frontend: Settings UI toggle for the experimental SQLite audit backend

Makes the opt-in auditLogBackend flag (previous commit) actually
reachable by a human instead of only by editing settings.json directly.
New audit:sqliteCapability IPC handler surfaces
getSqliteStoreCapabilityReport() so the UI can explain *why* the toggle
is disabled when the native addon isn't built, rather than it silently
doing nothing. Audit & Privacy gets a new "Audit log storage backend"
card: current backend badge, a disabled state with reason text when
SQLite isn't available, and a switch button that migrates existing
events in automatically (JSON is never deleted, so switching back is
always possible).

New e2e spec (audit-sqlite-backend-toggle.spec.ts) drives the real
Electron app: create a case on JSON, switch to SQLite, confirm the
migrated event survived, switch back, confirm it's still there.
Screenshotted the resulting Audit & Privacy page to confirm visual
placement. Full e2e suite (10 specs) and unit suites (581 app + 95
frontend) all still pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: voidstackloop

app/src/ipc/audit-handlers.ts

@@ -1,10 +1,14 @@
 import { ipcMain, IpcMainInvokeEvent } from "electron";
 import * as auditLogStore from "../audit-log-store";
+import { getSqliteStoreCapabilityReport } from "../native-sqlite-store";
 
 export function registerAuditIpc(): void {
     ipcMain.handle("audit:list", () => auditLogStore.listEvents());
     ipcMain.handle("audit:clearAll", () => auditLogStore.clearAll());
     ipcMain.handle("audit:verifyIntegrity", () => auditLogStore.verifyChainIntegrity());
+    // Lets Settings explain *why* the experimental SQLite backend silently
+    // stayed on JSON, rather than the toggle just appearing to do nothing.
+    ipcMain.handle("audit:sqliteCapability", () => getSqliteStoreCapabilityReport());
 
     ipcMain.handle(
         "audit:record",

app/src/preload.ts

@@ -466,6 +466,8 @@ export const api = {
         ): Promise<AuditEvent> => ipcRenderer.invoke("audit:record", { actionCategory, fields }),
         verifyIntegrity: (): Promise<{ valid: boolean; checkedCount: number; brokenAtIndex?: number; reason?: string }> =>
             ipcRenderer.invoke("audit:verifyIntegrity"),
+        sqliteCapability: (): Promise<{ available: boolean; reason?: string; detail?: string }> =>
+            ipcRenderer.invoke("audit:sqliteCapability"),
     },
 
     encryption: {

e2e/tests/audit-sqlite-backend-toggle.spec.ts

@@ -0,0 +1,43 @@
+import { test, expect } from "@playwright/test";
+import { launchApp, makeUserDataDir, type LaunchedApp } from "../fixtures/electron-app";
+
+// Exercises the Settings UI toggle for the experimental SQLite audit-log
+// backend (see docs/RUST_MIGRATION_ASSESSMENT.md) end to end: creating a
+// case while on JSON, switching to SQLite, confirming the migrated event is
+// still visible, then switching back — through the real IPC path, not a
+// mock. Assumes the native addon is built (app/native present); if it
+// isn't, the toggle is expected to stay disabled, which this test doesn't
+// cover — see native-sqlite-store.test.ts / audit-log-store.test.ts for the
+// addon-unavailable fallback behavior at the unit level.
+
+let instance: LaunchedApp;
+
+test.afterEach(async () => {
+    await instance?.close();
+});
+
+test("switching the audit log storage backend migrates existing events and back again", async () => {
+    const userDataDir = makeUserDataDir();
+    instance = await launchApp({ userDataDir, settings: { onboardingComplete: true } });
+
+    await instance.window.getByRole("button", { name: "Patient Cases" }).click();
+    await instance.window.getByLabel("New case").fill("Backend toggle test case");
+    await instance.window.getByRole("button", { name: "New case" }).click();
+    await expect(instance.window.getByText("Backend toggle test case")).toBeVisible();
+
+    await instance.window.getByRole("button", { name: "Audit & Privacy" }).click();
+    await expect(instance.window.getByText("JSON (default)")).toBeVisible();
+    await expect(instance.window.getByText("Case created")).toBeVisible();
+
+    const toggle = instance.window.getByRole("button", { name: /Switch to experimental SQLite backend|Switch back to JSON/ });
+    await expect(toggle).toBeEnabled({ timeout: 10_000 });
+    await toggle.click();
+
+    await expect(instance.window.getByText("SQLite")).toBeVisible();
+    // The pre-existing event must have migrated in, not disappeared.
+    await expect(instance.window.getByText("Case created")).toBeVisible();
+
+    await instance.window.getByRole("button", { name: "Switch back to JSON" }).click();
+    await expect(instance.window.getByText("JSON (default)")).toBeVisible();
+    await expect(instance.window.getByText("Case created")).toBeVisible();
+});

