AUDIT
Audit model
Equivalent JSONL and SQLite evidence records preserve the operational story without justifying secret collection.
Backends
JSONL is append-only, line-oriented and stream-friendly. SQLite is transactional, indexed and queryable. Both use the same logical event representation.
Event schema
- event_id and UTC timestamp
- node_id, component and event_type
- Severity and optional ReasonCode
- target, SOP and action context where applicable
- result and structured evidence_json
- safe error and software_version
Cross-cutting lifecycle
Observations, analysis results, triage decisions, SOP selection or rejection, dry-run action records, verification outcomes, circuit/maintenance changes and failures may each produce records.
Sensitive data
Passwords, tokens, private keys, credentials, unrestricted environment dumps and unrestricted command output are prohibited. Audit completeness never justifies retaining secrets.