ADR-003: Dual-Channel Observability, Cloud Logging Pipeline & 40-Year Pediatric Audit Retention

Status

ACCEPTED  2026-09-03

Context

High-throughput SaaS operations in healthcare and compounding pharmacy verticals generate massive volumes of operational logs (REST requests, Angular UI clicks, background jobs, serial scale weighings, thermal label prints). Ingestion of high-frequency telemetry directly into relational databases (PostgreSQL) causes severe IOPS degradation, database bloat, and operational latency.

Furthermore, medical compliance (LGPD, CFM Res. 1.821/2007, and ANVISA RDC 67/2007) requires strict audit trails. Under Brazilian Civil Law (Civil Code, Art. 198, I), the statute of limitations for legal claims does not run against minors until they reach the age of majority (18 years old). Consequently, forensic audit logs regarding pediatric treatments and formulations must be retained for at least 38 to 40 years to guarantee lifetime legal protection for partner clinics, doctors, and pharmacies.

Decision

1. Dual-Channel Observability Strategy:
   • Channel 1 (Operational Telemetry & Access Trails): High-frequency structured NDJSON logs generated via Serilog ([LoggerMessage] zero-allocation source generators) enriched ambiently by LogContext (TenantId, UserId, TraceId). Zero impact on PostgreSQL.
   • Channel 2 (Relational State Diffs): ACID transactional before/after entity diffs captured by GerciaDbContext strictly for domain entities annotated with the unified [Audit] attribute, persisted in core.audit_history.
2. Unified [Audit] Domain Attribute: Consolidate multiple legacy attributes ([AuditHistory], [AuditAccess], [Auditable]) into a single, clean [Audit] attribute in Gercia.BuildingBlocks.
3. Google Cloud Logging & Managed Log Router Pipeline: Application containers emit structured Serilog NDJSON logs directly to stdout. Google Cloud Logging captures this stream transparently, providing real-time log exploration in Cloud Logging Console, and automatically dispatches audit events to Google Cloud Storage via managed Log Router Sinks without running any local log shipping daemons.
4. 40-Year Immutable Archival & BigQuery Roadmap: Archive uncompressed NDJSON logs to gs://gercia-audit-logs/ in southamerica-east1 under a YYYY/MM/DD partition hierarchy with WORM Bucket Lock (40-year retention), guaranteeing future zero-ETL integration with Google BigQuery External Tables.

Consequences

• Positive: 0% database load/IOPS overhead on PostgreSQL for millions of operational and hardware log events.
• Positive: 100% legal forensic protection for pediatric and clinical claims spanning from birth to adulthood + 20-year CFM statutory limit.
• Positive: Forward-compatibility for future Google BigQuery analytics without requiring complex ingestion ETL pipelines.
• Positive: Clean, unified domain model using only [Audit] and [Encrypted] attributes.
• Mitigation: Requires configuring Cloud Logging Log Router Sinks and Google Cloud Storage bucket IAM bindings with zero host daemon maintenance.