From 7b6c4036a5731f342ac03d923079904374755fd2 Mon Sep 17 00:00:00 2001
From: alex-dembele <alexandredembele16@gmail.com>
Date: Fri, 9 Oct 2026 09:20:38 +0100
Subject: [PATCH 1/6] feat(timeline): read the tenant feed as the
 organisation's journal (#905)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The redesigned Activity page reads "Fatou Ndiaye a créé la mitigation
Bastion d'administration (PAM)" and filters by Risques, Incidents,
Vulnérabilités, Mitigations, Preuves, Conformité and Rapports. The feed
now gives it what that takes:

- Each event names its domain and its object. The object is the record's
  title or name when the audit row carries it, else the name the summary
  quotes; ids and bare numbers are not names.
- GET /timeline?domain=… filters by domain inside the query, so a
  filtered page is full rather than over-read and thinned.
- Mitigations, reports and frameworks have no drawer and were shown only
  to audit-permission holders. They now follow the feed's own rule (you
  see an event if you may read what it is about), gated by the permission
  that guards their pages: mitigations:read, compliance:controls:read,
  reports:board:read. Governance records stay behind the audit permission.
- Technical rows (onboarding celebrations, notification reads, unnamed
  routes) are left out of the journal for everyone; the audit trail keeps
  them.
- One mutation recorded by both the HTTP middleware and the model hook
  shows once, from the model row that carries the record.
- Actors read by display name when the user has one, email otherwise.

Tests: journal Success / NotFound (unknown domain) / Unauthorized (per
page permission), domain pushed into the query, twin merge, object
labels, names. Existing timeline tests unchanged and green.

Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
---
 .../internal/application/entity/journal.go    | 206 ++++++++++++++++++
 .../application/entity/journal_test.go        | 199 +++++++++++++++++
 .../internal/application/entity/timeline.go   |  43 ++--
 backend/internal/application/entity/types.go  |   8 +
 backend/internal/handler/entity_handler.go    |   5 +-
 .../repository/gorm_user_repository.go        |  27 +++
 6 files changed, 474 insertions(+), 14 deletions(-)
 create mode 100644 backend/internal/application/entity/journal.go
 create mode 100644 backend/internal/application/entity/journal_test.go

diff --git a/backend/internal/application/entity/journal.go b/backend/internal/application/entity/journal.go
new file mode 100644
index 000000000..b78dd4d25
--- /dev/null
+++ b/backend/internal/application/entity/journal.go
@@ -0,0 +1,206 @@
+// Copyright (c) 2026 OpenDefender Contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+// This program is free software: you can redistribute it and/or modify it under
+// the terms of the GNU Affero General Public License v3.0 (see LICENSE).
+
+package entity
+
+import (
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/opendefender/openrisk/internal/domain"
+)
+
+// =============================================================================
+// The organisation's journal (#905)
+// =============================================================================
+//
+// The Activity page reads the tenant feed as a journal: "Fatou a qualifié en P1
+// INC-…". That needs three things the raw audit row does not say plainly:
+//
+//   - which business domain an event belongs to, so the page can filter by
+//     Risques / Incidents / Vulnérabilités / Mitigations / Preuves / Conformité /
+//     Rapports;
+//   - the object's name, so the sentence can end on it;
+//   - one entry per thing that happened. Two writers record a mutation (the
+//     HTTP middleware and the model hook), so the same change arrives twice.
+//
+// Visibility keeps the feed's rule: an event is shown to someone who may read
+// what it is about. Types with a drawer use the drawer's permission; mitigations,
+// reports and frameworks use the permission that guards their own pages;
+// governance records stay behind the audit permission. Technical records
+// (onboarding celebrations, notification reads, unnamed routes) are not part of
+// the journal for anyone; they remain in the audit trail.
+
+// Journal domains, the values of the `domain` filter and of TimelineEvent.Domain.
+const (
+	DomainRisk          = "risk"
+	DomainIncident      = "incident"
+	DomainVulnerability = "vulnerability"
+	DomainMitigation    = "mitigation"
+	DomainEvidence      = "evidence"
+	DomainCompliance    = "compliance"
+	DomainReport        = "report"
+	DomainAsset         = "asset"
+	DomainGovernance    = "governance"
+)
+
+// journalClass says how one audit entity type appears in the journal.
+type journalClass struct {
+	domain string
+	// drawer is set when the type opens a drawer: its permission and deep link
+	// come from the registry.
+	drawer Type
+	// perm and link serve types without a drawer.
+	perm string
+	link func(id string) string
+}
+
+func listLink(path string) func(string) string { return func(string) string { return path } }
+
+// journalClasses maps every audit entity type the journal shows. A type absent
+// from this map is not part of the journal.
+var journalClasses = map[string]journalClass{
+	"risk":                 {domain: DomainRisk, drawer: TypeRisk},
+	"incident":             {domain: DomainIncident, drawer: TypeIncident},
+	"incident_post_mortem": {domain: DomainIncident, perm: "incidents:read", link: listLink("/incidents")},
+	"vulnerability":        {domain: DomainVulnerability, drawer: TypeVulnerability},
+	"mitigation":           {domain: DomainMitigation, perm: "mitigations:read", link: listLink("/mitigations")},
+	"evidence":             {domain: DomainEvidence, drawer: TypeEvidence},
+	"control_evidence":     {domain: DomainEvidence, drawer: TypeEvidence},
+	"compliance_control":   {domain: DomainCompliance, drawer: TypeControl},
+	"control":              {domain: DomainCompliance, drawer: TypeControl},
+	"compliance_framework": {
+		domain: DomainCompliance, perm: "compliance:controls:read",
+		link: func(id string) string { return "/compliance/" + id },
+	},
+	"report":     {domain: DomainReport, perm: "compliance:controls:read", link: listLink("/reports")},
+	"report_job": {domain: DomainReport, perm: "compliance:controls:read", link: listLink("/reports")},
+	"board":      {domain: DomainReport, perm: "reports:board:read", link: listLink("/reports/board")},
+	"asset":      {domain: DomainAsset, drawer: TypeAsset},
+	// Governance: who may approve, delegate or automate. Audit permission only,
+	// as the feed has always done for entities with no drawer.
+	"approval_request":          {domain: DomainGovernance, perm: AuditPermission, link: listLink("/governance")},
+	"approval_workflow":         {domain: DomainGovernance, perm: AuditPermission, link: listLink("/governance")},
+	"automation_rule":           {domain: DomainGovernance, perm: AuditPermission, link: listLink("/automation")},
+	"automation_channel_config": {domain: DomainGovernance, perm: AuditPermission, link: listLink("/automation")},
+	"delegation":                {domain: DomainGovernance, perm: AuditPermission, link: listLink("/governance")},
+	"organization_member":       {domain: DomainGovernance, perm: AuditPermission, link: listLink("/settings/members")},
+	"invitation":                {domain: DomainGovernance, perm: AuditPermission, link: listLink("/settings/members")},
+	"mfa_policy":                {domain: DomainGovernance, perm: AuditPermission, link: listLink("/settings")},
+}
+
+// journalTypesFor returns the audit entity types of one domain, for the query.
+// Unknown domain → nil, ok false.
+func journalTypesFor(d string) ([]string, bool) {
+	var out []string
+	for et, cls := range journalClasses {
+		if cls.domain == d {
+			out = append(out, et)
+		}
+	}
+	return out, len(out) > 0
+}
+
+// visible reports whether the caller may see an event of this class.
+func (cls journalClass) visible(c Caller) bool {
+	if CanReadAudit(c) {
+		return true
+	}
+	if cls.drawer != "" {
+		return c.CanRead(cls.drawer)
+	}
+	return cls.perm != "" && c.Can(cls.perm)
+}
+
+// journalEvent projects an audit row into a journal entry, or false when the
+// row is not part of the journal.
+func journalEvent(e domain.AuditEvent) (TimelineEvent, journalClass, bool) {
+	cls, ok := journalClasses[e.EntityType]
+	if !ok {
+		return TimelineEvent{}, cls, false
+	}
+	ev := auditToTimeline(e)
+	ev.Domain = cls.domain
+	ev.Object = objectLabel(e)
+	if cls.drawer != "" {
+		ev.Target = Ref{Type: cls.drawer, ID: e.EntityID}
+		ev.TargetURL = DeepLink(cls.drawer, e.EntityID)
+	} else if cls.link != nil {
+		ev.TargetURL = cls.link(e.EntityID)
+	}
+	return ev, cls, true
+}
+
+var (
+	affectedSuffix = regexp.MustCompile(`\s*\(\d+ records? affected\)\s*$`)
+	quoted         = regexp.MustCompile(`"([^"]+)"`)
+	bareNumber     = regexp.MustCompile(`^\d+$`)
+)
+
+// objectLabel names the object of an entry: the record's own title or name when
+// the row carries it, else the name the summary quotes. Only that one field is
+// read from the snapshot; the reader is already cleared for the type, and the
+// summary itself states the same name.
+func objectLabel(e domain.AuditEvent) string {
+	for _, snap := range []domain.JSONMap{e.After, e.Before} {
+		for _, k := range []string{"title", "name", "file_name", "period_label"} {
+			if v, ok := snap[k].(string); ok && strings.TrimSpace(v) != "" {
+				return strings.TrimSpace(v)
+			}
+		}
+	}
+	s := affectedSuffix.ReplaceAllString(strings.TrimSpace(e.Summary), "")
+	if m := quoted.FindStringSubmatch(s); m != nil {
+		return m[1]
+	}
+	// "<action> <entity_type> <label>" is how both writers phrase it.
+	prefix := string(e.Action) + " " + e.EntityType + " "
+	if strings.HasPrefix(s, prefix) {
+		label := strings.TrimSpace(strings.TrimPrefix(s, prefix))
+		if _, err := uuid.Parse(label); err == nil || bareNumber.MatchString(label) {
+			return ""
+		}
+		return label
+	}
+	return ""
+}
+
+// twinWindow is how far apart the two writers' rows for one mutation may be.
+const twinWindow = 5 * time.Second
+
+// dropTwins removes the HTTP middleware's row when the model hook recorded the
+// same mutation: same type, entity and action, within a few seconds. The model
+// row is kept because it carries the record's fields. Input and output are in
+// the same order.
+func dropTwins(rows []domain.AuditEvent) []domain.AuditEvent {
+	type key struct{ et, id, action string }
+	model := map[key][]time.Time{}
+	for _, r := range rows {
+		if r.Source == "gorm" {
+			k := key{r.EntityType, r.EntityID, string(r.Action)}
+			model[k] = append(model[k], r.CreatedAt)
+		}
+	}
+	out := rows[:0:0]
+	for _, r := range rows {
+		if r.Source == "http" {
+			twin := false
+			for _, at := range model[key{r.EntityType, r.EntityID, string(r.Action)}] {
+				if d := r.CreatedAt.Sub(at); d < twinWindow && d > -twinWindow {
+					twin = true
+					break
+				}
+			}
+			if twin {
+				continue
+			}
+		}
+		out = append(out, r)
+	}
+	return out
+}
diff --git a/backend/internal/application/entity/journal_test.go b/backend/internal/application/entity/journal_test.go
new file mode 100644
index 000000000..213b07c6d
--- /dev/null
+++ b/backend/internal/application/entity/journal_test.go
@@ -0,0 +1,199 @@
+// Copyright (c) 2026 OpenDefender Contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+// This program is free software: you can redistribute it and/or modify it under
+// the terms of the GNU Affero General Public License v3.0 (see LICENSE).
+
+package entity
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/opendefender/openrisk/internal/domain"
+)
+
+// The tenant feed read as a journal (#905).
+
+type namedLookup struct {
+	fakeLookup
+	names map[uuid.UUID]string
+}
+
+func (n *namedLookup) NamesByIDs(_ context.Context, ids []uuid.UUID) (map[uuid.UUID]string, error) {
+	out := map[uuid.UUID]string{}
+	for _, id := range ids {
+		if v, ok := n.names[id]; ok {
+			out[id] = v
+		}
+	}
+	return out, nil
+}
+
+func journalWorld(t *testing.T) *world {
+	w := newWorld(t)
+	mit := auditEvent(w.tenantA, "mitigation", uuid.NewString(), domain.AuditActionCreate, at(6))
+	mit.Summary = "create mitigation Bastion d'administration (PAM)"
+	w.audit.events = []domain.AuditEvent{
+		auditEvent(w.tenantA, "risk", w.riskA.ID.String(), domain.AuditActionUpdate, at(7)),
+		mit,
+		auditEvent(w.tenantA, "report", uuid.NewString(), domain.AuditActionCreate, at(5)),
+		auditEvent(w.tenantA, "automation_rule", uuid.NewString(), domain.AuditActionUpdate, at(4)),
+		auditEvent(w.tenantA, "celebrated", uuid.NewString(), domain.AuditActionCreate, at(3)),
+		auditEvent(w.tenantA, "notification", uuid.NewString(), domain.AuditActionUpdate, at(2)),
+		auditEvent(w.tenantB, "mitigation", uuid.NewString(), domain.AuditActionCreate, at(8)),
+	}
+	return w
+}
+
+func domainsOf(events []TimelineEvent) []string {
+	out := make([]string, 0, len(events))
+	for _, e := range events {
+		out = append(out, e.Domain)
+	}
+	return out
+}
+
+func TestJournal_Success(t *testing.T) {
+	w := journalWorld(t)
+	page, err := w.svc.TenantTimeline(context.Background(), w.admin(w.tenantA), "", TimelineFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := domainsOf(page.Events)
+	want := []string{DomainRisk, DomainMitigation, DomainReport, DomainGovernance}
+	if len(got) != len(want) {
+		t.Fatalf("journal = %v, want %v (technical rows and tenant B stay out)", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("journal = %v, want %v", got, want)
+		}
+	}
+	m := page.Events[1]
+	if m.Object != "Bastion d'administration (PAM)" || m.TargetURL != "/mitigations" {
+		t.Errorf("mitigation entry = object %q link %q", m.Object, m.TargetURL)
+	}
+}
+
+// The domain filter is pushed into the query, so a filtered page is full.
+func TestJournal_FiltersByDomain(t *testing.T) {
+	w := journalWorld(t)
+	page, err := w.svc.TenantTimeline(context.Background(), w.admin(w.tenantA), "", TimelineFilter{Domain: DomainMitigation})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(page.Events) != 1 || page.Events[0].Domain != DomainMitigation {
+		t.Fatalf("mitigation filter returned %v", domainsOf(page.Events))
+	}
+	if !containsStr(w.audit.lastFilter.EntityTypes, "mitigation") {
+		t.Errorf("the domain did not reach the query: %v", w.audit.lastFilter.EntityTypes)
+	}
+}
+
+func TestJournal_NotFound(t *testing.T) {
+	w := journalWorld(t)
+	_, err := w.svc.TenantTimeline(context.Background(), w.admin(w.tenantA), "", TimelineFilter{Domain: "payroll"})
+	if !errors.Is(err, domain.ErrValidation) {
+		t.Fatalf("an unknown domain must be a validation error, got %v", err)
+	}
+}
+
+// Visibility follows the page each object belongs to.
+func TestJournal_Unauthorized(t *testing.T) {
+	w := journalWorld(t)
+
+	risksOnly, err := w.svc.TenantTimeline(context.Background(), callerIn(w.tenantA, "risks:read"), "", TimelineFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := domainsOf(risksOnly.Events); len(got) != 1 || got[0] != DomainRisk {
+		t.Fatalf("risks:read saw %v", got)
+	}
+
+	withMitigations, err := w.svc.TenantTimeline(context.Background(), callerIn(w.tenantA, "risks:read", "mitigations:read"), "", TimelineFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := domainsOf(withMitigations.Events); len(got) != 2 || got[1] != DomainMitigation {
+		t.Fatalf("mitigations:read saw %v", got)
+	}
+
+	if _, err := w.svc.TenantTimeline(context.Background(), Caller{}, "", TimelineFilter{}); !errors.Is(err, domain.ErrForbidden) {
+		t.Fatalf("a caller without a session must be refused, got %v", err)
+	}
+}
+
+// Two writers record one mutation; the journal shows it once, from the row
+// that carries the record.
+func TestJournal_MergesTheTwoWriters(t *testing.T) {
+	w := newWorld(t)
+	httpRow := auditEvent(w.tenantA, "incident", "5", domain.AuditActionCreate, at(3))
+	httpRow.Source = "http"
+	httpRow.Summary = "create incident 5"
+	modelRow := auditEvent(w.tenantA, "incident", "5", domain.AuditActionCreate, at(3).Add(-40*time.Millisecond))
+	modelRow.Source = "gorm"
+	modelRow.Summary = "create incident Indisponibilité du canal USSD"
+	modelRow.After = domain.JSONMap{"title": "Indisponibilité du canal USSD"}
+	later := auditEvent(w.tenantA, "incident", "5", domain.AuditActionCreate, at(9))
+	later.Source = "http"
+	w.audit.events = []domain.AuditEvent{httpRow, modelRow, later}
+
+	page, err := w.svc.TenantTimeline(context.Background(), w.admin(w.tenantA), "", TimelineFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(page.Events) != 2 {
+		t.Fatalf("got %v, want the model row and the unrelated later row", summariesOf(page.Events))
+	}
+	for _, e := range page.Events {
+		if e.Summary == "create incident 5" && e.OccurredAt.Equal(at(3)) {
+			t.Fatal("the HTTP twin survived")
+		}
+	}
+}
+
+func TestObjectLabel(t *testing.T) {
+	cases := []struct {
+		name string
+		e    domain.AuditEvent
+		want string
+	}{
+		{"title in the snapshot", domain.AuditEvent{After: domain.JSONMap{"title": "Rançongiciel"}, Summary: "update risk x"}, "Rançongiciel"},
+		{"name before deletion", domain.AuditEvent{Before: domain.JSONMap{"name": "Base clients"}}, "Base clients"},
+		{"quoted in the summary", domain.AuditEvent{Action: "defer", EntityType: "approval_request", Summary: `defer "Budget du PRA" to the next committee (2 records affected)`}, "Budget du PRA"},
+		{"writer phrasing", domain.AuditEvent{Action: "create", EntityType: "compliance_control", Summary: "create compliance_control Policies (94 records affected)"}, "Policies"},
+		{"a bare id is no name", domain.AuditEvent{Action: "create", EntityType: "incident", Summary: "create incident 5"}, ""},
+		{"a uuid is no name", domain.AuditEvent{Action: "create", EntityType: "board", Summary: "create board f590a0bb-85db-4a23-99e9-d083d2acf495"}, ""},
+	}
+	for _, c := range cases {
+		if got := objectLabel(c.e); got != c.want {
+			t.Errorf("%s: got %q, want %q", c.name, got, c.want)
+		}
+	}
+}
+
+func TestJournal_ActorsReadByName(t *testing.T) {
+	w := newWorld(t)
+	actor := uuid.New()
+	ev := auditEvent(w.tenantA, "risk", w.riskA.ID.String(), domain.AuditActionUpdate, at(1))
+	ev.ActorID = &actor
+	w.audit.events = []domain.AuditEvent{ev}
+	lookup := &namedLookup{
+		fakeLookup: fakeLookup{emails: map[uuid.UUID]string{actor: "fatou@a.example"}},
+		names:      map[uuid.UUID]string{actor: "Fatou Ndiaye"},
+	}
+	w.svc = w.svc.WithTimeline(NewTimelineService(w.audit).WithUserLookup(lookup))
+
+	page, err := w.svc.TenantTimeline(context.Background(), w.admin(w.tenantA), "", TimelineFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	a := page.Events[0].Actor
+	if a == nil || a.Label != "Fatou Ndiaye" || a.Email != "fatou@a.example" {
+		t.Fatalf("actor = %+v", a)
+	}
+}
diff --git a/backend/internal/application/entity/timeline.go b/backend/internal/application/entity/timeline.go
index 903aad7e3..78d492bab 100644
--- a/backend/internal/application/entity/timeline.go
+++ b/backend/internal/application/entity/timeline.go
@@ -57,6 +57,14 @@ type UserLookup interface {
 	EmailsByIDs(ctx context.Context, ids []uuid.UUID) (map[uuid.UUID]string, error)
 }
 
