An audit trail for agent actions, line by line

2026-10-17 — an audit trail earns the word “audit” only if you can hand it to someone later and have it still mean the same thing. That is a boring design bar: append-only, validated, redacted, replayable. This post is the boring tour of what 20131 actually writes.

One line, five anchors

Each observed action becomes one line in a local JSONL file with five anchors:

• agent family — which agent runtime the action came from (Claude Code, Codex, OpenClaw, an MCP-connected tool)
• process lineage — the chain of spawned processes, so a child’s action still names its parent
• command shape — the normalized form of what was attempted, against which kind of resource
• timestamp — wall time at the moment of observation
• policy verdict — the evaluation that was in force when the action happened; today, would_block or allow, never silently dropped

Trust without trusting

• Strict validation before write: a malformed event is rejected and zero bytes land. The file is trustworthy because of the gate, not because the writer promised.
• Redaction before logging: credentials, key-value secrets and key-file paths are stripped from every string the OS hands us. Nothing sensitive is “logged by accident”.
• Append-only on disk, owner-only permissions, size and daily rotation. History cannot be quietly rewritten by whoever can edit a file.
• Zero outbound calls from the collector — the dependency closure is machine-checked in CI, and the audit surface is yours alone.

Replay: the “what-if” that reviews actually ask

Because the record is structured, you can do more than grep it. A replay engine reads an existing audit corpus against a candidate rule file and emits per-event verdicts deterministically — twice byte-identical, zero side effects on the live system. Post-incident review stops being archaeology and becomes a diff: what would tomorrow’s policy have said about last Tuesday’s events?

See it on your own machine

The read-only control surface in the current build shows the record exactly as it is written — status, audit-tail, timeline. Binaries with per-file SHA-256 are on the <a href="/en/download/">downloads page</a>; the <a href="/en/docs/install/">install guide</a> walks through first run, and <a href="/en/supported-agents/">supported agents</a> states integration depth honestly per family. The narrative version of why this shape exists is <a href="/en/blog/agent-behavior-provable/">here</a>.