Docs
The ledger
Every decision the workspace makes emits one event in a fixed shape. The record is append-only, and the per-session export is what you hand an assessor.
The event
| Field | Content |
|---|---|
rule | The profile and the line that fired |
evidence | Session, person or agent, channel, process ancestry, path, operation, time |
fix | The profile change that would have allowed it, if any |
The fix field turns the record from an audit artifact into something a platform lead acts on.
Classes
The workspace logs every Occluded lookup. The record classifies before anything alerts.
| Class | Example | Alerts |
|---|---|---|
resolution | An editor or build tool resolving an import | No. Recorded |
attempt | A shell cat, an editor open, an agent's read_file, a fs.readFileSync from the person's script | Yes. The path was never visible to that process, so false positives are near zero |
write-refused | A write to a Read-only path | Yes, low severity |
held | A grant with an Absent path in scope, or a live reach for one | Routed to the named approver and shown where the request came from. Not an alert |
An alert fires only on an actual attempt at an Occluded or Absent path, never on a heuristic. A false alarm costs someone an hour, so recall rises by adding evidence, never by loosening a threshold.
Storage
- Append-only, with a hash chain per installation. The role that writes the record cannot update or delete it.
- Events leave the workspace through a bounded buffer, and a file operation never waits on the record. If the buffer fills, the person's side pauses until it drains: when the record cannot keep up, the work stops, not the record.
- Every door writes the same events, tagged with the door. Local mode's events are tagged
unenforced.
Queries and exports
- Blast radius: which sessions, and which people or agents, touched this path. The first question after an incident.
- Per-session export: the profile the session ran under, every file touched, every refusal and the rule that refused it. Signed JSON; the export verifies itself.
- Weekly digest, for the security lead.
- Push to your SIEM: Splunk HTTP Event Collector, and syslog.