+// NameLookup resolves actor ids to display names (#905: the journal reads
+// "Fatou Ndiaye a…", not an address). Optional: a UserLookup that also
+// satisfies it is used; without it, or for a user with no name, the email
+// stays the label.
+type NameLookup interface {
+	NamesByIDs(ctx context.Context, ids []uuid.UUID) (map[uuid.UUID]string, error)
+}
+
 // TimelineService reads history. It owns no table.
 type TimelineService struct {
 	audit  domain.AuditEventRepository
@@ -240,27 +248,28 @@ func (s *TimelineService) ForTenant(ctx context.Context, c Caller, cursor string
 		return nil, err
 	}
 
+	var types []string
+	if f.Domain != "" {
+		ts, ok := journalTypesFor(f.Domain)
+		if !ok {
+			return nil, domain.NewValidationError("unknown domain " + f.Domain)
+		}
+		types = ts
+	}
+
 	// Over-read: the permission filter below removes rows, and a page that comes
 	// back empty because the caller could see none of the last 25 rows would look
 	// like the end of the feed.
-	raw, err := s.auditEvents(ctx, c.TenantID, nil, "", cur, (limit+1)*3, f)
+	raw, err := s.auditEvents(ctx, c.TenantID, types, "", cur, (limit+1)*3, f)
 	if err != nil {
 		return nil, err
 	}
 
-	seeAll := CanReadAudit(c)
 	candidates := make([]TimelineEvent, 0, len(raw))
-	for _, e := range raw {
-		t, known := typeForAuditEntity(e.EntityType)
-		if !seeAll {
-			if !known || !c.CanRead(t) {
-				continue
-			}
-		}
-		ev := auditToTimeline(e)
-		if known {
-			ev.Target = Ref{Type: t, ID: e.EntityID}
-			ev.TargetURL = DeepLink(t, e.EntityID)
+	for _, e := range dropTwins(raw) {
+		ev, cls, ok := journalEvent(e)
+		if !ok || !cls.visible(c) {
+			continue
 		}
 		candidates = append(candidates, ev)
 	}
@@ -414,6 +423,11 @@ func (s *TimelineService) resolveActors(ctx context.Context, events []TimelineEv
 	if err != nil {
 		return err
 	}
+	var names map[uuid.UUID]string
+	if nl, ok := s.lookup.(NameLookup); ok {
+		// A failing name read leaves the email as the label.
+		names, _ = nl.NamesByIDs(ctx, ids)
+	}
 	for i := range events {
 		if events[i].Actor == nil {
 			continue
@@ -426,6 +440,9 @@ func (s *TimelineService) resolveActors(ctx context.Context, events []TimelineEv
 			events[i].Actor.Email = email
 			events[i].Actor.Label = email
 		}
+		if name := strings.TrimSpace(names[id]); name != "" {
+			events[i].Actor.Label = name
+		}
 	}
 	return nil
 }
diff --git a/backend/internal/application/entity/types.go b/backend/internal/application/entity/types.go
index 11611b957..99bc3ea3c 100644
--- a/backend/internal/application/entity/types.go
+++ b/backend/internal/application/entity/types.go
@@ -338,6 +338,10 @@ type TimelineEvent struct {
 	// TargetURL deep-links the event's subject — this is what makes the tenant
 	// timeline navigable (§36).
 	TargetURL string `json:"target_url,omitempty"`
+	// Domain and Object make the tenant feed read as a journal (#905): which
+	// part of the product the event belongs to, and the object's name.
+	Domain string `json:"domain,omitempty"`
+	Object string `json:"object,omitempty"`
 }
 
