Audit log
Every card the feed shows is a decision, and every decision is recorded with its reasons in an append-only, hash-chained log — so "is the algorithm pushing your games?" has a checkable answer.
What is recorded — one entry per card shown
| field | meaning |
|---|---|
seq · ts | position in the session's feed · timestamp |
sessionId | anonymous session — no identity |
tenant | operator id (or standalone) |
cardId, kind, game | what was shown |
reasonCodes | enumerated decision reasons (taxonomy below) |
reasons | the raw rule trace behind the codes |
policyVersion, rulesetId | the exact composition logic in force — a decision is reproducible against the logic that made it |
riskState | the operator risk state at decision time |
override | any human/config override: actor, ts, note — inside the hashed content |
prevHash, hash | the tamper-evident chain |
Reason-code taxonomy
rg_breather · non_bet_quota · loss_streak_damping · watch_try_adjacency · ritual_anchor · game_introduction · known_game · no_replay_content · freshness · operator_risk_state · fallback · weighted_pick
A fixed vocabulary a reviewer can audit without reading code. Note the responsible-gaming codes — the log shows RG rules firing, and RG is non-configurable by construction.
Tamper-evidence — the hash chain
Each entry stores hash = SHA-256(prevHash + entry-content); its prevHash is the previous entry's hash (the first links to a fixed genesis value). Editing any past field, deleting an entry, inserting, or re-ordering breaks the chain at that point. The log is append-only — earlier entries are never rewritten.
Verify it yourself: the dashboard's composition-audit panel has a Verify chain action that walks the whole chain and reports chain intact — N entries or the index and reason of the first break. The verifier is unit-tested against edit, delete, and re-hash attacks.
Export for a regulator
CSV / JSON export, scoped to the dashboard's date range and tenant filter. The export is allowlisted — only the fields above are emitted, so no internal field can ride along. Each row carries prevHash/hash, so an exported range's linkage is independently checkable.
Retention
The on-device log retains the most recent 1,000 decisions per browser (append-only ring). For a pilot, export on a schedule (e.g. daily) and retain server-side under your own decision-audit retention policy — the log carries no player identity, so retention is governed by your policy, not data-subject rules.
What this is not
The audit log records composition decisions. It is not a wallet or transaction ledger — money never appears here. It supplements, and does not replace, your own transaction and RG records.
docs/AUDIT.md
fidra is a B2B software supplier — no gambling services operated, no player funds held.
g.jgerenaia@tomsons.co