Modules
Threadline is an audit platform that captures database row changes and links them to application actions and execution context. Threadline combines trigger-backed row-change capture, rich action semantics (actor/intent/context), and operator-grade exploration.
Threadline.Audit runs a domain write inside one database transaction and optionally links the write to a semantic action.
An AuditChange is one row mutation in one audited table.
An AuditTransaction groups row changes from one database transaction; it is not a request or an action.
Threadline.ChangeDiff projects one captured row change into deterministic, JSON-friendly maps.
Threadline.Continuity documents the post-install capture boundary that
starts each table's audit history at its first trigger-fired mutation.
Threadline evidence records snapshot a subject's status and details at a point in time.
A proof document summarizes evidence snapshots and the claims they support.
The closed set of subject names accepted by Threadline evidence records.
Exports captured row changes as bounded CSV or JSON data and lazy streams.
Runs asynchronous export jobs by streaming captured rows to temporary files and storage.
Enqueues Threadline export jobs for asynchronous processing.
Enqueues Threadline exports in Oban.
Runs export jobs in supervised, in-process tasks.
An EvidenceRecord is an append-only snapshot of a Threadline subject at a point in time.
Reports capture health and trigger coverage for Threadline installations.
A health finding reports a detected capture issue with one host table and an actionable fix.
Validates :expected_uncovered_tables and :audit_anyway configuration
for Threadline.Health.trigger_coverage/1's third bucket.
The Sigra integration derives Threadline audit context from optional Sigra request state.
An IncidentBundle groups one captured transaction with its linked action and change diffs.
An incident change pairs a linked audit change with its JSON diff for investigation review.
A LinkedChange connects one captured row mutation to its transaction and optional action.
A linked transaction groups its audit changes and optional action into one investigation slice.
Carries serialized actor references and stable context keys through background-job argument maps.
Threadline.NotFoundError is raised by the ! sibling of a single-subject
lookup when the subject does not exist or is not visible under the caller's
scope.
Namespace for the Threadline operator surface — the opt-in mountable LiveView surface that turns Threadline's investigation contracts into one-click answers for documented support questions.
Uses host authorization callbacks to admit or halt Threadline operator LiveView mounts.
Mounts Threadline's operator interface in a Phoenix router with host-owned authorization and query scoping.
Threadline.Page represents one page of a Threadline paged read.
Plug that extracts AuditContext from a Plug.Conn and stores it in
conn.assigns[:audit_context].
Threadline.Retention batches expiry of AuditChange rows and optionally
removes empty AuditTransaction rows.
Validates config :threadline, :retention before purge runs.
An actor reference identifies who performed an audited operation, including when the actor is not a user.
An AuditAction is an application-level event that records who did what and why.
An AuditContext carries request or job details into a semantic audit action.
Stores and retrieves export files and other persistent artifacts.
Stores Threadline exports on the local filesystem.
Stores Threadline exports in S3-compatible object storage.
Resolves storage schema names and builds validated SQL references to Threadline-owned tables.
Threadline.Telemetry defines Threadline's emitted event contract and lets
hosts record accurate transaction table counts.
Compares health coverage entries with the host's expected audited tables.
Mix Tasks
Brownfield capture cutover helper — honest T0 semantics (see guides/brownfield-continuity.md).
Shows Threadline-owned evidence proof output through one canonical viewer task.
Loads application config, starts the configured Ecto repo, and writes an export file
using Threadline.Export — no ad-hoc Ecto.Query in this task (parity with
mix threadline.retention.purge).
Generates an Ecto migration that adds audit_changes_row_history_idx to an
existing Threadline install.
Generates an Ecto migration that installs Threadline audit triggers on the specified tables.
Shows trigger coverage as reported by Threadline.Health.trigger_coverage/1,
with a three-section table (default) or JSON output (--json).
Loads application config, starts the configured Ecto repo, and fetches the incident bundle for a given transaction ID.
Generates an Ecto migration file for the Threadline audit schema.
Shows configured versus deployed redaction policy drift for Threadline capture triggers through the same report shape used by the operator surface.
Delegates to Threadline.Retention.purge/1 after loading application config and
starting the configured Ecto repo (same resolution pattern as mix threadline.verify_coverage).
Verifies that tables listed in application config have Threadline audit
triggers installed, using the same catalog queries as Threadline.Health.trigger_coverage/1.