 // TimelinePage is one cursor-paginated slice, newest first.
@@ -358,6 +362,10 @@ type TimelinePage struct {
 type TimelineFilter struct {
 	// Kind filters on the event verb (create/update/delete/...).
 	Kind string
+	// Domain filters the tenant feed to one journal domain (risk, incident,
+	// vulnerability, mitigation, evidence, compliance, report, asset,
+	// governance). #905.
+	Domain string
 	// ActorID filters to one actor.
 	ActorID *uuid.UUID
 	// Since / Until bound the window.
diff --git a/backend/internal/handler/entity_handler.go b/backend/internal/handler/entity_handler.go
index 2802179de..20f169fee 100644
--- a/backend/internal/handler/entity_handler.go
+++ b/backend/internal/handler/entity_handler.go
@@ -143,7 +143,10 @@ func (h *EntityHandler) GetCatalogue(c *fiber.Ctx) error {
 // because their actor id had a typo would read the result as "Alice did all of
 // this".
 func timelineFilterFrom(c *fiber.Ctx) (entity.TimelineFilter, error) {
-	f := entity.TimelineFilter{Kind: strings.TrimSpace(c.Query("kind"))}
+	f := entity.TimelineFilter{
+		Kind:   strings.TrimSpace(c.Query("kind")),
+		Domain: strings.TrimSpace(c.Query("domain")),
+	}
 
 	if v := strings.TrimSpace(c.Query("limit")); v != "" {
 		n, err := strconv.Atoi(v)
diff --git a/backend/internal/infrastructure/repository/gorm_user_repository.go b/backend/internal/infrastructure/repository/gorm_user_repository.go
index f42faae93..5f0c2bb62 100644
--- a/backend/internal/infrastructure/repository/gorm_user_repository.go
+++ b/backend/internal/infrastructure/repository/gorm_user_repository.go
@@ -48,6 +48,33 @@ func (r *GormUserRepository) GetByID(ctx context.Context, id uuid.UUID) (*domain
 // absent from the result. Backs the asset history "who" column
 // (assetapp.UserLookup); intentionally not tenant-scoped — a snapshot's
 // changed_by is already tenant-bound and users span organizations.
+// NamesByIDs returns the display names of the given users (#905). Users are
+// global rows; the ids come from the caller's own tenant-scoped audit rows, the
+// same gate as EmailsByIDs. A user without a name is left out.
+func (r *GormUserRepository) NamesByIDs(ctx context.Context, ids []uuid.UUID) (map[uuid.UUID]string, error) {
+	result := make(map[uuid.UUID]string, len(ids))
+	if len(ids) == 0 {
+		return result, nil
+	}
+	var rows []struct {
+		ID       uuid.UUID
+		FullName string
+	}
+	if err := r.db.WithContext(ctx).
+		Model(&domain.User{}).
+		Select("id", "full_name").
+		Where("id IN ?", ids).
+		Find(&rows).Error; err != nil {
+		return nil, err
+	}
+	for _, row := range rows {
+		if row.FullName != "" {
+			result[row.ID] = row.FullName
+		}
+	}
+	return result, nil
+}
+
 func (r *GormUserRepository) EmailsByIDs(ctx context.Context, ids []uuid.UUID) (map[uuid.UUID]string, error) {
 	result := make(map[uuid.UUID]string, len(ids))
 	if len(ids) == 0 {

From 78b0afa48499ac4ea028348f4c308dd4c2a5bfa0 Mon Sep 17 00:00:00 2001
From: alex-dembele <alexandredembele16@gmail.com>
Date: Fri, 9 Oct 2026 12:34:59 +0100
Subject: [PATCH 2/6] fix(audit): honour the entity-type list when reading the
 chain (#905)

The audit-chain repository, which every timeline reads in production,
ignored AuditEventFilter.EntityTypes. The Activity page's domain filter
came back unfiltered, and an entity timeline that asks for two names of
one type (compliance_control and control) also matched any other type
sharing the id. Incidents use sequential ids, so "incident 5" could pick
up another type's row numbered 5. The older audit repository applied
the list; the chain one now does too. The timeline unit tests use a fake
that honoured the list, which is why they never failed; a repository
test now covers it.

Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
---
 .../audit_chain_entity_types_test.go          |  55 +++++++++
 .../repository/gorm_audit_chain_repository.go |   4 +
 .../entity-drawer/GlobalTimelinePage.tsx      | 116 ------------------
 3 files changed, 59 insertions(+), 116 deletions(-)
 create mode 100644 backend/internal/infrastructure/repository/audit_chain_entity_types_test.go
 delete mode 100644 frontend/src/features/entity-drawer/GlobalTimelinePage.tsx

diff --git a/backend/internal/infrastructure/repository/audit_chain_entity_types_test.go b/backend/internal/infrastructure/repository/audit_chain_entity_types_test.go
new file mode 100644
index 000000000..fe4cc85ac
--- /dev/null
+++ b/backend/internal/infrastructure/repository/audit_chain_entity_types_test.go
@@ -0,0 +1,55 @@
+// Copyright (c) 2026 OpenDefender Contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+// This program is free software: you can redistribute it and/or modify it under
+// the terms of the GNU Affero General Public License v3.0 (see LICENSE).
+
+package repository
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"github.com/opendefender/openrisk/internal/domain"
+)
+
+// The timeline asks the trail for several entity types at once: a control is
+// recorded as "compliance_control" by one writer and "control" by the other,
+// and the Activity page filters by domain (#905). The chain repository — the
+// one production reads — ignored EntityTypes, so a filtered feed came back
+// unfiltered, and an incident's history (sequential ids like "5") could pick
+// up another type's row with the same id.
+func TestAuditChainList_FiltersByEntityTypes(t *testing.T) {
+	db := newGovernanceDB(t)
+	repo := NewGormAuditChainRepository(db)
+	ctx := context.Background()
+	tenant := uuid.New()
+	for _, et := range []string{"incident", "mitigation", "control", "compliance_control", "risk"} {
+		e := &domain.AuditEvent{TenantID: tenant, Action: domain.AuditActionCreate, EntityType: et, EntityID: "5", Summary: "create " + et}
+		if err := repo.Append(ctx, e); err != nil {
+			t.Fatalf("append %s: %v", et, err)
+		}
+	}
+
+	got, _, err := repo.List(ctx, tenant, domain.AuditEventFilter{EntityTypes: []string{"control", "compliance_control"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("got %d rows for two control types, want 2", len(got))
+	}
+	for _, e := range got {
+		if e.EntityType != "control" && e.EntityType != "compliance_control" {
+			t.Fatalf("a %s row came through the control filter", e.EntityType)
+		}
+	}
+
+	one, _, err := repo.List(ctx, tenant, domain.AuditEventFilter{EntityTypes: []string{"incident"}, EntityID: "5"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(one) != 1 || one[0].EntityType != "incident" {
+		t.Fatalf("incident 5's history picked up other types: %d rows", len(one))
+	}
+}
diff --git a/backend/internal/infrastructure/repository/gorm_audit_chain_repository.go b/backend/internal/infrastructure/repository/gorm_audit_chain_repository.go
index b6b4b9b97..20b94cfd1 100644
--- a/backend/internal/infrastructure/repository/gorm_audit_chain_repository.go
+++ b/backend/internal/infrastructure/repository/gorm_audit_chain_repository.go
@@ -140,6 +140,10 @@ func (r *GormAuditChainRepository) filtered(ctx context.Context, tenantID uuid.U
 	if f.EntityType != "" {
 		q = q.Where("entity_type = ?", f.EntityType)
 	}
+	if len(f.EntityTypes) > 0 {
+		// Chained on the tenant_id filter of q above.
+		q = q.Where("entity_type IN ?", f.EntityTypes)
+	}
 	if f.EntityID != "" {
 		q = q.Where("entity_id = ?", f.EntityID)
 	}
diff --git a/frontend/src/features/entity-drawer/GlobalTimelinePage.tsx b/frontend/src/features/entity-drawer/GlobalTimelinePage.tsx
deleted file mode 100644
index c333619d2..000000000
--- a/frontend/src/features/entity-drawer/GlobalTimelinePage.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-// Copyright (c) 2026 OpenDefender Contributors
-// SPDX-License-Identifier: AGPL-3.0-only
-//
-// The Global Timeline (W1-02 §35-§36).
-//
-// One tenant-wide feed of what actually happened, built from the canonical audit
-// trail. It answers the question no single register can: "what changed here
-// today, and who changed it" — across risks, assets, findings, controls,
-// incidents and evidence at once.
-//
-// Two properties make it more than a log viewer:
-//
-//   - Every row deep-links to its subject's drawer. Reading the feed and
-//     investigating what you find are the same gesture (§36).
-//   - It is RBAC-filtered server-side. A caller sees an event only if they may
-//     read the kind of thing it is about; events about entities with no drawer
-//     (automation rules, delegations) are governance surface and reach only a
-//     holder of the audit permission. A page can therefore come back shorter
-//     than its limit — that is the filter working, not a bug.
-//
-// It is not the audit trail. It carries no before/after snapshots; that is
-// /governance/audit-trail, behind its own permission (§23).
-
-import { useMemo, useState } from 'react';
-import { History } from 'lucide-react';
-import { Button, ErrorState, SkeletonRows } from '../../shared/ds';
-import { EmptyState } from '../../shared/EmptyState';
-import { useDrawerController } from './drawerState';
-import { TimelineSection } from './sections/TimelineSection';
-import { useUIStrings } from '../../shared/uiStrings';
-import { useTenantTimeline } from './useEntityDrawer';
-
-/** The verbs worth filtering by. Deliberately short: §22 warns against adding
- *  filter machinery nobody asked for, and these four cover the real questions
- *  ("what was created today", "what was deleted"). */
-const KINDS = [
-  { id: '', labelKey: 'act_all' },
-  { id: 'create', labelKey: 'act_created' },
-  { id: 'update', labelKey: 'act_updated' },
-  { id: 'delete', labelKey: 'act_deleted' },
-] as const;
-
-export function GlobalTimelinePage() {
-  const L = useUIStrings();
-  const [kind, setKind] = useState('');
-  const feed = useTenantTimeline(kind || undefined);
-  const { open } = useDrawerController();
-
-  const events = useMemo(() => feed.data?.pages.flatMap((p) => p.events) ?? [], [feed.data]);
-
-  return (
-    <div className="mx-auto flex w-full max-w-3xl flex-col gap-5 overflow-y-auto px-5 py-6">
-      <header className="flex flex-wrap items-start justify-between gap-3">
-        <div>
-          <h1 className="flex items-center gap-2 text-lg font-semibold text-fg-primary">
-            <History size={18} aria-hidden />
-            {L.act_title}
-          </h1>
-          <p className="mt-1 max-w-[60ch] text-sm text-fg-secondary">{L.act_intro}</p>
-        </div>
-      </header>
-
-      <div className="flex flex-wrap gap-1.5" role="group" aria-label={L.act_filterLabel}>
-        {KINDS.map((k) => (
-          <Button
-            key={k.id || 'all'}
-            variant={kind === k.id ? 'secondary' : 'ghost'}
-            size="sm"
-            aria-pressed={kind === k.id}
-            onClick={() => setKind(k.id)}
-          >
-            {L[k.labelKey]}
-          </Button>
-        ))}
-      </div>
-
-      {feed.isError ? (
-        <ErrorState
-          title={L.act_loadFailed}
-          description={L.ed_retryDesc}
-          onRetry={() => void feed.refetch()}
-        />
-      ) : feed.isLoading ? (
-        <SkeletonRows rows={8} />
-      ) : events.length === 0 ? (
-        <EmptyState
-          variant={kind ? 'no-results' : 'first-use'}
-          title={kind ? L.act_emptyFiltered : L.act_emptyNone}
-          description={kind ? L.act_emptyFilteredDesc : L.act_emptyNoneDesc}
-          primaryAction={
-            kind ? (
-              <Button variant="secondary" size="sm" onClick={() => setKind('')}>
-                {L.act_clearFilter}
-              </Button>
-            ) : undefined
-          }
-        />
-      ) : (
-        <TimelineSection
-          events={events}
-          isLoading={false}
-          error={null}
-          hasMore={!!feed.hasNextPage}
-          isLoadingMore={feed.isFetchingNextPage}
-          onLoadMore={() => void feed.fetchNextPage()}
-          onRetry={() => void feed.refetch()}
-          // This is what makes the feed navigable: an event's subject is not the
-          // record you are already looking at, so each row can open its own.
-          onOpenTarget={open}
-        />
-      )}
-    </div>
-  );
-}
-
-export default GlobalTimelinePage;

From 1659e1a748ce8eec3a357529d6b5d42e5cf020e8 Mon Sep 17 00:00:00 2001
From: alex-dembele <alexandredembele16@gmail.com>
Date: Fri, 9 Oct 2026 12:40:42 +0100
Subject: [PATCH 3/6] fix(timeline): keep who acted when merging twin audit
 rows (#905)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The journal keeps the model hook's row of a mutation and drops the HTTP
middleware's twin. The model row can carry no actor, so incidents read
"OpenRisk a créé l'incident …" when a person had created them. The
actor now moves from the dropped twin onto the kept row. Approval
entries also name the request rather than the circuit step ("approve
step "Comité" of "Prolongation…""), and "submitted … for approval: X"
yields X.

Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
---
 .../internal/application/entity/journal.go    | 54 ++++++++++++-------
 .../application/entity/journal_test.go        |  7 +++
 2 files changed, 42 insertions(+), 19 deletions(-)

diff --git a/backend/internal/application/entity/journal.go b/backend/internal/application/entity/journal.go
index b78dd4d25..ac163352b 100644
--- a/backend/internal/application/entity/journal.go
+++ b/backend/internal/application/entity/journal.go
@@ -139,6 +139,7 @@ func journalEvent(e domain.AuditEvent) (TimelineEvent, journalClass, bool) {
 var (
 	affectedSuffix = regexp.MustCompile(`\s*\(\d+ records? affected\)\s*$`)
 	quoted         = regexp.MustCompile(`"([^"]+)"`)
+	forApproval    = regexp.MustCompile(`for approval: (.+)$`)
 	bareNumber     = regexp.MustCompile(`^\d+$`)
 )
 
@@ -155,8 +156,13 @@ func objectLabel(e domain.AuditEvent) string {
 		}
 	}
 	s := affectedSuffix.ReplaceAllString(strings.TrimSpace(e.Summary), "")
-	if m := quoted.FindStringSubmatch(s); m != nil {
-		return m[1]
+	// 'approve step "Comité" of "Prolongation…"': the object is the last name
+	// quoted, not the step.
+	if all := quoted.FindAllStringSubmatch(s, -1); len(all) > 0 {
+		return all[len(all)-1][1]
+	}
+	if m := forApproval.FindStringSubmatch(s); m != nil {
+		return strings.TrimSpace(m[1])
 	}
 	// "<action> <entity_type> <label>" is how both writers phrase it.
 	prefix := string(e.Action) + " " + e.EntityType + " "
@@ -175,32 +181,42 @@ const twinWindow = 5 * time.Second
 
 // dropTwins removes the HTTP middleware's row when the model hook recorded the
 // same mutation: same type, entity and action, within a few seconds. The model
-// row is kept because it carries the record's fields. Input and output are in
-// the same order.
+// row is kept because it carries the record's fields; the HTTP row knows who
+// acted, so its actor moves onto the model row when that one has none. Input
+// order is kept.
 func dropTwins(rows []domain.AuditEvent) []domain.AuditEvent {
 	type key struct{ et, id, action string }
-	model := map[key][]time.Time{}
-	for _, r := range rows {
+	rows = append([]domain.AuditEvent(nil), rows...)
+	model := map[key][]int{}
+	for i, r := range rows {
 		if r.Source == "gorm" {
 			k := key{r.EntityType, r.EntityID, string(r.Action)}
-			model[k] = append(model[k], r.CreatedAt)
+			model[k] = append(model[k], i)
 		}
 	}
-	out := rows[:0:0]
-	for _, r := range rows {
-		if r.Source == "http" {
-			twin := false
-			for _, at := range model[key{r.EntityType, r.EntityID, string(r.Action)}] {
-				if d := r.CreatedAt.Sub(at); d < twinWindow && d > -twinWindow {
-					twin = true
-					break
+	out := make([]domain.AuditEvent, 0, len(rows))
+	drop := make([]bool, len(rows))
+	for i, r := range rows {
+		if r.Source != "http" {
+			continue
+		}
+		for _, j := range model[key{r.EntityType, r.EntityID, string(r.Action)}] {
+			if d := r.CreatedAt.Sub(rows[j].CreatedAt); d < twinWindow && d > -twinWindow {
+				drop[i] = true
+				if rows[j].ActorID == nil && r.ActorID != nil {
+					rows[j].ActorID = r.ActorID
+					rows[j].ActorEmail = r.ActorEmail
+					rows[j].ActorType = r.ActorType
+					rows[j].ActorLabel = r.ActorLabel
 				}
+				break
 			}
-			if twin {
-				continue
-			}
 		}
-		out = append(out, r)
+	}
+	for i, r := range rows {
+		if !drop[i] {
+			out = append(out, r)
+		}
 	}
 	return out
 }
diff --git a/backend/internal/application/entity/journal_test.go b/backend/internal/application/entity/journal_test.go
index 213b07c6d..43a38a231 100644
--- a/backend/internal/application/entity/journal_test.go
+++ b/backend/internal/application/entity/journal_test.go
@@ -134,6 +134,8 @@ func TestJournal_MergesTheTwoWriters(t *testing.T) {
 	httpRow := auditEvent(w.tenantA, "incident", "5", domain.AuditActionCreate, at(3))
 	httpRow.Source = "http"
 	httpRow.Summary = "create incident 5"
+	actor := uuid.New()
+	httpRow.ActorID = &actor
 	modelRow := auditEvent(w.tenantA, "incident", "5", domain.AuditActionCreate, at(3).Add(-40*time.Millisecond))
 	modelRow.Source = "gorm"
 	modelRow.Summary = "create incident Indisponibilité du canal USSD"
@@ -153,6 +155,9 @@ func TestJournal_MergesTheTwoWriters(t *testing.T) {
 		if e.Summary == "create incident 5" && e.OccurredAt.Equal(at(3)) {
 			t.Fatal("the HTTP twin survived")
 		}
+		if e.Object == "Indisponibilité du canal USSD" && (e.Actor == nil || e.Actor.ID != actor.String()) {
+			t.Fatalf("the person who acted was lost in the merge: %+v", e.Actor)
+		}
 	}
 }
 
@@ -165,6 +170,8 @@ func TestObjectLabel(t *testing.T) {
 		{"title in the snapshot", domain.AuditEvent{After: domain.JSONMap{"title": "Rançongiciel"}, Summary: "update risk x"}, "Rançongiciel"},
 		{"name before deletion", domain.AuditEvent{Before: domain.JSONMap{"name": "Base clients"}}, "Base clients"},
 		{"quoted in the summary", domain.AuditEvent{Action: "defer", EntityType: "approval_request", Summary: `defer "Budget du PRA" to the next committee (2 records affected)`}, "Budget du PRA"},
+		{"the request, not the step", domain.AuditEvent{Action: "approve", EntityType: "approval_request", Summary: `approve step "Comité des risques" of "Prolongation de l'exception" → approved (2 records affected)`}, "Prolongation de l'exception"},
+		{"submitted for approval", domain.AuditEvent{Action: "submit", EntityType: "approval_request", Summary: "submitted risk_acceptance for approval: Acceptation du risque R-0115 (2 records affected)"}, "Acceptation du risque R-0115"},
 		{"writer phrasing", domain.AuditEvent{Action: "create", EntityType: "compliance_control", Summary: "create compliance_control Policies (94 records affected)"}, "Policies"},
 		{"a bare id is no name", domain.AuditEvent{Action: "create", EntityType: "incident", Summary: "create incident 5"}, ""},
 		{"a uuid is no name", domain.AuditEvent{Action: "create", EntityType: "board", Summary: "create board f590a0bb-85db-4a23-99e9-d083d2acf495"}, ""},

From 028947e081c73fe2c0c77b680675eba3d56c1ef8 Mon Sep 17 00:00:00 2001
From: alex-dembele <alexandredembele16@gmail.com>
Date: Fri, 9 Oct 2026 12:40:42 +0100
Subject: [PATCH 4/6] feat(activity): rebuild the Activity journal on the
 October 2026 redesign (#905)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The organisation's journal as the mockup lays it out: title and
subtitle, the Tout / Risques / Incidents / Vulnérabilités / Mitigations
/ Preuves / Conformité / Rapports pills (a server-side filter), entries
grouped by day (Aujourd'hui, Hier, then the date) on a vertical rail,
each with its avatar, the actor's name, the verb, the object in mono and
the time on the right. System entries carry the OpenRisk mark. Older
entries load when the end comes into view, or with the button.

Each entry is one sentence ("Fatou Ndiaye a créé la mitigation
Bastion d'administration (PAM)", "a changé le statut de la
vulnérabilité …"), built from the event's domain, verb and object in
fr/en. An object with a drawer opens it in place; others link to their
page. The dashboard's recent-activity card now reads the same sentence.

The previous page (W1-02 GlobalTimelinePage) and its create/update/
delete filter are replaced. The subtitle avoids the mockup's gendered
"autorisée".

Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
---
 frontend/src/App.tsx                          |   8 +-
 .../src/features/activity/ActivityPage.tsx    | 203 ++++++++++++++++
 .../activity/__tests__/activityPage.test.tsx  | 221 ++++++++++++++++++
 frontend/src/features/activity/journal.ts     |  98 ++++++++
 .../dashboard/console/RecentActivity.tsx      |  21 +-
 .../features/entity-drawer/entityService.ts   |   3 +-
 frontend/src/features/entity-drawer/types.ts  |   5 +
 .../features/entity-drawer/useEntityDrawer.ts |   7 +-
 frontend/src/locales/en.json                  |  59 +++++
 frontend/src/locales/fr.json                  |  59 +++++
 10 files changed, 671 insertions(+), 13 deletions(-)
 create mode 100644 frontend/src/features/activity/ActivityPage.tsx
 create mode 100644 frontend/src/features/activity/__tests__/activityPage.test.tsx
 create mode 100644 frontend/src/features/activity/journal.ts

diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 918613ffa..16ea18ab8 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -183,9 +183,9 @@ const FinancialDashboard = lazy(() =>
     default: m.FinancialDashboard,
   })),
 );
-const GlobalTimelinePage = lazy(() =>
-  import('./features/entity-drawer/GlobalTimelinePage').then((m) => ({
-    default: m.GlobalTimelinePage,
+const ActivityPage = lazy(() =>
+  import('./features/activity/ActivityPage').then((m) => ({
+    default: m.ActivityPage,
   })),
 );
 const AutomationPage = lazy(() =>
@@ -768,7 +768,7 @@ function App() {
             {/* The tenant-wide activity feed (W1-02). RBAC filtering is the
               server's, so any authenticated member may open it — they simply see
               only what they may read. */}
-            <Route path="activity" element={<GlobalTimelinePage />} />
+            <Route path="activity" element={<ActivityPage />} />
             <Route path="leaderboard" element={<LeaderboardPage />} />
 
