> ## Documentation Index
> Fetch the complete documentation index at: https://plainrouter.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> Trace workspace security, Drive ownership, governed execution, verification, and restoration.

Open **Audit log** from the PlainRouter sidebar to review chronological security and Actions history for the current workspace.

## What an audit event contains

Each event records:

* Event type and plain-language summary.
* Actor type and actor name.
* Related batch and action, when applicable.
* Structured event payload and creation time.
* Event hash, previous hash, and hash version.

Events are append-only and predecessor-linked within the current database snapshot.

## Integrity versions

The top of the audit page reports separate integrity segments:

| Segment       | Meaning                                                                                                                                             |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| Historical v1 | Preserves predecessor continuity, but the stored hash cannot be recomputed completely from durable row fields. It is labeled `v1_non_recomputable`. |
| Checkpoint    | Bridges the preserved v1 tail into the v2 segment. The page reports whether it is present and valid.                                                |
| v2            | Uses a durable canonical representation. PlainRouter recomputes every stored v2 row and reports whether the current database snapshot matches.      |

<Warning>
  The hash chain has no external tail anchor. Successful v2 recomputation detects changed stored rows within the current snapshot, but it cannot independently prove that no tail events were deleted outside that snapshot.
</Warning>

Expand **Integrity details** on an event to see its version, hash, and predecessor hash.

## Events to follow

| Stage              | Representative events                                                                              | Meaning                                                                                                                                        |
| ------------------ | -------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| Drive ownership    | `folder.claim`, `folder.verification_failed`, `folder.verified`                                    | A workspace owner claimed a Drive folder, ownership verification failed, or ownership was verified before inventory sync.                      |
| Policy             | `policy.updated`                                                                                   | A workspace owner changed action-policy settings. The event records the complete before-and-after policy and is not tied to a batch or action. |
| Token lifecycle    | `token.issued`, `token.revoked`                                                                    | A workspace owner issued, rotated, or revoked a scoped token. The event records durable token metadata but never the plaintext credential.     |
| Proposal           | `batch.proposed`, `batch.blocked`                                                                  | An agent submitted a batch and policy accepted it for review or blocked it.                                                                    |
| Decision           | `batch.recommendation_approved`, `batch.approved`, `batch.rejected`                                | A person recorded a suggest-only approval, authorized execution, or rejected the proposal.                                                     |
| Execution gate     | `execution.started`, `execution.blocked`                                                           | The worker began or the fresh execution-time policy check denied the batch.                                                                    |
| Provider evidence  | `action.provider_read_started`, `action.provider_read_observed`, `action.provider_read_classified` | A receipt-addressed read was authorized, captured, and mechanically classified.                                                                |
| Verification       | `action.verified`, `execution.verified`                                                            | The exact provider object matched; all actions are Landed only after the batch-level verified event.                                           |
| Async verification | `action.verification_handed_off`, `action.async_verification_*`                                    | A committed ad copy remains Not Landed while scheduled verification continues.                                                                 |
| Outcome            | `outcome.checked`, `outcome.anomaly_detected`                                                      | A later provider outcome was recorded and classified.                                                                                          |
| Restoration        | `action.rolled_back`, `batch.rolled_back`, `batch.rollback_incomplete`                             | Compensation restored provider state, or incomplete recovery needs attention.                                                                  |

Measurement-only events explicitly say **NOT LANDED**. Do not count them as production execution acceptance.

## Investigate unexpected execution

<Steps>
  <Step title="Confirm the principal and scope">
    Find `batch.proposed`. Confirm the agent, account, evidence provenance, target-selection boundary, and execution-mode snapshot.
  </Step>

  <Step title="Trace both policy decisions">
    Read the proposal-time result and, for executable work, the execution-time result recorded before the provider call.
  </Step>

  <Step title="Confirm the human decision">
    Find the approval or rejection event and confirm the named person and time.
  </Step>

  <Step title="Follow the receipt evidence">
    Trace execution, raw provider observations, classifications, and terminal verification. An awaiting-verification event is not Landed.
  </Step>

  <Step title="Confirm restoration when needed">
    For failed work, find the compensation and provider-read proof. Escalate any `rollback_incomplete` event.
  </Step>

  <Step title="Revoke access if necessary">
    Revoke the PlainRouter agent connection or workspace token. Revocation disables its principal and associated credential.
  </Step>
</Steps>