AUDIT

Audit model

Equivalent JSONL and SQLite evidence records preserve the operational story without justifying secret collection.

Backends

JSONL is append-only, line-oriented and stream-friendly. SQLite is transactional, indexed and queryable. Both use the same logical event representation.

Event schema

  • event_id and UTC timestamp
  • node_id, component and event_type
  • Severity and optional ReasonCode
  • target, SOP and action context where applicable
  • result and structured evidence_json
  • safe error and software_version

Cross-cutting lifecycle

Observations, analysis results, triage decisions, SOP selection or rejection, dry-run action records, verification outcomes, circuit/maintenance changes and failures may each produce records.

Sensitive data

Passwords, tokens, private keys, credentials, unrestricted environment dumps and unrestricted command output are prohibited. Audit completeness never justifies retaining secrets.

Integrity boundary