             {/* ---------------- Reports ----------------
diff --git a/frontend/src/features/activity/ActivityPage.tsx b/frontend/src/features/activity/ActivityPage.tsx
new file mode 100644
index 000000000..ff385dc2e
--- /dev/null
+++ b/frontend/src/features/activity/ActivityPage.tsx
@@ -0,0 +1,203 @@
+// Copyright (c) 2026 OpenDefender Contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+//
+// Activity on the October 2026 redesign (#905): the organisation's journal,
+// filtered server-side to what the member may read. One sentence per entry
+// ("Fatou Ndiaye a créé la mitigation Bastion d'administration (PAM)"), grouped
+// by day on a vertical rail, with the time on the right. System entries carry
+// the product's mark. Older entries load when the end of the list scrolls into
+// view, or with the button.
+//
+// An object with a drawer opens it in place, so reading the journal and looking
+// into an entry are the same gesture; other objects link to their page.
+
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { Link } from 'react-router';
+
+import { useI18n } from '../../hooks/useI18n';
+import { formatDate, formatTime } from '../../i18n/format';
+import { OpenRiskLogo } from '../../shared/Logo';
+import { Button } from '../../shared/ds';
+import { PageFrame, PageHeader } from '../../shared/ui';
+import { BlockEmpty, BlockError, BlockSkeleton } from '../dashboard/console/Panel';
+import { useDrawerController } from '../entity-drawer/drawerState';
+import { isEntityType, type TimelineEvent } from '../entity-drawer/types';
+import { useTenantTimeline } from '../entity-drawer/useEntityDrawer';
+import {
+  JOURNAL_FILTERS,
+  groupByDay,
+  initialsOf,
+  phraseKeys,
+  relativeDay,
+  type JournalFilter,
+} from './journal';
+
+export function ActivityPage() {
+  const { t, locale } = useI18n();
+  const [filter, setFilter] = useState<JournalFilter>('');
+  const feed = useTenantTimeline(filter || undefined);
+  const events = useMemo(() => feed.data?.pages.flatMap((p) => p.events) ?? [], [feed.data]);
+  const days = useMemo(() => groupByDay(events), [events]);
+  const now = new Date();
+
+  // Load older entries as the end of the list comes into view.
+  const sentinel = useRef<HTMLDivElement | null>(null);
+  const { hasNextPage, isFetchingNextPage, fetchNextPage } = feed;
+  useEffect(() => {
+    const el = sentinel.current;
+    if (!el || !hasNextPage || typeof IntersectionObserver === 'undefined') return;
+    const io = new IntersectionObserver((entries) => {
+      if (entries.some((e) => e.isIntersecting) && !isFetchingNextPage) void fetchNextPage();
+    });
+    io.observe(el);
+    return () => io.disconnect();
+  }, [hasNextPage, isFetchingNextPage, fetchNextPage]);
+
+  const dayLabel = (key: string, sample: string) => {
+    const rel = relativeDay(sample, now);
+    if (rel) return t(`activity.${rel}`);
+    const sameYear = key.slice(0, 4) === String(now.getFullYear());
+    return formatDate(locale, sample, {
+      day: 'numeric',
+      month: 'short',
+      ...(sameYear ? {} : { year: 'numeric' }),
+    });
+  };
+
+  return (
+    <PageFrame>
+      <div className="mx-auto max-w-[900px]">
+        <PageHeader
+          className="!mb-[18px]"
+          title={t('activity.title')}
+          subtitle={t('activity.subtitle')}
+        />
+
+        <div
+          className="flex gap-1.5 flex-wrap mb-[22px]"
+          role="group"
+          aria-label={t('activity.filterLabel')}
+        >
+          {JOURNAL_FILTERS.map((f) => {
+            const on = f === filter;
+            return (
+              <button
+                key={f || 'all'}
+                type="button"
+                aria-pressed={on}
+                onClick={() => setFilter(f)}
+                data-testid={`act-filter-${f || 'all'}`}
+                className={`h-[30px] px-3 rounded-full border text-[12.5px] font-semibold transition-colors ${
+                  on
+                    ? 'bg-surface-3 border-border-strong text-ink'
+                    : 'bg-transparent border-border-default text-ink-soft hover:border-border-strong'
+                }`}
+              >
+                {t(`activity.filters.${f || 'all'}`)}
+              </button>
+            );
+          })}
+        </div>
+
+        {feed.isLoading ? (
+          <BlockSkeleton lines={8} height={28} />
+        ) : feed.isError ? (
+          <BlockError onRetry={() => void feed.refetch()} />
+        ) : events.length === 0 ? (
+          <div className="grid justify-items-start gap-2">
+            <BlockEmpty>{filter ? t('activity.emptyFiltered') : t('activity.empty')}</BlockEmpty>
+            {filter && (
+              <Button variant="secondary" size="sm" onClick={() => setFilter('')}>
+                {t('activity.showAll')}
+              </Button>
+            )}
+          </div>
+        ) : (
+          <>
+            {days.map((d) => (
+              <section key={d.day} className="mb-6" data-testid="act-day">
+                <h2 className="m-0 mb-1.5 text-[10.5px] tracking-[0.06em] uppercase font-semibold text-ink-muted">
+                  {dayLabel(d.day, d.events[0].occurred_at)}
+                </h2>
+                <ol className="list-none m-0 p-0 border-l border-border-default ml-[15px]">
+                  {d.events.map((e) => (
+                    <JournalEntry key={e.id} e={e} />
+                  ))}
+                </ol>
+              </section>
+            ))}
+            <div ref={sentinel} className="flex justify-center py-2">
+              {feed.hasNextPage ? (
+                <Button
+                  variant="secondary"
+                  size="sm"
+                  loading={feed.isFetchingNextPage}
+                  onClick={() => void feed.fetchNextPage()}
+                  data-testid="act-more"
+                >
+                  {feed.isFetchingNextPage ? t('activity.loadingMore') : t('activity.loadMore')}
+                </Button>
+              ) : (
+                <span className="text-[11.5px] text-ink-muted">{t('activity.end')}</span>
+              )}
+            </div>
+          </>
+        )}
+      </div>
+    </PageFrame>
+  );
+}
+
+function JournalEntry({ e }: { e: TimelineEvent }) {
+  const { t, locale } = useI18n();
+  const { open } = useDrawerController();
+  const system = !e.actor;
+  const who = e.actor?.label || e.actor?.email || t('activity.system');
+  const keys = phraseKeys(e);
+  const noun = keys.noun ? t(keys.noun) : '';
+  const object = e.object?.trim() || '';
+  const type = e.target.type;
+
+  const objectText = object || null;
+  const objectClass = 'mono text-[12.5px] text-accent hover:underline';
+  let objectNode = null;
+  if (objectText) {
+    if (type && isEntityType(type)) {
+      objectNode = (
+        <button type="button" className={objectClass} onClick={() => open(type, e.target.id)}>
+          {objectText}
+        </button>
+      );
+    } else if (e.target_url) {
+      objectNode = (
+        <Link to={e.target_url} className={objectClass}>
+          {objectText}
+        </Link>
+      );
+    } else {
+      objectNode = <span className="mono text-[12.5px] text-ink">{objectText}</span>;
+    }
+  }
+
+  return (
+    <li className="flex gap-3 items-start py-2 -ml-4" data-testid="act-entry">
+      <span
+        className="w-[31px] h-[31px] rounded-full bg-surface-1 border border-border-default flex items-center justify-center shrink-0 text-[10.5px] font-semibold text-ink-soft"
+        aria-hidden="true"
+        data-testid={system ? 'act-avatar-system' : 'act-avatar'}
+      >
+        {system ? <OpenRiskLogo size={15} className="text-accent" title="" /> : initialsOf(who)}
+      </span>
+      <span className="flex-1 min-w-0 text-[13px] leading-normal pt-[5px] text-ink-soft break-words">
+        <b className="text-ink font-semibold">{who}</b> {t(keys.verb)}
+        {noun ? ` ${noun}` : ''} {objectNode}
+      </span>
+      <time
+        dateTime={e.occurred_at}
+        className="mono text-[11.5px] text-ink-muted pt-[7px] shrink-0"
+      >
+        {formatTime(locale, e.occurred_at)}
+      </time>
+    </li>
+  );
+}
diff --git a/frontend/src/features/activity/__tests__/activityPage.test.tsx b/frontend/src/features/activity/__tests__/activityPage.test.tsx
new file mode 100644
index 000000000..f888ffef8
--- /dev/null
+++ b/frontend/src/features/activity/__tests__/activityPage.test.tsx
@@ -0,0 +1,221 @@
+// Copyright (c) 2026 OpenDefender Contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+//
+// The Activity journal of the redesign (#905), against GET /timeline.
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor, fireEvent, within } from '@testing-library/react';
+import { MemoryRouter } from 'react-router';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+
+import { useUIStore } from '../../../store/uiStore';
+import type { TimelineEvent, TimelinePage } from '../../entity-drawer/types';
+import { groupByDay, initialsOf, phraseKeys, relativeDay } from '../journal';
+
+const calls = vi.fn<(params: Record<string, unknown>) => void>();
+let pages: Record<string, TimelinePage> = {};
+let fail = false;
+
+vi.mock('../../../lib/api', () => ({
+  api: {
+    get: (url: string, cfg?: { params?: Record<string, unknown> }) => {
+      if (url === '/timeline') {
+        const params = cfg?.params ?? {};
+        calls(params);
+        if (fail) return Promise.reject(new Error('boom'));
+        const key = `${(params.domain as string) ?? ''}|${(params.cursor as string) ?? ''}`;
+        return Promise.resolve({ data: pages[key] ?? { events: [], sources: ['audit'] } });
+      }
+      return Promise.resolve({ data: {} });
+    },
+    post: () => Promise.resolve({ data: {} }),
+    interceptors: { request: { use: () => 0 }, response: { use: () => 0 } },
+  },
+  onMFARequired: () => () => undefined,
+}));
+
+import { ActivityPage } from '../ActivityPage';
+
+const NOW = new Date();
+function iso(daysAgo: number, h: number, m: number): string {
+  const d = new Date(NOW);
+  d.setDate(d.getDate() - daysAgo);
+  d.setHours(h, m, 0, 0);
+  return d.toISOString();
+}
+
+function ev(over: Partial<TimelineEvent>): TimelineEvent {
+  return {
+    id: Math.random().toString(36).slice(2),
+    kind: 'create',
+    occurred_at: iso(0, 9, 15),
+    actor: { id: 'u1', email: 'fatou@example.test', label: 'Fatou Ndiaye' },
+    target: { id: 't1' },
+    summary: '',
+    source: 'audit',
+    ...over,
+  };
+}
+
+function renderPage() {
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  return render(
+    <QueryClientProvider client={client}>
+      <MemoryRouter>
+        <ActivityPage />
+      </MemoryRouter>
+    </QueryClientProvider>,
+  );
+}
+
+beforeEach(() => {
+  calls.mockReset();
+  fail = false;
+  useUIStore.setState({ lang: 'fr' });
+  pages = {
+    '|': {
+      events: [
+        ev({
+          domain: 'mitigation',
+          object: "Bastion d'administration (PAM)",
+          target_url: '/mitigations',
+        }),
+        ev({
+          kind: 'update',
+          occurred_at: iso(0, 8, 5),
+          domain: 'risk',
+          object: 'Rançongiciel',
+          target: { type: 'risk', id: 'r1' },
+          changes: [{ field: 'status' }],
+        }),
+        ev({
+          actor: undefined,
+          occurred_at: iso(1, 17, 32),
+          domain: 'incident',
+          object: 'Indisponibilité du canal USSD',
+          target: { type: 'incident', id: 'i1' },
+        }),
+      ],
+      next_cursor: 'c2',
+      sources: ['audit'],
+    },
+    '|c2': {
+      events: [
+        ev({ occurred_at: iso(9, 14, 5), domain: 'report', object: 'Comité des risques — T3' }),
+      ],
+      sources: ['audit'],
+    },
+    'mitigation|': {
+      events: [ev({ domain: 'mitigation', object: 'Segmentation réseau' })],
+      sources: ['audit'],
+    },
+  };
+});
+
+describe('#905 — wording helpers', () => {
+  it('builds the phrase from the verb, the domain and status changes', () => {
+    expect(phraseKeys(ev({ domain: 'risk' }))).toEqual({
+      verb: 'activity.verb.create',
+      noun: 'activity.noun.risk',
+    });
+    expect(
+      phraseKeys(ev({ kind: 'update', domain: 'risk', changes: [{ field: 'status' }] })),
+    ).toEqual({
+      verb: 'activity.verb.status',
+      noun: 'activity.nounAfterDe.risk',
+    });
+    expect(phraseKeys(ev({ kind: 'escalate', domain: 'nope' }))).toEqual({
+      verb: 'activity.verb.fallback',
+      noun: null,
+    });
+  });
+
+  it('groups by local day and names today and yesterday', () => {
+    const g = groupByDay([
+      ev({ occurred_at: iso(0, 9, 0) }),
+      ev({ occurred_at: iso(0, 8, 0) }),
+      ev({ occurred_at: iso(1, 9, 0) }),
+    ]);
+    expect(g.map((d) => d.events.length)).toEqual([2, 1]);
+    expect(relativeDay(iso(0, 1, 0), NOW)).toBe('today');
+    expect(relativeDay(iso(1, 1, 0), NOW)).toBe('yesterday');
+    expect(relativeDay(iso(4, 1, 0), NOW)).toBeNull();
+  });
+
+  it('takes initials from a name or an address', () => {
+    expect(initialsOf('Fatou Ndiaye')).toBe('FN');
+    expect(initialsOf('admin@opendefender.io')).toBe('AD');
+    expect(initialsOf('jean-marc.ekotto@x.io')).toBe('JM');
+  });
+});
+
+describe('#905 — Activity page', () => {
+  it('reads each entry as a sentence, grouped by day', async () => {
+    renderPage();
+    const entries = await screen.findAllByTestId('act-entry');
+    expect(entries[0]).toHaveTextContent(
+      "Fatou Ndiaye a créé la mitigation Bastion d'administration (PAM)",
+    );
+    expect(entries[0]).toHaveTextContent('FN');
+    expect(entries[1]).toHaveTextContent('a changé le statut du risque Rançongiciel');
+    const days = screen.getAllByTestId('act-day');
+    expect(within(days[0]).getByRole('heading')).toHaveTextContent("Aujourd'hui");
+    expect(within(days[1]).getByRole('heading')).toHaveTextContent('Hier');
+  });
+
+  it('shows the product mark for system entries', async () => {
+    renderPage();
+    await screen.findAllByTestId('act-entry');
+    expect(screen.getAllByTestId('act-avatar-system')).toHaveLength(1);
+    expect(screen.getAllByTestId('act-entry')[2]).toHaveTextContent("OpenRisk a créé l'incident");
+  });
+
+  it('links objects without a drawer to their page', async () => {
+    renderPage();
+    const link = await screen.findByRole('link', { name: "Bastion d'administration (PAM)" });
+    expect(link).toHaveAttribute('href', '/mitigations');
+  });
+
+  it('loads older entries with the button', async () => {
+    renderPage();
+    fireEvent.click(await screen.findByTestId('act-more'));
+    expect(await screen.findByText('Comité des risques — T3')).toBeInTheDocument();
+    expect(screen.getByText('Début du journal')).toBeInTheDocument();
+    expect(calls).toHaveBeenCalledWith(expect.objectContaining({ cursor: 'c2' }));
+  });
+
+  it('filters by domain on the server', async () => {
+    renderPage();
+    await screen.findAllByTestId('act-entry');
+    fireEvent.click(screen.getByTestId('act-filter-mitigation'));
+    expect(await screen.findByText('Segmentation réseau')).toBeInTheDocument();
+    expect(calls).toHaveBeenCalledWith(expect.objectContaining({ domain: 'mitigation' }));
+    expect(screen.getByTestId('act-filter-mitigation')).toHaveAttribute('aria-pressed', 'true');
+  });
+
+  it('empty filter offers to show everything', async () => {
+    renderPage();
+    await screen.findAllByTestId('act-entry');
+    fireEvent.click(screen.getByTestId('act-filter-evidence'));
+    expect(
+      await screen.findByText("Rien dans cette catégorie pour l'instant."),
+    ).toBeInTheDocument();
+    fireEvent.click(screen.getByRole('button', { name: 'Tout afficher' }));
+    await waitFor(() => expect(screen.getAllByTestId('act-entry').length).toBeGreaterThan(0));
+  });
+
+  it('a failed load offers a retry', async () => {
+    fail = true;
+    renderPage();
+    expect(await screen.findByRole('alert')).toBeInTheDocument();
+  });
+});
+
+describe('#905 — governance entries', () => {
+  it('name their object without a noun', () => {
+    expect(phraseKeys(ev({ kind: 'defer', domain: 'governance' }))).toEqual({
+      verb: 'activity.verb.defer',
+      noun: null,
+    });
+  });
+});
diff --git a/frontend/src/features/activity/journal.ts b/frontend/src/features/activity/journal.ts
new file mode 100644
index 000000000..6073d2136
--- /dev/null
+++ b/frontend/src/features/activity/journal.ts
@@ -0,0 +1,98 @@
+// Copyright (c) 2026 OpenDefender Contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+//
+// How one journal entry reads (#905): "Fatou Ndiaye a créé la mitigation
+// Bastion d'administration (PAM)". Pure helpers so the wording is tested
+// without a browser.
+
+import type { TimelineEvent } from '../entity-drawer/types';
+
+/** The filter pills, in the design's order. '' is "Tout". */
+export const JOURNAL_FILTERS = [
+  '',
+  'risk',
+  'incident',
+  'vulnerability',
+  'mitigation',
+  'evidence',
+  'compliance',
+  'report',
+] as const;
+export type JournalFilter = (typeof JOURNAL_FILTERS)[number];
+
+const VERBS = new Set([
+  'create',
+  'update',
+  'delete',
+  'approve',
+  'reject',
+  'defer',
+  'submit',
+  'cancel',
+  'simulate',
+]);
+const DOMAINS = new Set([
+  'risk',
+  'incident',
+  'vulnerability',
+  'mitigation',
+  'evidence',
+  'compliance',
+  'report',
+  'asset',
+  'governance',
+]);
+
+/** The locale keys of the verb phrase and the noun that follows it. */
+export function phraseKeys(e: TimelineEvent): { verb: string; noun: string | null } {
+  // Governance objects name themselves ("Budget du PRA…"): no noun before them.
+  const domain = e.domain && DOMAINS.has(e.domain) && e.domain !== 'governance' ? e.domain : null;
+  if (e.kind === 'update' && e.changes?.some((c) => c.field === 'status')) {
+    return {
+      verb: 'activity.verb.status',
+      noun: domain ? `activity.nounAfterDe.${domain}` : null,
+    };
+  }
+  return {
+    verb: VERBS.has(e.kind) ? `activity.verb.${e.kind}` : 'activity.verb.fallback',
+    noun: domain ? `activity.noun.${domain}` : null,
+  };
+}
+
+/** Local calendar day of an instant, "2026-10-09". */
+export function dayKey(iso: string): string {
+  const d = new Date(iso);
+  const m = String(d.getMonth() + 1).padStart(2, '0');
+  const day = String(d.getDate()).padStart(2, '0');
+  return `${d.getFullYear()}-${m}-${day}`;
+}
+
+/** 'today' | 'yesterday' | null for any other day, relative to `now`. */
+export function relativeDay(iso: string, now: Date): 'today' | 'yesterday' | null {
+  const k = dayKey(iso);
+  if (k === dayKey(now.toISOString())) return 'today';
+  const y = new Date(now);
+  y.setDate(y.getDate() - 1);
+  if (k === dayKey(y.toISOString())) return 'yesterday';
+  return null;
+}
+
+/** Events grouped by local day, newest day first, order kept inside a day. */
+export function groupByDay(events: TimelineEvent[]): { day: string; events: TimelineEvent[] }[] {
+  const out: { day: string; events: TimelineEvent[] }[] = [];
+  for (const e of events) {
+    const k = dayKey(e.occurred_at);
+    const last = out[out.length - 1];
+    if (last && last.day === k) last.events.push(e);
+    else out.push({ day: k, events: [e] });
+  }
+  return out;
+}
+
+/** "Fatou Ndiaye" → "FN"; "admin@opendefender.io" → "AD". */
+export function initialsOf(label: string): string {
+  const base = label.includes('@') ? label.split('@')[0] : label;
+  const words = base.split(/[\s._-]+/).filter(Boolean);
+  if (words.length >= 2) return (words[0][0] + words[1][0]).toUpperCase();
+  return (words[0] ?? '?').slice(0, 2).toUpperCase();
+}
diff --git a/frontend/src/features/dashboard/console/RecentActivity.tsx b/frontend/src/features/dashboard/console/RecentActivity.tsx
index 7178d4b58..8c294dc08 100644
--- a/frontend/src/features/dashboard/console/RecentActivity.tsx
+++ b/frontend/src/features/dashboard/console/RecentActivity.tsx
@@ -3,14 +3,16 @@
 //
 // The last six events of the organisation's journal (#901), read from the same
 // feed as the Activity page (GET /timeline), already filtered server-side to
-// what the member may see. The wording of each event is the feed's own; the
-// Activity page issue (#905) owns making it read as a sentence.
+// what the member may see. Each entry reads as the Activity journal's sentence
+// (#905).
 
