---
description: Add an audit-log event end to end - the events.md catalogue key, the category_for mapping, and the recorder call at the mutation point.
argument-hint: <event.key for which mutation>
allowed-tools: Read, Grep, Edit, Bash(python *)
---
Add the audit event for: **$ARGUMENTS**

Follow the audit-log design (`devplacepy/services/audit/`); confirm against the source first.

1. Pick or extend the event key in `events.md` (the authoritative catalogue at the repo root) in the correct domain.
2. If it is a NEW domain, extend `category_for` in `devplacepy/services/audit/categories.py`.
3. Call the recorder on the mutation's success path: `audit.record(request, event_key, ...)` in HTTP or WebSocket handlers, or `audit.record_system(event_key, ...)` in request-less contexts (services, jobs, CLI). On a guard or denial branch pass `result="denied"`; on a failure branch pass `result="failure"`.
4. Route through the existing DRY choke point when one applies (`content.py`, the `project_files.py` helpers, `routers/containers.py` `_audit_instance`, the Devii dispatcher `_audit_mechanic`) instead of scattering call sites. The HTTP path and the Devii path for one mutation must stay disjoint (no double counting).
5. Recording is best-effort: wrap nothing the caller depends on, and NEVER gate the audited action on the record succeeding.
6. Validate with `hawk` on the touched files and `python -c "from devplacepy.main import app"`.
