Audit Timeline
Chronological, immutable record of access events, review decisions, escalations and finalisation metadata. Filter the view, then export exactly what you are looking at.
Tamper-evident chain
Every record is folded into a SHA-256 hash chain: digest(n) = SHA-256(digest(n-1) ‖ canonical(record n)). Anchor the chain head, and any later edit, deletion or back-dated insertion re-derives to a different digest.
No chain anchor recorded yet. Anchor the current timeline to make later modifications detectable.
Agent activity (MCP)
Every tool call made by a connected agent — who, when, which tool, which case and assets — recorded server-side and merged into the timeline below.
Loading agent tool calls…
Filters
date: all · cases: all · roles: all · categories: all · event types: all · 2 of 2 events
Asset and node filters match any record referencing the id — media, evidence, `MODULE:<name>` or FUSION nodes from the evidence graph.
No agent activity recorded yet — connect an MCP client to populate these filters.
Timeline
Newest first · times are UTC
- 00:00:00ZSYSTEMSECURITY_FINDING_FIXED_CRITICAL—suryakavacham-agent · SYSTEM
Finding "ssrf_sla_alert" (SSRF hardening — validation extracted and logged) marked fixed · Destination validation moved to a unit-tested pure module and every dispatch attempt now emits a redacted structured log line recording destination, actor context and rejection reason. · code paths: src/lib/notifications-url.ts, src/lib/alert-logging.ts, src/lib/notifications.functions.ts
chain …
- 00:00:00ZSYSTEMSECURITY_FINDING_FIXED_CRITICAL—suryakavacham-agent · SYSTEM
Finding "ssrf_sla_alert" (SSRF in SLA alert dispatch) marked fixed · Alert dispatch now requires an authenticated session and validates the webhook destination, rejecting non-http(s) schemes, embedded credentials, non-standard ports and private/link-local/metadata addresses. · code paths: src/lib/notifications.functions.ts
chain …
The audit trail records what was accessed, decided and exported. It is evidence of process, not of wrongdoing — an AI assessment is never proof of wrongdoing.