 import { Link } from 'react-router';
 import { useQuery } from '@tanstack/react-query';
 import { useI18n } from '../../../hooks/useI18n';
 import { formatTime } from '../../../i18n/format';
 import { fetchTenantTimeline } from '../../entity-drawer/entityService';
+import type { TimelineEvent } from '../../entity-drawer/types';
+import { phraseKeys } from '../../activity/journal';
 import { BlockEmpty, BlockError, BlockSkeleton, HeaderLink, Panel, PanelTitle } from './Panel';
 
 export function RecentActivity({ className = '' }: { className?: string }) {
@@ -21,6 +23,13 @@ export function RecentActivity({ className = '' }: { className?: string }) {
     staleTime: 30_000,
   });
   const events = feed.data?.events ?? [];
+  // The journal's own sentence (#905); the raw summary only for an entry the
+  // journal could not classify.
+  const phrase = (e: TimelineEvent) => {
+    if (!e.domain) return e.summary;
+    const k = phraseKeys(e);
+    return [t(k.verb), k.noun ? t(k.noun) : '', e.object ?? ''].filter(Boolean).join(' ');
+  };
 
   return (
     <Panel testId="dash-activity" className={`pb-1.5 ${className}`}>
@@ -48,13 +57,15 @@ export function RecentActivity({ className = '' }: { className?: string }) {
               {formatTime(locale, e.occurred_at)}
             </span>
             <span className="text-ink-soft min-w-0 break-words">
-              <b className="text-ink font-semibold">{e.actor?.label ?? t('dashboard.activity.system')}</b>{' '}
+              <b className="text-ink font-semibold">
+                {e.actor?.label ?? t('dashboard.activity.system')}
+              </b>{' '}
               {e.target_url ? (
                 <Link to={e.target_url} className="hover:underline">
-                  {e.summary}
+                  {phrase(e)}
                 </Link>
               ) : (
-                e.summary
+                phrase(e)
               )}
             </span>
           </div>
diff --git a/frontend/src/features/entity-drawer/entityService.ts b/frontend/src/features/entity-drawer/entityService.ts
index d4b78fd05..920011f1b 100644
--- a/frontend/src/features/entity-drawer/entityService.ts
+++ b/frontend/src/features/entity-drawer/entityService.ts
@@ -94,12 +94,13 @@ export function fetchAudit(
 
 /** The tenant-wide activity feed. */
 export function fetchTenantTimeline(
-  opts: { cursor?: string; limit?: number; kind?: string } = {},
+  opts: { cursor?: string; limit?: number; kind?: string; domain?: string } = {},
 ): Promise<TimelinePage> {
   return get<TimelinePage>('/timeline', {
     cursor: opts.cursor || undefined,
     limit: opts.limit,
     kind: opts.kind || undefined,
+    domain: opts.domain || undefined,
   });
 }
 
diff --git a/frontend/src/features/entity-drawer/types.ts b/frontend/src/features/entity-drawer/types.ts
index 0cbbf7ba4..31d9a8fb8 100644
--- a/frontend/src/features/entity-drawer/types.ts
+++ b/frontend/src/features/entity-drawer/types.ts
@@ -181,6 +181,11 @@ export interface TimelineEvent {
   changes?: TimelineChange[];
   source: TimelineSourceName;
   target_url?: string;
+  /** Journal domain (#905): risk, incident, vulnerability, mitigation,
+   *  evidence, compliance, report, asset, governance. */
+  domain?: string;
+  /** The object's name, when the journal knows it. */
+  object?: string;
 }
 
 export interface TimelinePage {
diff --git a/frontend/src/features/entity-drawer/useEntityDrawer.ts b/frontend/src/features/entity-drawer/useEntityDrawer.ts
index 82185f234..103a9e0b7 100644
--- a/frontend/src/features/entity-drawer/useEntityDrawer.ts
+++ b/frontend/src/features/entity-drawer/useEntityDrawer.ts
@@ -111,12 +111,13 @@ export function useEntityAudit(type: EntityType | null, id: string | null, enabl
 }
 
 /** The tenant-wide activity feed. */
-export function useTenantTimeline(kind?: string) {
+/** The organisation's journal, one journal domain or all of them (#905). */
+export function useTenantTimeline(domain?: string) {
   const tenant = useTenantKey();
   return useInfiniteQuery({
-    queryKey: [ENTITY_QUERY_ROOT, tenant, 'tenant-timeline', kind ?? 'all'] as const,
+    queryKey: [ENTITY_QUERY_ROOT, tenant, 'tenant-timeline', domain ?? 'all'] as const,
     queryFn: ({ pageParam }) =>
-      fetchTenantTimeline({ cursor: pageParam as string | undefined, limit: 30, kind }),
+      fetchTenantTimeline({ cursor: pageParam as string | undefined, limit: 30, domain }),
     initialPageParam: undefined as string | undefined,
     getNextPageParam: (last) => last.next_cursor || undefined,
     retry: false,
diff --git a/frontend/src/locales/en.json b/frontend/src/locales/en.json
index 8a079b4a5..95c7ea85b 100644
--- a/frontend/src/locales/en.json
+++ b/frontend/src/locales/en.json
@@ -1356,5 +1356,64 @@
       "residualAle": "Residual ALE",
       "avoided": "Loss avoided / yr:"
     }
+  },
+  "activity": {
+    "title": "Activity",
+    "subtitle": "The organisation's journal, filtered to what your rights let you see.",
+    "filterLabel": "Filter the journal",
+    "filters": {
+      "all": "All",
+      "risk": "Risks",
+      "incident": "Incidents",
+      "vulnerability": "Vulnerabilities",
+      "mitigation": "Mitigations",
+      "evidence": "Evidence",
+      "compliance": "Compliance",
+      "report": "Reports"
+    },
+    "today": "Today",
+    "yesterday": "Yesterday",
+    "system": "OpenRisk",
+    "verb": {
+      "create": "created",
+      "update": "updated",
+      "delete": "deleted",
+      "approve": "approved",
+      "reject": "rejected",
+      "defer": "deferred",
+      "submit": "submitted",
+      "cancel": "cancelled",
+      "simulate": "simulated",
+      "status": "changed the status of",
+      "fallback": "acted on"
+    },
+    "noun": {
+      "risk": "the risk",
+      "incident": "the incident",
+      "vulnerability": "the vulnerability",
+      "mitigation": "the mitigation",
+      "evidence": "the evidence",
+      "compliance": "the compliance item",
+      "report": "the report",
+      "asset": "the asset"
+    },
+    "nounAfterDe": {
+      "risk": "the risk",
+      "incident": "the incident",
+      "vulnerability": "the vulnerability",
+      "mitigation": "the mitigation",
+      "evidence": "the evidence",
+      "compliance": "the compliance item",
+      "report": "the report",
+      "asset": "the asset"
+    },
+    "loadMore": "Show older entries",
+    "loadingMore": "Loading…",
+    "end": "Start of the journal",
+    "loadError": "The journal could not be loaded.",
+    "retry": "Retry",
+    "empty": "Nothing yet. What happens in the organisation shows up here.",
+    "emptyFiltered": "Nothing in this category yet.",
+    "showAll": "Show everything"
   }
 }
diff --git a/frontend/src/locales/fr.json b/frontend/src/locales/fr.json
index 750a288da..fd1dea3d2 100644
--- a/frontend/src/locales/fr.json
+++ b/frontend/src/locales/fr.json
@@ -1356,5 +1356,64 @@
       "residualAle": "ALE résiduel",
       "avoided": "Perte évitée / an :"
     }
+  },
+  "activity": {
+    "title": "Activité",
+    "subtitle": "Journal de l'organisation, filtré selon ce que vos droits vous permettent de consulter.",
+    "filterLabel": "Filtrer le journal",
+    "filters": {
+      "all": "Tout",
+      "risk": "Risques",
+      "incident": "Incidents",
+      "vulnerability": "Vulnérabilités",
+      "mitigation": "Mitigations",
+      "evidence": "Preuves",
+      "compliance": "Conformité",
+      "report": "Rapports"
+    },
+    "today": "Aujourd'hui",
+    "yesterday": "Hier",
+    "system": "OpenRisk",
+    "verb": {
+      "create": "a créé",
+      "update": "a modifié",
+      "delete": "a supprimé",
+      "approve": "a approuvé",
+      "reject": "a rejeté",
+      "defer": "a reporté",
+      "submit": "a soumis",
+      "cancel": "a annulé",
+      "simulate": "a simulé",
+      "status": "a changé le statut",
+      "fallback": "a agi sur"
+    },
+    "noun": {
+      "risk": "le risque",
+      "incident": "l'incident",
+      "vulnerability": "la vulnérabilité",
+      "mitigation": "la mitigation",
+      "evidence": "la preuve",
+      "compliance": "l'élément de conformité",
+      "report": "le rapport",
+      "asset": "l'actif"
+    },
+    "nounAfterDe": {
+      "risk": "du risque",
+      "incident": "de l'incident",
+      "vulnerability": "de la vulnérabilité",
+      "mitigation": "de la mitigation",
+      "evidence": "de la preuve",
+      "compliance": "de l'élément de conformité",
+      "report": "du rapport",
+      "asset": "de l'actif"
+    },
+    "loadMore": "Afficher les entrées plus anciennes",
+    "loadingMore": "Chargement…",
+    "end": "Début du journal",
+    "loadError": "Le journal n'a pas pu être chargé.",
+    "retry": "Réessayer",
+    "empty": "Rien encore. Ce qui est fait dans l'organisation apparaît ici.",
+    "emptyFiltered": "Rien dans cette catégorie pour l'instant.",
+    "showAll": "Tout afficher"
   }
 }

From a9ec243748d05e883e686bbb2aa031bf22ad32d6 Mon Sep 17 00:00:00 2001
From: alex-dembele <alexandredembele16@gmail.com>
Date: Fri, 9 Oct 2026 13:00:09 +0100
Subject: [PATCH 5/6] docs(api): document the timeline endpoints (#905)

GET /timeline and GET /entities/{type}/{id}/timeline were missing from
the contract. Both are now described with their shared paging and
filter parameters (cursor, limit, kind, actor_id, since, until), the
tenant feed's domain filter, and the TimelinePage / TimelineEvent
schemas, including domain and object. The description states who sees
what: drawer permission, page permission for mitigations, reports and
frameworks, audit permission for governance records. TS types
regenerated. Redocly reports the same 60 errors and 28 warnings as
before, none on these paths.

Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
---
 docs/openapi.yaml                       | 199 ++++++++++++++++++++++
 frontend/src/types/openapi.generated.ts | 216 ++++++++++++++++++++++++
 2 files changed, 415 insertions(+)

diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 142a54e0e..71f258f28 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -885,6 +885,108 @@ paths:
         '404':
           description: Risk not found
 
+  /timeline:
+    get:
+      tags:
+        - Timeline
+      summary: The organisation's journal (tenant-wide activity feed)
+      description: >
+        Newest-first, cursor-paginated feed built from the audit trail. Each
+        event is shown only to a caller who may read what it is about: types
+        with a drawer use the drawer's read permission; mitigations, reports
+        and frameworks use the permission guarding their pages
+        (`mitigations:read`, `compliance:controls:read`, `reports:board:read`);
+        governance records need `governance:audit:read`. Technical audit rows
+        (onboarding, notification reads, unnamed routes) are not part of the
+        journal. A mutation recorded by both audit writers appears once. A page
+        can hold fewer events than `limit` after the permission filter; follow
+        `next_cursor` until it is absent.
+      operationId: getTenantTimeline
+      security:
+        - bearerAuth: []
+      parameters:
+        - $ref: '#/components/parameters/TimelineCursor'
+        - $ref: '#/components/parameters/TimelineLimit'
+        - name: domain
+          in: query
+          description: One journal domain.
+          schema:
+            type: string
+            enum: [risk, incident, vulnerability, mitigation, evidence, compliance, report, asset, governance]
+        - $ref: '#/components/parameters/TimelineKind'
+        - $ref: '#/components/parameters/TimelineActor'
+        - $ref: '#/components/parameters/TimelineSince'
+        - $ref: '#/components/parameters/TimelineUntil'
+      responses:
+        '200':
+          description: One page of the journal
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/TimelinePage'
+        '400':
+          description: Malformed cursor, limit, actor_id, since or until, or an unknown domain
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '401':
+          description: Unauthorized
+        '403':
+          description: No organization in the session
+
+  /entities/{type}/{id}/timeline:
+    get:
+      tags:
+        - Timeline
+      summary: One entity's history
+      description: >
+        The merged history of one record, newest first: its audit trail plus,
+        for a risk, score and status changes made by the score worker and, for
+        an incident, its own journal. Same event shape and paging as
+        `/timeline`. Field names that changed are listed; their values stay in
+        the audit trail behind `governance:audit:read`.
+      operationId: getEntityTimeline
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: type
+          in: path
+          required: true
+          schema:
+            type: string
+            enum: [asset, risk, vulnerability, finding, control, incident, vendor, evidence]
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+        - $ref: '#/components/parameters/TimelineCursor'
+        - $ref: '#/components/parameters/TimelineLimit'
+        - $ref: '#/components/parameters/TimelineKind'
+        - $ref: '#/components/parameters/TimelineActor'
+        - $ref: '#/components/parameters/TimelineSince'
+        - $ref: '#/components/parameters/TimelineUntil'
+      responses:
+        '200':
+          description: One page of the entity's history
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/TimelinePage'
+        '400':
+          description: Malformed cursor or filter
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '401':
+          description: Unauthorized
+        '403':
+          description: Not allowed to read this type
+        '404':
+          description: No such record in the caller's organization
+
   /analytics/financial:
     get:
       tags:
@@ -3632,6 +3734,34 @@ components:
         Never send it in the path or the query string.
       schema:
         type: string
+    TimelineCursor:
+      name: cursor
+      in: query
+      description: The previous page's next_cursor. Opaque.
+      schema: { type: string }
+    TimelineLimit:
+      name: limit
+      in: query
+      description: Page size, 1 to 100 (default 25).
+      schema: { type: integer, minimum: 1, maximum: 100, default: 25 }
+    TimelineKind:
+      name: kind
+      in: query
+      description: Only events with this verb (create, update, delete, …).
+      schema: { type: string }
+    TimelineActor:
+      name: actor_id
+      in: query
+      description: Only events by this user.
+      schema: { type: string, format: uuid }
+    TimelineSince:
+      name: since
+      in: query
+      schema: { type: string, format: date-time }
+    TimelineUntil:
+      name: until
+      in: query
+      schema: { type: string, format: date-time }
 
