Audit log
Every action that touches a model, a key or a tool gets recorded. Append-only, timestamped, queryable.
What's logged
- Routing decisions: prompt classifier output, constraints, chosen model, fallback reasons
- Tool calls in pilot mode: tool name, parameters (sanitised), result hash, user who confirmed
- API key registration and rotation
- Persona creation, edits, deletion
- Plan-mode executions: full task DAG, per-worker timings, synthesis output
- Auth events: sign-in, sign-out, tenant switch
Where it lives
data/audit_log.jsonl for engine events, data/routing_log.jsonl for routing decisions specifically. JSONL format: one record per line, timestamps in ISO 8601, fields stable across versions.
Query it
Standard jq works fine for one-off queries. For long-term analysis, ship the logs to a data warehouse:
# routing decisions for a specific model in the last 24h
jq 'select(.model == "qwen2.5-coder:7b")' data/routing_log.jsonl | tail -100
# pilot-mode tool calls that the user denied
jq 'select(.tool_call and .user_approved == false)' data/audit_log.jsonl
Retention
Local mode: kept until you delete. Simezu/Cloud mode: 90 days by default, configurable up to 7 years for regulated industries via the Enterprise plan.