Domain event catalogue
Status: Accepted · Version: 0.1
Events are JSON objects validated against ../schemas/audit-event.schema.json, with type from the list below. Producers must persist them through the audit module when the type is marked audit.
Payloads contain ids and codes. They must not contain instruction text, document bytes, OTPs, or tokens.
Identity and contacts
| Type | Audit | When |
|---|---|---|
user.created |
yes | Owner account created |
session.revoked |
yes | Owner or system revokes a session |
trusted_contact.invited |
yes | Invitation created |
trusted_contact.accepted |
yes | Contact accepts |
trusted_contact.rejected |
yes | Contact rejects |
trusted_contact.verified |
yes | Channel verified |
trusted_contact.removed |
yes | Owner removes |
recipient.created |
yes | Recipient record created |
vault.assigned |
yes | Assignment written |
Vault
| Type | Audit | When |
|---|---|---|
vault.created |
yes | Vault created |
instruction.version_created |
yes | New version id. No body |
vault.archived |
yes | Archived |
vault.deleted |
yes | Ciphertext destroyed |
Life check and escalation
| Type | Audit | When |
|---|---|---|
policy.version.activated |
yes | Life-check or release policy version becomes active. Includes policy_version and previous version id |
life_check.confirmed |
yes | Owner confirmed. Includes from-state |
life_check.attempt_recorded |
yes | A reminder or alternate attempt was recorded |
escalation.transitioned |
yes | State change. Includes from, to, cycle id |
escalation.cancelled |
yes | Cycle returned to active or was cancelled |
notification.requested |
yes | Handed to the notification module |
notification.provider_accepted |
yes | Provider accepted the send |
notification.provider_failed |
yes | Provider failed. Must not start grace |
Release
| Type | Audit | When |
|---|---|---|
release.case.created |
yes | Candidate created |
release.case.eligible |
yes | Evidence attached. See example |
release.case.simulated |
yes | Prototype / drill outcome |
release.case.approved |
yes | Reviewer approved. Forbidden in prototype emitters |
release.case.rejected |
yes | Reviewer rejected |
release.case.held |
yes | Case hold |
release.hold.enabled |
yes | Global hold on |
release.hold.disabled |
yes | Global hold off |
release.package.created |
yes | Vault ids and content version ids only |
release.recipient.accessed |
yes | Recipient opened a vault |
release.case.eligible
{
"type": "release.case.eligible",
"at": "2026-10-13T00:00:00Z",
"actor": { "kind": "system", "id": "system" },
"user_id": "usr_example",
"release_case_id": "rel_example",
"policy_version": "7",
"evidence": [
"life_check_unconfirmed",
"grace_period_elapsed",
"trusted_contact_confirmed"
]
}
Notification abstraction
Producers emit notification.requested. The notification module applies policy, renders a template, and calls one provider adapter. Life-check code must not import a provider SDK.
Template variables may include owner display name, a portal link, and a cycle id. They must not include instruction bodies.
Canonical notice sense, Indonesian or English:
Ada informasi Titip yang tersedia untuk Anda.
That sentence is for recipient release notices, which the prototype does not send for real. Life-check templates are different: they ask the owner to confirm, or ask a trusted contact to review a confirmation request. They still must not include vault contents.