[alex-dembele]

Sixth screen of the redesign epic (#899). Stacked on #932 (financial): the base is feat/904-financial, so the diff shows only this issue.

What changes for the user

Activity is now the organisation's journal from the mockup:

• Domain pills: Tout, Risques, Incidents, Vulnérabilités, Mitigations, Preuves, Conformité, Rapports.
• Days grouped as Aujourd'hui, Hier, then the date, on a vertical rail.
• One sentence per entry, e.g. "System Administrator a changé le statut de la vulnérabilité Contournement d'authentification — passerelle API", with the time on the right. System entries show the OpenRisk mark.
• Objects with a drawer open it in place; others link to their page.
• Older entries load on scroll or with the button.

The dashboard's "Activité récente" card reads the same sentences.

Backend

• /timeline events carry domain and object, and ?domain= filters inside the query. The object comes from the record's title or name when the audit row carries one, otherwise from the name the summary quotes. Ids and bare numbers are never shown as names.
• Visibility change (tenant scoping untouched): mitigations, reports and frameworks have no drawer, so before this only audit-permission holders saw their events. They now follow the feed's own rule, "you see an event if you may read what it is about". The gate is the permission that already guards each page: mitigations:read, compliance:controls:read, reports:board:read. Governance records stay behind the audit permission. Flagging it here because it touches who sees what.
• Technical rows are left out of the journal for everyone and stay in the audit trail: onboarding celebrations, notification reads, unnamed routes.
• One mutation is recorded twice, by the HTTP middleware and by the model hook. The journal shows it once: it keeps the model row (which carries the record) and moves the actor over from the HTTP twin.
• Actors read by display name (NamesByIDs), falling back to the email.
• Fix found in the live pass: GormAuditChainRepository, the one production reads, ignored AuditEventFilter.EntityTypes. The domain filter came back unfiltered. The per-entity timeline asks for two names of one type (compliance_control + control), so it also matched any other type sharing the id. That matters for incidents, whose ids are sequential. Unit tests used a fake that honoured the list; a repository test now covers the real one.

Verified

• go test ./...: all packages pass. New tests:
  • TestJournal_Success / _NotFound (unknown domain) / _Unauthorized (per-page permission).
  • Domain pushed into the query, twin merge keeps the actor, TestObjectLabel, names lookup.
  • TestAuditChainList_FiltersByEntityTypes: it failed before the fix.
• npx tsc -b --noEmit clean, eslint clean on the touched files, npx vitest run 115 files / 1041 tests. One run had a flake in shared/ds Menu, untouched here; it passed 3 times alone.
• Live on Postgres with the parity dataset, at 1440×900 in dark and light, side by side with the design:
  • ?domain=incident returned 5 incidents (10 audit rows before the merge), each with its title and the person who created it.
  • The button loaded 30 → 60 entries.
  • The Incidents pill filtered.
  • Clicking an incident opened its drawer at /activity?drawer=incident&entity=5.

Deliberate differences from the mockup

• Objects are names, not references (INC-2026-033, R-0115). Those references don't exist yet; the same gap applies on the risk register.
• Updates read "a modifié" or "a changé le statut de". The mockup's "a relevé la probabilité de 2 à 3" needs before/after values, which the feed deliberately leaves to the audit trail, behind its own permission.
• The subtitle avoids the mockup's gendered "autorisée".

Not done here

• /timeline is not in docs/openapi.yaml at all. Documenting it is a separate docs task.
• The live check used the admin account only. The per-permission visibility is covered by tests.

Closes #905