  concurrency, multi-prefix filters, and retention-window indicators remain
  documented product gaps. They are not faked by the current suite.