Audit log

The Audit & receipts page is the record of what operators did in your tenant. Every significant console action (a sign-in, an approval, a stop, a replay) is appended to a chain. Each entry carries a hash linking it to the entry before it, and each is signed as an ed25519 receipt. Altering or removing history breaks the chain, and the console tells you exactly where.

This page records what operators did in the console. What hosts enforced (terminations, integrity failures, lockdowns) lives on the Evidence page.

A pill next to the page title reports the chain’s health at all times: chain verified · n entries when every link checks out, or chain broken at seq n pointing at the first entry that fails.

What gets recorded

Entries cover the actions that matter for accountability, grouped here by area:

Sign-ins and sign-outs: every attempt, successful or denied (authn.success, authn.deny), lockouts (authn.lockout), sign-outs, and every passkey registration and assertion (webauthn.register, webauthn.assert).
Recording replays: every time an operator fetches a sealed session recording for replay (recording.fetch). Watching history is itself history.
Provisioning codes: each code issued, staged for review, or revoked (provisioning.issue, provisioning.stage, provisioning.revoke).
Change requests: created, approved, rejected, and published (governance.change.create through governance.change.publish). See Approvals.
Change control: application stops with the stated reason and emergency flag (app.stop), rescans (app.rescan), re-baseline authorizations and denials (change.authorize, change.deny), and change-window schedule changes. See Change control.
Application administration: configuration updates, recompositions, and retirements (app.update, app.recompose, app.retire).
Host containment: quarantines, releases, unlocks, and retirements of enrolled hosts (enrollment.quarantine, enrollment.release, enrollment.unlock, enrollment.retire). An unlock carries the reason you gave for it. See Lockdowns.
CAB membership: ceremony steps, invitations sent and redeemed, member key registrations, genesis approvals, and member admissions, renames, and removals.
Operator administration: operator invitations sent, resent, redeemed, and revoked, plus registrations, renames, disables, enables, and unlocks (operator.*).

The table

Entries list newest first. The columns are:

Column	Meaning
WHEN	The wall-clock time the action was recorded.
OPERATOR	The signed-in identity that acted (for example `you@westgate`). Shown as a dash when no operator identity applies.
ACTION	The action’s dotted name, such as `governance.change.approve` or `app.stop`.
TARGET	What was acted on: a change request id, an application id, an operator identity. Shown as a dash when there is no target.
DETAIL	Action-specific context, such as a stop’s reason and emergency flag. Long details are truncated. Hover over the cell to read the full text.
RECEIPT	The entry’s chain hash, truncated. Entries at or after a chain break show their receipt in red.

The count in the card’s corner shows how many entries are listed. The free-text filter narrows it, and a trailing + means more pages exist further back.

Filters

Free text: matches against operator, target, and action. It searches only the entries already loaded, so page further back first if you are hunting for something old.
Action chips: all, governance.change.approve, provisioning, and governance.change.publish. Chips match by prefix, so provisioning covers issue, stage, and revoke in one selection.
Time chips: today, 7d, or 30d, defaulting to 7d. today means since midnight local time.
Load more: entries load 100 at a time. Select Load more at the bottom of the table to page further back within the selected time window.

Chain integrity

The verification behind the header pill covers the whole chain, not just what you are looking at: on every read, Churchill re-walks every link from the chain’s first entry through its head. This is stricter than the Evidence page, which verifies only the window of events it has loaded. A break anywhere in operator history surfaces here, even one from years back.

The Chain integrity card below the table shows the working figures:

Field	Meaning
root	The hash of the chain’s first entry.
head	The hash of the newest entry.
verified through	The timestamp and sequence number of the newest entry.
tamper events	none detected, or break at seq n naming the first broken link.

A broken chain hides nothing: entries at and after the break still display, with their receipts tinted red. Treat them as untrusted until the break is investigated. Everything before the break remains verified.

The status bar at the bottom of every console screen also shows the chain head sequence, but it is captured when your session loads and does not re-verify. The header pill on this page is the live check.

Tracing a change end to end

The audit log is where a change request’s whole story lives in one place. From a change request’s Adoption card, select View audit chain. You land here with the change id already filled into the free-text filter, showing only that change’s entries.

Two traces you will see often:

Registering an application: provisioning.issue when the code is created, then provisioning.stage and governance.change.create together when you submit the staged registration for review, one governance.change.approve per CAB approver, then governance.change.publish.
A change-control run: app.stop (with the reason and emergency flag in DETAIL), app.rescan when the replacement binary is scanned, one governance.change.approve per approver, then change.authorize publishing the new baseline. A vetoed change shows governance.change.reject followed by change.deny instead.

Empty and error states

With the default filters and no history yet, the table shows No audit entries yet. With filters applied, it shows No audit entries in this window. Widen the time chip or clear the free-text query before concluding an action never happened.

If the log cannot load, the table is replaced by Audit log unavailable with a short reason. A not authenticated reason means your session has expired. Sign in again and return.