Struct AuditEntry 

pub struct AuditEntry {

    pub timestamp: String,
    pub tool: ToolName,
    pub command: String,
    pub result: AuditResult,
    pub duration_ms: u64,
    pub error_category: Option<String>,
    pub error_domain: Option<String>,
    pub error_phase: Option<String>,
    pub claim_source: Option<ClaimSource>,
    pub mcp_server_id: Option<String>,
    pub injection_flagged: bool,
    pub embedding_anomalous: bool,
    pub cross_boundary_mcp_to_acp: bool,
    pub adversarial_policy_decision: Option<String>,
    pub exit_code: Option<i32>,
    pub truncated: bool,
    pub caller_id: Option<String>,
    pub policy_match: Option<String>,
    pub correlation_id: Option<String>,
    pub vigil_risk: Option<VigilRiskLevel>,
    pub execution_env: Option<String>,
    pub resolved_cwd: Option<String>,
    pub scope_at_definition: Option<String>,
    pub scope_at_dispatch: Option<String>,
}

A single tool invocation record written to the audit log.

Serialized as a flat JSON object (newline-terminated). Optional fields are omitted when None or false to keep entries compact.

Example JSON output

{"timestamp":"1712345678","tool":"shell","command":"ls -la","result":{"type":"success"},
 "duration_ms":12,"exit_code":0,"claim_source":"shell"}

Fields

timestamp: String

Unix timestamp (seconds) when the tool invocation started.

tool: ToolName

Tool identifier (e.g. "shell", "web_scrape", "fetch").

command: String

Human-readable command or URL being invoked.

result: AuditResult

Outcome of the invocation.

duration_ms: u64

Wall-clock duration from invocation start to completion, in milliseconds.

error_category: Option<String>

Fine-grained error category label from the taxonomy. None for successful executions.

error_domain: Option<String>

High-level error domain for recovery dispatch. None for successful executions.

error_phase: Option<String>

Invocation phase in which the error occurred per arXiv:2601.16280 taxonomy. None for successful executions.

claim_source: Option<ClaimSource>

Provenance of the tool result. None for non-executor audit entries (e.g. policy checks).

mcp_server_id: Option<String>

MCP server ID for tool calls routed through McpToolExecutor. None for native tools.

injection_flagged: bool

Tool output was flagged by regex injection detection.

embedding_anomalous: bool

Tool output was flagged as anomalous by the embedding guard. Raw cosine distance is NOT stored (prevents threshold reverse-engineering).

cross_boundary_mcp_to_acp: bool

Tool result crossed the MCP-to-ACP trust boundary (MCP tool result served to an ACP client).

adversarial_policy_decision: Option<String>

Decision recorded by the adversarial policy agent before execution.

Values: "allow", "deny:<reason>", "error:<message>". None when adversarial policy is disabled or not applicable.

exit_code: Option<i32>

Process exit code for shell tool executions. None for non-shell tools.

truncated: bool

Whether tool output was truncated before storage. Default false.

caller_id: Option<String>

Caller identity that initiated this tool call. None for system calls.

policy_match: Option<String>

Policy rule trace that matched this tool call. Populated from PolicyDecision::trace. None when policy is disabled or this entry is not from a policy check.

correlation_id: Option<String>

Correlation id shared with any associated EgressEvent emitted during this tool call. Generated at execute_tool_call entry. None for policy-only or rollback entries that do not map to a network-capable tool call.

vigil_risk: Option<VigilRiskLevel>

VIGIL risk level when the pre-sanitizer gate flagged this tool output. None when VIGIL did not fire (output was clean or tool was exempt).

execution_env: Option<String>

Name of the resolved execution environment (from [[execution.environments]]). None when no named environment was selected for this invocation.

resolved_cwd: Option<String>

Canonical absolute working directory actually used for this shell invocation. None for non-shell tools or legacy path without a resolved context.

scope_at_definition: Option<String>

Name of the capability scope active at tool_definitions() time (for scope-at-definition audit). None when ScopedToolExecutor is not in the chain or the scope is the identity (general).

scope_at_dispatch: Option<String>

Name of the capability scope active at execute_tool_call() dispatch time. None when ScopedToolExecutor is not in the chain.

Trait Implementations

impl Serialize for AuditEntry

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.