The gap
Task deletion is recorded in the audit trail; task creation is not. Creating a task produces no audit event, so there is no durable record of who created which task or when.
How it surfaced
Building the workspace activity feed (#54): the feed presents recorded events, and task creation is conspicuously absent because nothing emits it. The feed correctly shows what is recorded; the gap is in audit coverage, not the feed.
Impact
- Incomplete audit trail: creation is an unrecorded mutation while deletion is recorded - an asymmetry an auditor would flag
- The activity feed cannot show task creation until this is emitted (the allowlist entry was removed to match reality and will be restored once creation is audited)
Proposed direction
Emit a task.created audit event in the task-creation path, mirroring how task.deleted is emitted on deletion - same actor/workspace/target/payload discipline.
Out of scope here
Filed from the activity-feed work but deliberately not bundled into it - that change is read-only by design and introduces no new events. This is a small, separate audit-layer change with its own verification.
The gap
Task deletion is recorded in the audit trail; task creation is not. Creating a task produces no audit event, so there is no durable record of who created which task or when.
How it surfaced
Building the workspace activity feed (#54): the feed presents recorded events, and task creation is conspicuously absent because nothing emits it. The feed correctly shows what is recorded; the gap is in audit coverage, not the feed.
Impact
Proposed direction
Emit a
task.createdaudit event in the task-creation path, mirroring howtask.deletedis emitted on deletion - same actor/workspace/target/payload discipline.Out of scope here
Filed from the activity-feed work but deliberately not bundled into it - that change is read-only by design and introduces no new events. This is a small, separate audit-layer change with its own verification.