Foundation & framework-free core

[erikfrerejean]

Summary

Builds the framework-free core of wedevelopnl/audit-log (Plan 1): value objects, the AuditEvent contract, the Recorder and its ports, the immutable AuditRecord read contract, and the read DTOs — plus repo scaffold, QA tooling, GitHub Actions CI, and the governing ADRs. No Symfony/Doctrine; persistence and wiring follow in Plans 2–3.

What's included

• Event — AuditChannel, Subject, FieldChange, Changeset, RenderLine, RenderPayload, the AuditEvent contract, AbstractAuditEvent, ProvidesSubjectLabel.
• Recording — Actor, Origin, the five ports (ActorResolver, OriginResolver, SubjectLabeller, IdentityGenerator, RecordStore), NewAuditRecord, the Recorder seam and DefaultRecorder.
• Record / Reading — AuditRecord (immutable read contract with property hooks), AuditEntry, AuditActor, AuditQuery, AuditPage (page-count), RecordReader.
• Docs & tooling — ADRs 0001–0008, README, CONTRIBUTING, BSD-3-Clause LICENSE, .gitattributes (clean Packagist dist), PHPStan (max + 100% type coverage), PHP CS Fixer, Rector, Deptrac, PHPUnit, Infection.

Quality

• cs-check, phpstan (level max), rector-check, deptrac (0 violations), test — all green.
• Coverage: 100% on all classes with logic. The 3 pure read DTOs (AuditEntry/AuditActor/AuditQuery) are intentionally exercised by Plan 2's reader.
• Mutation testing: Infection 21/21 mutants killed, MSI 100% — now enforced in CI.

Notes / deviations from plan

• Fixture event return types narrowed to non-nullable where they always return a value (satisfies PHPStan return.unusedType at max).
• DefaultRecorderTest asserts non-null before -> access instead of chained ?-> (phpstan-phpunit narrows the receiver after the first assertion).
• Added a data() per-concrete-event @return narrowing convention (instead of generics on the interface) — see UserDeletedEvent.
• Infection wired into the QA workflow.