   schemas:
     # ========== ACTION CENTER (#429) ==========
@@ -6285,6 +6415,75 @@ components:
         code:
           type: string
           enum: [wrong_password, wrong_code, mfa_required_by_role, no_local_password, not_enrolled, too_many_attempts, rejected, internal]
+    TimelineActor:
+      type: object
+      properties:
+        id: { type: string, format: uuid }
+        email: { type: string }
+        label:
+          type: string
+          description: Display name when the user has one, else the email.
+    TimelineChange:
+      type: object
+      required: [field]
+      properties:
+        field: { type: string }
+    TimelineEvent:
+      type: object
+      required: [id, kind, occurred_at, target, summary, source]
+      properties:
+        id: { type: string }
+        kind:
+          type: string
+          description: The verb (create, update, delete, approve, reject, defer, submit, …).
+        occurred_at: { type: string, format: date-time }
+        actor:
+          description: Absent for an event no person performed.
+          allOf: [{ $ref: '#/components/schemas/TimelineActor' }]
+        target:
+          type: object
+          required: [id]
+          properties:
+            type:
+              type: string
+              description: Drawer type, when the object has a drawer.
+            id: { type: string }
+        summary:
+          type: string
+          description: The audit trail's own wording, in English.
+        changes:
+          type: array
+          description: Names of the fields that moved; no values.
+          items: { $ref: '#/components/schemas/TimelineChange' }
+        source:
+          type: string
+          enum: [audit, risk_history, incident_timeline, asset_snapshot]
+        target_url:
+          type: string
+          description: Where the object opens in the console.
+        domain:
+          type: string
+          enum: [risk, incident, vulnerability, mitigation, evidence, compliance, report, asset, governance]
+          description: Journal domain (tenant feed only).
+        object:
+          type: string
+          description: The object's name, when known (tenant feed only).
+    TimelinePage:
+      type: object
+      required: [events, sources]
+      properties:
+        events:
+          type: array
+          items: { $ref: '#/components/schemas/TimelineEvent' }
+        next_cursor:
+          type: string
+          description: Absent at the end of the history.
+        sources:
+          type: array
+          description: Which journals were consulted, even when one added nothing.
+          items:
+            type: string
+            enum: [audit, risk_history, incident_timeline, asset_snapshot]
     ErrorResponse:
       type: object
       properties:
diff --git a/frontend/src/types/openapi.generated.ts b/frontend/src/types/openapi.generated.ts
index a23b93c2d..7e6e2ceb5 100644
--- a/frontend/src/types/openapi.generated.ts
+++ b/frontend/src/types/openapi.generated.ts
@@ -347,6 +347,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/timeline": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The organisation's journal (tenant-wide activity feed)
+         * @description Newest-first, cursor-paginated feed built from the audit trail. Each event is shown only to a caller who may read what it is about: types with a drawer use the drawer's read permission; mitigations, reports and frameworks use the permission guarding their pages (`mitigations:read`, `compliance:controls:read`, `reports:board:read`); governance records need `governance:audit:read`. Technical audit rows (onboarding, notification reads, unnamed routes) are not part of the journal. A mutation recorded by both audit writers appears once. A page can hold fewer events than `limit` after the permission filter; follow `next_cursor` until it is absent.
+         */
+        get: operations["getTenantTimeline"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/entities/{type}/{id}/timeline": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * One entity's history
+         * @description The merged history of one record, newest first: its audit trail plus, for a risk, score and status changes made by the score worker and, for an incident, its own journal. Same event shape and paging as `/timeline`. Field names that changed are listed; their values stay in the audit trail behind `governance:audit:read`.
+         */
+        get: operations["getEntityTimeline"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/analytics/financial": {
         parameters: {
             query?: never;
@@ -3620,6 +3660,52 @@ export interface components {
             /** @enum {string} */
             code: "wrong_password" | "wrong_code" | "mfa_required_by_role" | "no_local_password" | "not_enrolled" | "too_many_attempts" | "rejected" | "internal";
         };
+        TimelineActor: {
+            /** Format: uuid */
+            id?: string;
+            email?: string;
+            /** @description Display name when the user has one, else the email. */
+            label?: string;
+        };
+        TimelineChange: {
+            field: string;
+        };
+        TimelineEvent: {
+            id: string;
+            /** @description The verb (create, update, delete, approve, reject, defer, submit, …). */
+            kind: string;
+            /** Format: date-time */
+            occurred_at: string;
+            /** @description Absent for an event no person performed. */
+            actor?: components["schemas"]["TimelineActor"];
+            target: {
+                /** @description Drawer type, when the object has a drawer. */
+                type?: string;
+                id: string;
+            };
+            /** @description The audit trail's own wording, in English. */
+            summary: string;
+            /** @description Names of the fields that moved; no values. */
+            changes?: components["schemas"]["TimelineChange"][];
+            /** @enum {string} */
+            source: "audit" | "risk_history" | "incident_timeline" | "asset_snapshot";
+            /** @description Where the object opens in the console. */
+            target_url?: string;
+            /**
+             * @description Journal domain (tenant feed only).
+             * @enum {string}
+             */
+            domain?: "risk" | "incident" | "vulnerability" | "mitigation" | "evidence" | "compliance" | "report" | "asset" | "governance";
+            /** @description The object's name, when known (tenant feed only). */
+            object?: string;
+        };
+        TimelinePage: {
+            events: components["schemas"]["TimelineEvent"][];
+            /** @description Absent at the end of the history. */
+            next_cursor?: string;
+            /** @description Which journals were consulted, even when one added nothing. */
+            sources: ("audit" | "risk_history" | "incident_timeline" | "asset_snapshot")[];
+        };
         ErrorResponse: {
             /** @example Invalid input */
             error?: string;
@@ -3633,6 +3719,16 @@ export interface components {
         VendorPathId: string;
         /** @description The opaque questionnaire token from the link's URL fragment (ADR 0004 D4). Never send it in the path or the query string. */
         VendorAssessmentToken: string;
+        /** @description The previous page's next_cursor. Opaque. */
+        TimelineCursor: string;
+        /** @description Page size, 1 to 100 (default 25). */
+        TimelineLimit: number;
+        /** @description Only events with this verb (create, update, delete, …). */
+        TimelineKind: string;
+        /** @description Only events by this user. */
+        TimelineActor: string;
+        TimelineSince: string;
+        TimelineUntil: string;
     };
     requestBodies: never;
     headers: never;
@@ -4663,6 +4759,126 @@ export interface operations {
             };
         };
     };
+    getTenantTimeline: {
+        parameters: {
+            query?: {
+                /** @description The previous page's next_cursor. Opaque. */
+                cursor?: components["parameters"]["TimelineCursor"];
+                /** @description Page size, 1 to 100 (default 25). */
+                limit?: components["parameters"]["TimelineLimit"];
+                /** @description One journal domain. */
+                domain?: "risk" | "incident" | "vulnerability" | "mitigation" | "evidence" | "compliance" | "report" | "asset" | "governance";
+                /** @description Only events with this verb (create, update, delete, …). */
+                kind?: components["parameters"]["TimelineKind"];
+                /** @description Only events by this user. */
+                actor_id?: components["parameters"]["TimelineActor"];
+                since?: components["parameters"]["TimelineSince"];
+                until?: components["parameters"]["TimelineUntil"];
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of the journal */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TimelinePage"];
+                };
+            };
+            /** @description Malformed cursor, limit, actor_id, since or until, or an unknown domain */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No organization in the session */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    getEntityTimeline: {
+        parameters: {
+            query?: {
+                /** @description The previous page's next_cursor. Opaque. */
+                cursor?: components["parameters"]["TimelineCursor"];
+                /** @description Page size, 1 to 100 (default 25). */
+                limit?: components["parameters"]["TimelineLimit"];
+                /** @description Only events with this verb (create, update, delete, …). */
+                kind?: components["parameters"]["TimelineKind"];
+                /** @description Only events by this user. */
+                actor_id?: components["parameters"]["TimelineActor"];
+                since?: components["parameters"]["TimelineSince"];
+                until?: components["parameters"]["TimelineUntil"];
+            };
+            header?: never;
+            path: {
+                type: "asset" | "risk" | "vulnerability" | "finding" | "control" | "incident" | "vendor" | "evidence";
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of the entity's history */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TimelinePage"];
+                };
+            };
+            /** @description Malformed cursor or filter */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Not allowed to read this type */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such record in the caller's organization */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     getFinancialSummary: {
         parameters: {
             query?: never;

From b638dd5051b3ca9977628d19e81d4e81e68c944e Mon Sep 17 00:00:00 2001
From: alex-dembele <alexandredembele16@gmail.com>
Date: Fri, 9 Oct 2026 13:00:09 +0100
Subject: [PATCH 6/6] docs(decisions): record D-069, the owner's review of the
 redesign epic (#899)

Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
---
 docs/DECISIONS.md | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md
index 1bcbdc8b3..b0d0d1d32 100644
--- a/docs/DECISIONS.md
+++ b/docs/DECISIONS.md
@@ -5,6 +5,36 @@ recommends, and surfaces these in the daily brief. Run `/decide` to clear them.
 
 ## Open
 
+### D-069 — Console redesign: the owner's review of the epic · decided 2026-10-09
+**Decided** — Comments on #899, applying to every child issue still open:
+- **A. Risk score, no ambiguity.** The frozen formula is never bent to the mockup (no
+  "sur 25"). One source of truth for the computation; one display format in the register,
+  the matrix, the risk detail and exports; inherent and residual scores always labelled
+  as such; automated tests on both the figures and how they are shown.
+- **B. Dashboard keeps role and period.** The role selector stays where switching really
+  changes the view (it does: counters and priorities differ per business role). The
+  period control stays, and applies consistently to every period-bound indicator without
+  recomputing scores over another window. Alerts form a compact stack under the title,
+  critical first: active P1 incident, security block (e.g. MFA obligation), onboarding or
+  configuration action.
+- **C. One shared Select.** A single design-system Select replaces native selects:
+  keyboard navigation and visible focus, search on long lists, disabled / loading / error
+  states, accessible labels, menus not clipped by containers, Escape closes without
+  losing the value. Shared by filters, infrastructure forms, roles and mitigation owners.
+- **D. Topology keeps its power.** Zoom and pan, search and centre on an asset, node
+  selection with details, critical assets distinguished, an accessible list/table of
+  dependencies. Labels adapt to zoom; details on hover or selection.
+- **E. AI and Threat Intel claim no certainty.** Threat Intel relevance is explained
+  (assets, CVEs, sector, sources). The AI assistant entry stays on recommendations with
+  the risk's context, and is never the sole justification of a risk or compliance
+  decision. IOC matches are absent or explicitly unavailable until log ingestion exists.
+- **Validation checklist** (16 items) posted on #899; every child PR checks itself
+  against it, including 1440 px, 1280 px and a narrow viewport.
+**Supersedes** — D-067's "the design's role switch is not built".
+**Consequence** — #901 merged without the role switch, the period control and the
+alert stack: tracked as a follow-up. The shared Select is its own issue, a prerequisite
+for #912, #913, #914 and #923. A, D and E are noted on #913, #907, #911 and #920.
+
 ### D-068 — Loss-exceedance curve: sample how often losses happen? · raised 2026-10-09
 
 **Raised by** — #904, tracked in #931. A change to the quantification model, so it is