From a57b367fe5a8772b9d15cdfffa109db35c1e7112 Mon Sep 17 00:00:00 2001
From: Saravana Achu Mac <saravanakumardb1@gmail.com>
Date: Sat, 4 Apr 2026 11:19:25 -0700
Subject: [PATCH] feat(cowork-service): prefer canonical audit event ids

---
 .../src/modules/agent-runtime/routes.test.ts  |  6 ++++--
 .../src/modules/agent-runtime/routes.ts       | 21 +++++++++++++++----
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/services/cowork-service/src/modules/agent-runtime/routes.test.ts b/services/cowork-service/src/modules/agent-runtime/routes.test.ts
index fb673453..a432bd3f 100644
--- a/services/cowork-service/src/modules/agent-runtime/routes.test.ts
+++ b/services/cowork-service/src/modules/agent-runtime/routes.test.ts
@@ -164,6 +164,7 @@ describe('agent runtime routes', () => {
               action: 'approval_granted',
               timestamp: '2026-04-04T09:00:00.000Z',
               details: {
+                eventId: 'evt_cowork_approval_1',
                 taskId: 'task-1',
                 sessionId: 'sess-1',
                 tool: 'rm',
@@ -182,7 +183,7 @@ describe('agent runtime routes', () => {
     expect(res.statusCode).toBe(200);
     const body = JSON.parse(res.payload);
     expect(body.approvals[0]).toMatchObject({
-      approvalId: 'audit-1',
+      approvalId: 'evt_cowork_approval_1',
       sessionId: 'sess-1',
       runId: 'task-1',
       status: 'approved',
@@ -201,6 +202,7 @@ describe('agent runtime routes', () => {
             category: 'execution',
             timestamp: '2026-04-04T09:05:00.000Z',
             details: {
+              eventId: 'evt_cowork_action_1',
               taskId: 'task-1',
               sessionId: 'sess-1',
               correlationId: 'corr-1',
@@ -215,7 +217,7 @@ describe('agent runtime routes', () => {
     expect(res.statusCode).toBe(200);
     const body = JSON.parse(res.payload);
     expect(body.actions[0]).toMatchObject({
-      actionLogId: 'audit-2',
+      actionLogId: 'evt_cowork_action_1',
       sessionId: 'sess-1',
       runId: 'task-1',
       eventName: 'task_completed',
diff --git a/services/cowork-service/src/modules/agent-runtime/routes.ts b/services/cowork-service/src/modules/agent-runtime/routes.ts
index 7c87d2a7..78b76cff 100644
--- a/services/cowork-service/src/modules/agent-runtime/routes.ts
+++ b/services/cowork-service/src/modules/agent-runtime/routes.ts
@@ -168,6 +168,19 @@ function mapResolverSurface(surface: unknown): 'mobile' | 'web' | 'desktop' | nu
   }
 }
 
+function getCanonicalAuditEventId(
+  record: Record<string, unknown>,
+  details: Record<string, unknown>
+): string | null {
+  if (typeof details.eventId === 'string' && details.eventId.length > 0) {
+    return details.eventId;
+  }
+  if (typeof record.id === 'string' && record.id.length > 0) {
+    return record.id;
+  }
+  return null;
+}
+
 function toApprovalCheckpoint(
   record: Record<string, unknown>,
   fallbackNow: string
@@ -178,10 +191,10 @@ function toApprovalCheckpoint(
       : {};
   const status = mapApprovalStatus(record.action);
   const requestedAt = asIsoString(record.timestamp ?? record.createdAt, fallbackNow);
+  const canonicalEventId = getCanonicalAuditEventId(record, details);
 
   return AgentApprovalCheckpointSchema.parse({
-    approvalId:
-      typeof record.id === 'string' && record.id.length > 0 ? record.id : `approval_${fallbackNow}`,
+    approvalId: canonicalEventId ?? `approval_${fallbackNow}`,
     sessionId:
       typeof details.sessionId === 'string' && details.sessionId.length > 0
         ? details.sessionId
@@ -226,6 +239,7 @@ function toActionLog(record: Record<string, unknown>, fallbackNow: string): Agen
     record.details && typeof record.details === 'object'
       ? (record.details as Record<string, unknown>)
       : {};
+  const canonicalEventId = getCanonicalAuditEventId(record, details);
   const sessionId =
     typeof details.sessionId === 'string' && details.sessionId.length > 0
       ? details.sessionId
@@ -240,8 +254,7 @@ function toActionLog(record: Record<string, unknown>, fallbackNow: string): Agen
         : 'unknown-run';
 
   return AgentActionLogSchema.parse({
-    actionLogId:
-      typeof record.id === 'string' && record.id.length > 0 ? record.id : `action_${fallbackNow}`,
+    actionLogId: canonicalEventId ?? `action_${fallbackNow}`,
     sessionId,
     runId,
     eventName: