Log schema versioned for regulatory changes

When a regulator examines records from 5 years ago, they need to understand what the log schema meant at that time — whether status meant HTTP status or business status, whether amount was in cents or dollars, whether a column that now exists was absent in earlier records. Without schema versioning, there is no authoritative answer to those questions. NIST 800-53 AU-3 requires audit records to contain sufficient information to establish what happened, which extends to the schema definitions that give field values their meaning. SOX §404 internal control assessments assume that the design of a control is stable and documented — an undocumented schema change is a gap in that documentation. FINRA Rule 4511 requires that books and records be available in a form that permits examination; records whose column semantics have shifted without documentation cannot be reliably examined.

Create an audit_schema_versions table and insert a record for every migration that modifies transaction_logs, in db/migrations/ or supabase/migrations/:

CREATE TABLE audit_schema_versions (
  version       INTEGER PRIMARY KEY,
  applied_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  changelog     TEXT NOT NULL,
  regulatory_reason TEXT
);

INSERT INTO audit_schema_versions (version, changelog, regulatory_reason) VALUES
  (1, 'Initial: id, timestamp, user_id, operation_type, amount, currency',
      'SOX §404 baseline — AU-3 required fields'),
  (2, 'Added balance_before, balance_after',
      'FINRA 4511 — reconciliation support'),
  (3, 'Added entry_hash, previous_hash',
      'PCI-DSS 4.0 Req-10.3.3 — tamper evidence');

ALTER TABLE transaction_logs ADD COLUMN schema_version INTEGER NOT NULL DEFAULT 3;

When applying future migrations, always include an INSERT INTO audit_schema_versions as part of the same migration file so version tracking stays in sync with schema state. Add schema_version as a column in the exported audit log (see finserv-audit-trail.retention-compliance.export-completeness) so regulators can identify which schema applies to each record.