Follow one action across its evidence
Wildo carries available request correlation into audit events, logs and errors. Investigators can follow the effects of one action without reconstructing the sequence from timestamps alone.
The originating surface adds context, while browser-installation correlation is an explicit application choice.
Example — Follow one action across its evidence
A request changes a parent record and its children. Their audit events share correlation, allowing the reviewer to inspect that action as one sequence.
For engineers
The HTTP boundary establishes request context. _createAuditLog prefers the explicitly supplied execution context’s correlation ID, then the ambient request frame:
const requestFrame = getRequestContextFrame();
const correlationId = requestExecutionContext?.correlationId ?? requestFrame?.correlationId;
const frontendServiceName = requestFrame?.frontendServiceName;
These exact source lines are selected from audit-logs.backend.service.ts. Available fields are added to the record and the export envelope. Internal jobs can carry their own correlation context; a request-only surface field need not exist for background activity.
Use the declared correlationId filter on audit list/search to collect related events. Preserve the execution context through custom service work rather than creating an unrelated context for each child action.
Choose browser correlation deliberately
The shared application configuration accepts this selected fragment:
compliance: {
clientInstanceIdScope: ClientInstanceIdScope.SESSION,
},
ClientInstanceIdScope comes from the shared model vocabulary. DISABLED collects no installation identifier; SESSION uses session storage; PERSISTENT survives browser restarts and sign-outs. The request-ingestion boundary enforces the configured choice before the field reaches audit consumers.
Choose the mode according to the application’s privacy and investigation policy. Correlation is supporting evidence, not proof that two requests came from the same human, and it never supplies authorization.