An audit trail you can prove

Every audited create, write and unlink lands in an append-only log where each row stores the sha256 of the previous row plus its own fields. verify_chain() walks the whole chain and returns the first row that does not hash, so any silent edit is detectable. No group has write or delete on the log; appends happen only through a sudo write path. Independent of mail.thread.

Multi-company that refuses to leak

The company-aware mixin makes company_id required, defaults it to the active company, and rejects any write that moves a record into a company the user is not a member of, even under sudo, unless an explicit audited override context key is set. Every cross-company elevation writes its own audit row recording all affected record ids.

A foundation, not a black box

Typed per-company settings that version on write instead of destroying the old value, feature flags with company, group, date-window and deterministic percentage rollout, and a plain-Python service registry that keeps business logic off the ORM. LGPL-3 source on disk, no activation key, no phone-home. Read it, extend it, build on it.

A hash chain is inherently serial. Before each append the log takes a transaction-scoped Postgres advisory lock, so two concurrent transactions cannot read the same tail and fork the chain. The lock releases automatically on commit or rollback.

The company-aware mixin rejects cross-company writes even when called through sudo. The only way through is an explicit allow_cross_company context key, and taking it writes an audit row listing every affected record id, so the elevation is never silent.

The rate limiter increments with a single INSERT ON CONFLICT DO UPDATE RETURNING, so racing gunicorn or gevent workers can never both read a stale count. The counter is shared across workers and survives a restart, unlike an in-memory dict.

Audit payloads are built from raw field reads, so recordsets and date objects arrive un-serializable. The log coerces them identically for both the stored jsonb column and the hash material, so the chain stays symmetric and never raises on a relational field.

A missing actor is normalised to 0 on both the append and verify paths. An earlier version hashed it as 0 on write but as the string False on verify, which broke the chain for every system-initiated row. Fixed and covered.

The timezone service computes the civil date an event belongs to in the employee's own locale and returns day windows that correctly span 23 or 25 hour days across daylight-saving jumps, falling back to company timezone then UTC.

Writing a settings key never destroys the prior value. The old entry is archived and pointed at its successor, and a unique constraint guarantees exactly one active entry per company and key.

The rate-limit table is vacuumed by a dedicated daily cron that deletes only windows closed beyond the cutoff, keeping a high-churn counter table small without touching live counters.