chore(openspec): generate parafering-audit-trail spec

[rubenvdlinde]

Summary

Generate the parafering-audit-trail OpenSpec change. No code in this PR — spec only.

Layers a legally-sufficient, append-only audit trail on top of the existing parafeerroute lifecycle (sister to parafeerroute-engine, parafering-actions, voorstel-management). Every state transition (started, paraferd, advised, terugsturen, route-changed, completed) is recorded as a paraferingAuditEntry with actor, actor role, timestamp, reason, content snapshot, and IP — sufficient for Awb bezwaar/beroep procedures and Archiefwet handover to the gemeentelijk e-Depot.

Requirements (8 total, REQ-PAT-1 .. REQ-PAT-8)

ID	Capability
REQ-PAT-1	paraferingAuditEntry schema registration (10 properties, 2 enums, Schema.org Action)
REQ-PAT-2	Event-sourced audit writes only — single listener on ParafeerTransitionEvent
REQ-PAT-3	Append-only validator — UPDATE/DELETE rejected with HTTP 403 static message
REQ-PAT-4	Reuse of OpenRegister audit-trail-immutable — no parallel hash chain / Merkle tree
REQ-PAT-5	Content snapshot frozen at transition (6 fixed fields, no lazy refs)
REQ-PAT-6	Archive export endpoint with MDTO 1.0 envelope, group-gated to auditors
REQ-PAT-7	Manifest index page (type: 'index') for auditor browsing — no bespoke Vue view
REQ-PAT-8	Retention 20y for decisions / 7y for non-decisions (Selectielijst Gemeenten 2020)

Key Design Decisions

• Separate schema, not extending parafeeractie — parafeeractie must remain updateable by the routing service (e.g. step supersession); audit must be append-only. Conflating them weakens both.
• Event bus, not direct service call — listener-only writes future-proof for SIEM streaming and remove parafering-audit-trail as a hard dependency of the routing service.
• No custom audit store — extends ADR-022 by layering transition semantics on top of OR audit-trail-immutable; the auditEntryHash (SHA-256) provides per-entry tamper detection without a chain.
• MDTO 1.0 JSON envelope for V1 — XML profiles deferred; e-Depot push automation deferred to follow-up.
• Retention sweeper out of scope — the append-only validator blocks deletion outright; production retention enforcement filed as follow-up issue.

Validation

openspec validate --type change --strict parafering-audit-trail
Change 'parafering-audit-trail' is valid

Test plan

• OpenSpec strict validation passes locally (openspec validate parafering-audit-trail --type change --strict)
• Spec files render correctly in the OpenSpec UI
• Cross-references to parafeerroute-engine, parafering-actions, voorstel-management resolve
• ADR-022 alignment confirmed (no parallel audit store introduced)
• Archiefwet retention windows match Selectielijst Gemeenten 2020

[github-actions]

Quality Report — ConductionNL/procest @ 1241d1f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
composer			✅	✅ 100/100
npm			✅	✅ 407/407
PHPUnit					⏭️
Newman					⏭️
Playwright					❌

Spec coverage: 3% (21 tests / 673 specs)

---

Quality workflow — 2026-05-11 11:58 UTC

Download the full PDF report from the workflow artifacts.