---
path: /studio/yemaya/compliance-and-audit
surface: studio
domain: yemaya
auth: signed-in + studio entitlement (AAA-gated for policy mutations)
source: apps/oshun/web/src/app/studio/yemaya/compliance-and-audit/page.tsx
status: walked
last_walked:
  '2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data
  (2xx), console/page-errors, expected content, screenshot verified; live
  screen-reader, touch, offline, and telemetry-delivery checks pending a manual
  AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body
  re-derived 2026-06-03 from current source (lane-console architecture)'
---

# Studio · Yemaya · Compliance and Audit

## Purpose

Admin lane console wired to the `@yemaya/d3-visualizations` transforms: feed an
audit metric series and surface anomalies (IQR outliers), the
period-over-period growth profile, and a linear trend line (slope / intercept /
R²) for compliance review.

## Entry points

- Studio index quick-actions.
- No breadcrumb panel on this page.
- This page links out to `/studio/yemaya/rbac`.
- Embedded as a lane inside `/studio/yemaya/enterprise` and `/studio/yemaya/users`.
- Direct URL / bookmark (signed-in + studio entitlement).

## Layout regions

`page.tsx` renders `ShellLayout active="studio"` and:

- **Workspace panel** (`StudioYemayaComplianceAndAuditWorkspace`,
  `data-yemaya-compliance-and-audit-workspace`):
  - `<h1>` "Yemaya Compliance and Audit Workspace".
  - Summary `<p data-yemaya-compliance-and-audit-summary>` (IQR outliers, growth
    profile, trend line).
  - **Analyze lane** — loading / unauthorized / error / ready-form / result.
- **Route Map panel** (`data-yemaya-compliance-and-audit-route-map`): `<h2>`
  "Route Map" with five entries.
- **Quick-action panel**: two `quickAction` links.

## States

- [ ] **Loading** — `data-yemaya-ca-loading` ("Loading audit analytics…").
- [ ] **Unauthorized** — 401/403 → `data-yemaya-ca-unauthorized` with reason
      "Yemaya workspace scope required to view compliance and audit.".
- [ ] **Error** — non-OK / malformed catalog → `data-yemaya-ca-error`.
- [ ] **Ready-form** — catalog (`outputs`, `defaultOutlierThreshold`) loaded.
- [ ] **Result** — 200 → `data-yemaya-ca-result` with `data-yemaya-ca-outliers`,
      `data-yemaya-ca-trend`, `data-yemaya-ca-growth`.
- [ ] **Validation error** — empty/non-numeric series, or a non-200 POST →
      `data-yemaya-ca-analyze-error`.

## Interactions

### Analyze lane

`<form data-yemaya-ca-analyze-form>`:

- [ ] **Audit metric series** — `<input data-yemaya-ca-field-series>` (aria-label
      "audit metric series"), comma/space separated.
- [ ] **Outlier threshold (IQR multiplier)** — `<input data-yemaya-ca-field-threshold>`
      (aria-label "outlier threshold").
- [ ] **"Analyze series"** submit (`data-yemaya-ca-analyze-submit`) — parses the
      series, then POSTs `{ series, outlierThreshold? }`.

### Route map

`data-yemaya-compliance-and-audit-route-map` — five entries:

- [ ] `/studio/yemaya/compliance-and-audit`
- [ ] `/studio/yemaya/compliance-and-audit/scenes/[sceneId]`
- [ ] `/studio/yemaya/compliance-and-audit/exports/[exportId]`
- [ ] `/studio/yemaya/compliance-and-audit/revisions/[revisionId]`
- [ ] `/studio/yemaya/compliance-and-audit/governance/[policyId]`

### Quick actions

- [ ] **"Open Yemaya RBAC workspace"** → `/studio/yemaya/rbac`.
- [ ] **"Back to Studio workspace index"** → `/studio`.

## Data & contracts

- **Reads**: `GET /v1/admin/yemaya/compliance-and-audit` (catalog; `outputs`,
  `defaultOutlierThreshold`) on mount with `buildBffAuthHeaders()`, `cache:
  'no-store'`.
- **Writes**: `POST /v1/admin/yemaya/compliance-and-audit/analyze` → `{ analysis:
  { outliers[], growthRates[], trend: { slope, intercept, rSquared } } }`.
- **Realtime**: None.
- **Caching**: client `fetch` on mount, no-store; aborted on unmount.
- **Auth/role check**: admin-scoped, fail-closed; route additionally signed-in +
  studio via the proxy gate.

## Cross-references

- Workspace source:
  `apps/oshun/web/src/components/studio/StudioYemayaComplianceAndAuditWorkspace.tsx`
- Route map source:
  `apps/oshun/web/src/components/studio/StudioYemayaComplianceAndAuditRouteMap.ts`
- Page source:
  `apps/oshun/web/src/app/studio/yemaya/compliance-and-audit/page.tsx`
- Embedded in: [`studio-yemaya-enterprise.md`](./studio-yemaya-enterprise.md),
  [`studio-yemaya-users.md`](./studio-yemaya-users.md)
- Studio overview: [`studio-overview.md`](../../studio-overview.md)
- Feature spec: [`V1/features.md`](../../../../V1/features.md)

## Open questions / known gaps

- [ ] The auth frontmatter notes "AAA-gated for policy mutations" but the lane
      only reads + runs a stateless analysis (no mutation). Confirm whether a
      policy-mutation path is planned for this route.
- [ ] Route-map children (`scenes`/`exports`/`revisions`/`governance`) are a
      sitemap contract; confirm which dynamic pages exist.