Drop legacy APP_DB audit table

[kentcdodds]

Summary

• backfill all retained pre-cutover audit history into AUDIT_DB
• drop the legacy audit_events table from APP_DB in migration 0127
• remove stale APP_DB retention/disposition inventory and test schema while preserving AUDIT_DB retention
• isolate APP_DB/AUDIT_DB fixtures and document only the dedicated AUDIT_DB end state

Production evidence

• post-expand parity: VERIFIED (299/299, zero missing/extra)
• retention: VERIFIED (normal hourly lane removed a 181-day canary)
• write isolation: VERIFIED (controlled audited read: APP_DB delta 0, AUDIT_DB delta +1)
• retained history: VERIFIED — 65,147 rows backfilled to reserved negative ids and exact field-by-field verifier workflow completed without error
• final state: VERIFIED at 2026-08-01T23:43:04Z — APP_DB audit_events table count=0; AUDIT_DB count=65,519, including all 65,147 historical rows; oldest/newest=2026-07-06T13:21:25Z/2026-08-01T23:34:01Z
• role-gated production admin_audit_log_query smoke passed after drop (total=65,519, one row returned)

Validation

• migration, retention, deletion/export, and isolated admin tests passed
• CI=1 npm run validate passed
• PR CI and AI review passed; reviewer feedback addressed
• current-main validation and production deployment succeeded after a sibling commit advanced main during the PR merge validation

Review response

CodeRabbit correctly identified that a shared APP_DB/AUDIT_DB fixture could mask a regression. The admin test now provisions distinct databases with only their owned schemas.

System recap — extends existing primitives (medium risk)

Mode: recap · Base: main @ eb21f180 · Head: f9bd3f3d

Classification: extends — APP_DB removes a duplicate table after every retained row is proven present in the authoritative audit database.

Primitives touched

Primitive	Group	Impact
d1-app-db	storage	extends — drops legacy duplicate audit_events table
audit-d1	storage	composes — authoritative history, writes, reads, and retention
scheduled-cron	surfaces	extends — removes stale APP_DB retention inventory entry only

System map

The contract migration removes the inactive audit table from APP_DB after exact retained-history backfill; all audit behavior remains on AUDIT_DB.

Legend: green = composes (wiring only) · amber = extended by this PR · red = new primitive · gray = context (unchanged, included only when an edge crosses it).

flowchart LR
	d1AppDb["d1-app-db<br/>D1 app database"]:::extended
	auditDb["audit-d1<br/>Audit database"]:::touched
	scheduledCron["scheduled-cron<br/>Scheduled handler"]:::extended
	d1AppDb -->|"65,147 rows verified, then drop duplicate"| auditDb
	scheduledCron -->|"180-day prune remains AUDIT_DB-only"| auditDb
	classDef touched fill:#1a7f37,color:#fff
	classDef extended fill:#9a6700,color:#fff
	classDef added fill:#cf222e,color:#fff
	classDef untouched fill:#57606a,color:#fff

Loading

Invariants

• No audit read or write targets APP_DB.
• Every retained historical row is present in AUDIT_DB.
• AUDIT_DB owns the 180-day retention task.
• Distinct test schemas prevent APP_DB audit regressions from passing.

Conductor report

STATUS: done

What shipped: the audit expand/contract cycle is complete. AUDIT_DB is the sole read/write/retention home; 65,147 retained historical rows were backfilled and exactly verified; migration 0127 removed the APP_DB table and stale APP_DB retention inventory; docs describe only the end state.

Production evidence: VERIFIED — post-expand parity 299/299; hourly retention canary deleted; post-cutover APP_DB delta 0 / AUDIT_DB delta +1; exact historical verifier completed for 65,147 rows; after deployment APP_DB table is absent and AUDIT_DB contains 65,519 rows with the full backfill; admin read smoke passed.

Risk self-assessment: medium after verification — destructive only to a proven duplicate; authoritative history and ongoing events are intact in AUDIT_DB.

Merged/deployed: yes — PR #1146 / yes — production deploy.

Scope spill: append-only APP_DB migration plus audit retention inventory/docs/test cleanup; no email, entitlements, vectorize, or index.ts changes.

  

Summary by CodeRabbit

• Data Management

  • Audit events are now stored and accessed exclusively through the dedicated audit database.
  • Legacy audit-event storage is removed, with events retained globally and automatically pruned after 180 days.

• Bug Fixes

  • Account retention workflows no longer treat audit events as account-owned data, preventing them from being affected by account deletion or export processes.

• Documentation

  • Updated data-storage guidance to reflect the current audit-event lifecycle and storage behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change removes the legacy APP_DB audit_events table and its retention coverage. It records migration 0127, documents exclusive AUDIT_DB usage, updates test schemas and contexts, and preserves 180-day audit-event pruning.

Changes

Audit storage retirement

Layer / File(s)	Summary
Remove legacy audit storage docs/contributing/architecture/data-storage.md, packages/worker/migrations/0127-drop-legacy-audit-events.sql, tools/migration-ledger.json, packages/worker/src/package-registry/test-schema.ts, packages/worker/src/mcp/capabilities/admin/admin-mailbox-maintenance.node.test.ts	The migration drops the legacy audit_events table. The migration ledger records its checksum. Documentation, test schema setup, and admin test context now reflect dedicated AUDIT_DB storage.
Remove audit retention coverage packages/worker/src/app/retention.ts, packages/worker/src/app/account-retention-dispositions.ts, packages/worker/src/app/retention.node.test.ts	The retention manifest, scheduled dispositions, and coverage test no longer include audit_events.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• kentcdodds/kody#1145: This PR finalizes the dedicated AUDIT_DB migration and removes legacy APP_DB audit support.
• kentcdodds/kody#1142: Both PRs modify audit-event storage and retention behavior.
• kentcdodds/kody#1064: Both PRs retire legacy tables and remove their retention and account-management coverage.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: removing the legacy APP_DB audit table.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/reporting-off-d1-0dbb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔎 Preview deployed: https://kody-pr-1146.kody-a99.workers.dev

Worker: kody-pr-1146
D1: kody-pr-1146-db
KV: kody-pr-1146-oauth-kv

Mocks:

• cloudflare: https://kody-pr-1146-mock-cloudflare.kody-a99.workers.dev/__mocks (kody-pr-1146-mock-cloudflare)

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@packages/worker/src/mcp/capabilities/admin/admin-mailbox-maintenance.node.test.ts`:
- Line 135: The test fixture’s env binding currently assigns the same database
to APP_DB and AUDIT_DB, so create separate in-memory databases in the fixture
setup: initialize APP_DB with the users schema and AUDIT_DB with the
audit_events schema, then pass those distinct instances through the env object
while preserving the existing test behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ef4a1ace-e53a-4ee2-ba5c-ec36c463a975

📥 Commits

Reviewing files that changed from the base of the PR and between eb21f18 and a487823.

📒 Files selected for processing (8)

• docs/contributing/architecture/data-storage.md
• packages/worker/migrations/0127-drop-legacy-audit-events.sql
• packages/worker/src/app/account-retention-dispositions.ts
• packages/worker/src/app/retention.node.test.ts
• packages/worker/src/app/retention.ts
• packages/worker/src/mcp/capabilities/admin/admin-mailbox-maintenance.node.test.ts
• packages/worker/src/package-registry/test-schema.ts
• tools/migration-ledger.json

💤 Files with no reviewable changes (3)

• packages/worker/src/app/retention.ts
• packages/worker/src/app/retention.node.test.ts
• packages/worker/src/app/account-retention-dispositions.ts

[cursor]

@coderabbitai review