Expand description
Append-only audit trail.
A remote shell without an audit trail leaves nothing to look at after an
incident: the process logs are ephemeral, and the API returns results to the
caller rather than recording them. This writes one JSON object per line —
readable with tail -f or jq, appendable without a database, and never
rewritten.
What is deliberately not recorded: the bearer token itself. Events carry a
per-registration token_id and the token’s label, which identify the caller
across a run without putting a credential in a file that is, by design, kept
around and often shipped elsewhere.
Structs§
- Audit
Event - One recorded event.
- File
State - Open file plus what has been written to it.
- Identity
- Who made a request, in terms safe to write down.
Enums§
- Audit
Sink - Where audit events go.