The audit.* family (10 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Purgeaudit.archive.purge
| Property | Value |
|---|---|
| Capability | audit.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
ONLY. { workspaceIds[] }. DELETE audit_archives for the given
workspaces (the onDelete
Call POST /v/audit.archive.purge with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Reportaudit.boxAnchor.report
| Property | Value |
|---|---|
| Capability | audit.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
ONLY (control-plane). { orgId, slug, sequence, headHash }. Folds the
FULL recordBoxAuditHead tamper logic: read the (organization_id, slug) anchor FOR UPDATE; a sequence
regression OR a fork (same sequence, different headHash) latches tampered=true and is REJECTED
({ok
Call POST /v/audit.boxAnchor.report with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Reportaudit.chain.report
| Property | Value |
|---|---|
| Capability | audit.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
ONLY. { workspaceId, valid, entriesChecked, brokenAt?, reason?, source }.
Append the outcome of a chain verification to sign_chain_integrity_reports (the WRITE peer of chain.verify).
Call POST /v/audit.chain.report with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Verifyaudit.chain.verify
| Property | Value |
|---|---|
| Capability | audit.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Admin |
| Availability | On demand (MCP tier 2) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
Recompute the caller workspace’s audit hash-chain from genesis
(INV-8 / ADR-0039 §6). {} (no input). RLS-scoped + explicit workspace_id = $. Returns a structured
ChainIntegrityReport: { chainedCount, verifiedFromSeq, verifiedToSeq, intact, firstBreak, legacyUnchainedCount }.
intact=false with firstBreak.{chainSeq,reason} on any tampered/reordered/missing link. Computes
nothing authoritative (INV-14) - a derived verdict over the SoR log, never a second store.
Call POST /v/audit.chain.verify with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool audit.chain.verify.
Feedaudit.feed
| Property | Value |
|---|---|
| Capability | audit.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Admin |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
The recent-events feed (the ops-console “what just happened” tail).
{ limit? }. The unfiltered newest-first tail of audit.query (the degenerate no-filter case,
surfaced as its own verb so the console render source is a single dispatch). RLS-scoped; paginated.
Call POST /v/audit.feed with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool audit.feed.
Appendaudit.log.append
| Property | Value |
|---|---|
| Capability | audit.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
ONLY. { workspaceId, action, resource, resourceId, userId?, metadata?, ipAddress?, userAgent? }. Appends one hash-chained audit_logs row. workspaceId is explicit (cross-ws cron).
Call POST /v/audit.log.append with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Queryaudit.query
| Property | Value |
|---|---|
| Capability | audit.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Admin |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
Read the immutable event log (INV-8) filtered by
{ actorId?, verb?, source?, since?, limit? }. RLS-scoped. since is an RFC-3339 timestamp lower
bound (events at-or-after it). Newest-first; paginated (NFR-PERF-3). ADMIN-only (security forensics).
Call POST /v/audit.query with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool audit.query.
Archive Purgeaudit.retention.archivePurge
| Property | Value |
|---|---|
| Capability | audit.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
ONLY. COMPOUND. { workspaceId, rangeStart, rangeEnd, recordCount, archiveJson, deletedBy, logIds[], selfAudit, retentionDays? }. Archive-before-delete in ONE
tx: INSERT audit_archives, DELETE the archived audit_logs by id, then (selfAudit) append the
AUDIT_LOG_PURGE row. Returns { archiveId, deleted, selfAuditId? }.
Call POST /v/audit.retention.archivePurge with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Appendaudit.security.append
| Property | Value |
|---|---|
| Capability | audit.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
ONLY. { type, workspaceId?, userId?, ipAddress?, userAgent?, detail?, metadata? }. Append a security_events row. PERMITS workspaceId=NULL (orphan attack evidence) - it does NOT
bind the ctx.workspace_id RLS fence (the sanctioned global/system path that RECORDS rather than drops).
Call POST /v/audit.security.append with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Archive Purgeaudit.security.archivePurge
| Property | Value |
|---|---|
| Capability | audit.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
ONLY. COMPOUND. { workspaceId, rangeStart, rangeEnd, recordCount, archiveJson, deletedBy, eventIds[] }. INSERT audit_archives + DELETE the archived
security_events by id in ONE tx (only workspace-scoped events; orphan NULL-ws events are never passed in).
Call POST /v/audit.security.archivePurge with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.