frontend/src/pages/AuditPrivacy.tsx

@@ -332,6 +332,70 @@ function ModelRegistrySection() {
     );
 }
 
+/** Experimental, opt-in: routes the audit log through a Rust/SQLite store
+ * instead of the JSON file (see docs/RUST_MIGRATION_ASSESSMENT.md). Off by
+ * default and safe to leave off — this exists to make the backend
+ * switchable/testable, not because JSON has a known problem serious enough
+ * to recommend switching. */
+function StorageBackendSection({ onBackendChanged }: { onBackendChanged: () => void }) {
+    const [backend, setBackend] = useState<"json" | "sqlite">("json");
+    const [capability, setCapability] = useState<{ available: boolean; reason?: string; detail?: string } | null>(null);
+    const [busy, setBusy] = useState(false);
+
+    function refresh() {
+        window.api.settings.get().then((s) => setBackend(s.auditLogBackend ?? "json"));
+        window.api.audit.sqliteCapability().then(setCapability);
+    }
+    useEffect(refresh, []);
+
+    async function toggle() {
+        setBusy(true);
+        try {
+            const next = backend === "sqlite" ? "json" : "sqlite";
+            await window.api.settings.save({ auditLogBackend: next });
+            refresh();
+            onBackendChanged();
+        } finally {
+            setBusy(false);
+        }
+    }
+
+    const capabilityUnavailableReason: Record<string, string> = {
+        "not-built": "the native module wasn't built into this install",
+        "abi-or-platform-mismatch": "the native module doesn't match this machine's platform/Node version",
+        "load-error": "the native module failed to load",
+    };
+
+    return (
+        <div className="rounded-xl border border-border/70 bg-card p-3.5">
+            <div className="flex items-center justify-between gap-2">
+                <div>
+                    <p className="text-xs font-semibold">Audit log storage backend</p>
+                    <p className="mt-1 text-xs text-muted-foreground">
+                        Experimental. Existing events migrate in automatically the first time you switch, and are
+                        never deleted from the JSON file — switching back to JSON afterward is always possible.
+                    </p>
+                </div>
+                <Badge variant={backend === "sqlite" ? "warning" : "secondary"}>{backend === "sqlite" ? "SQLite" : "JSON (default)"}</Badge>
+            </div>
+
+            {capability && !capability.available && (
+                <p className="mt-2 text-xs text-muted-foreground">
+                    SQLite backend unavailable on this install —{" "}
+                    {capabilityUnavailableReason[capability.reason ?? ""] ?? "it couldn't be loaded"}. Staying on JSON
+                    regardless of this setting.
+                </p>
+            )}
+
+            <div className="mt-2.5">
+                <Button size="sm" variant="outline" disabled={busy || (backend === "json" && !capability?.available)} onClick={toggle}>
+                    {backend === "sqlite" ? "Switch back to JSON" : "Switch to experimental SQLite backend"}
+                </Button>
+            </div>
+        </div>
+    );
+}
+
 const CATEGORY_LABEL: Record<AuditEvent["actionCategory"], string> = {
     "case-created": "Case created",
     "case-updated": "Case updated",
@@ -410,6 +474,8 @@ export default function AuditPrivacy() {
 
                     <ModelRegistrySection />
 
+                    <StorageBackendSection onBackendChanged={refresh} />
+
                     <div className="grid gap-3 sm:grid-cols-2">
                         <div className="rounded-xl border border-border/70 bg-card p-3.5">
                             <p className="text-xs font-semibold">Storage</p>

frontend/src/types/electron.d.ts

@@ -608,6 +608,7 @@ export interface AppSettings {
   caseAutoLockMinutes?: number;
   redactBeforeRemoteSend?: boolean;
   auditLogRetentionDays?: number;
+  auditLogBackend?: "json" | "sqlite";
 }
 
 export interface ChatOptions {
@@ -1128,6 +1129,7 @@ export interface ElectronApi {
       }
     ) => Promise<AuditEvent>;
     verifyIntegrity: () => Promise<AuditChainVerificationResult>;
+    sqliteCapability: () => Promise<{ available: boolean; reason?: string; detail?: string }>;
   };
   encryption: {
     status: () => Promise<{ enabled: boolean; unlocked: boolean }>;