Audit event reference

A lookup table of audit actions, their actor, and the safe fields each carries. For how to read these — and what is deliberately excluded from all of them — see Audit trail.

Every action below flows through the same append-only funnel. None carries chat text, queries, answer content, raw tool payloads, credentials, hidden reasoning, or presence data.

Administrator operational views

Action	Actor	Safe fields
admin.usage.members.viewed	Platform-authenticated Admin	Selected 7/30/90-day window, returned row count, and source availability

The member rows themselves are not copied into audit. In particular, display names, opaque member keys, activity times, token totals, and all member content are absent from this event.

Conversations: invitations and membership

Action	Actor	Safe fields
member.conversation.invitation.created	Owner	Invitation id, recipient-email digest, expiry, audience version
member.conversation.invitation.accepted	Named recipient	Invitation id, membership id, new audience version
member.conversation.invitation.revoked	Owner	Invitation id, correlation id
member.conversation.member.revoked	Owner	Membership id, new audience version, queued/active fencing outcome
member.conversation.member.left	Collaborator	Membership id, new audience version
member.conversation.agent.selected	Owner	Agent id and version, audience version, correlation id

Conversations: inputs, runs, delivery

Action	Actor	Safe fields
member.conversation.input.accepted	Active participant	Input id, kind, accepted position, queue state, audience version
member.conversation.input.cancelled	Participant or system recovery	Input id, run id when present, bounded reason
member.conversation.run.recovered	System (background run sweep)	Conversation id, counts of claims returned to the queue, existing terminals attached, and runs salvaged
chat.turn.*, chat.agent.*, chat.tool.*	Initiating participant or bound system recovery	Conversation/input/run correlation, outcome, duration, redacted counts
member.conversation.live.degraded	System	Conversation id, unavailable dependency, bounded duration and outcome
chat.pipeline.assigned	Initiating participant or migration system actor	Exact pipeline id and version, assignment source, policy version
chat.pipeline.fallback	Pipeline supervisor system recovery	Exact current and previous pipeline ids and versions, assignment source, policy version, bounded fallback reason

Message and steering text, answer content, raw tool payloads, and presence sets are prohibited from these actions. Normal reconnects do not create rows.

Pipeline assignment actions are closed, access-restricted operational records. They never enter member API responses, conversation events, or ordinary target/actor audit projections. Their payload schema rejects unknown fields.

Conversations: resources and sources

Action	Actor	Safe fields
member.conversation.resource.linked	Initiating participant	Reference and resource ids, kind, pinned version and digest, size, originating turn, journal correlation
member.conversation.resource.tombstoned	Permitted participant or system lifecycle	Reference id, kind, bounded reason (unlinked, deleted, quarantined)
member.conversation.source.denied	System	Run/turn correlation, source-kind and opaque source-id digest, audience version, source_not_visible_to_audience
member.conversation.access.denied	Requester or system	Route/operation class, privacy-safe reason such as resource_not_linked

Failed source intersection never logs the protected title, snippet, body, participant ACL list, or raw tool response.

Upload recovery

Action	Actor	Safe fields
document.upload.recovery.requested	Fixed SYSTEM component system:document-upload-recovery	Stored owner-bound journal event UUID target; opaque attempt UUID, closed action, receipt kind, state, cleanup, reason
document.upload.recovery.finished	Same SYSTEM component	Same exact target and attempt correlation; acknowledged cleanup outcome or bounded pending/unconfirmed reason

The requested event commits before cancellation fences or provider I/O. Failed or unknown intent acknowledgements permit no effects. Finished success requires acknowledged cleanup; outcome audit failure returns an explicit non-success gap and cannot imply rollback. These closed payloads reject missing, unrecognized or private fields. The component identity provides no authenticated human or runtime instance attribution; CLI/environment person claims cannot override it. Owner text, raw blob keys, private exception messages and credentials are excluded. Read-only inspect/list and foreign or inapplicable actions emit no mutation claim.

Sandbox

Action	Actor	Safe fields
chat.tool.run_code	Initiating participant	Turn/session correlation, ephemeral or persistent kernel mode, bounded outcome (resource_denied:<reason> when a chat-room run's projection is refused, unavailable:<reason> when a resource-authorization check names itself) and usage counts, retained output ids (a file identical to its latest saved version is listed under that version's id rather than stored again), and bounded projected-resource ids/kinds/versions/digests/sizes visible under the actor's existing ACL
chat.tool.write with tool_name=edit_workspace	Initiating participant	Turn correlation, guarded tool name, confirmation policy, and committed/denied/error outcome; never patch text, paths, retained snapshots, or register contents
member.conversation.sandbox.isolation_denied	Initiating participant or system	Conversation/run correlation, audience version, sandbox backend, sandbox_scope_unavailable; also written when a room's files changed under a run, paired with a chat.tool.run_code outcome of resource_denied:resource_manifest_changed
member.conversation.resource.linked	Initiating participant	Only the immutable output version that passed room-link policy, including its bounded name, type, digest, and size

Workspace keys, resource bytes, raw run capabilities, object-store keys, and raw sandbox output are prohibited.

Federated clusters

Action	Actor	Safe fields
oauth.consent.granted	Linking member	Federation name, shared_idp:<issuer> provider (also the target id), grant=device_code, and the realm identity that approved: linked_subject and linked_username from the issuer's token; written once when the member's approved device grant is stored
oauth.refresh.revoked	Linking member	Federation name, provider, reason=invalid_grant; written when the shared realm refuses the stored link and Kaizen forgets it
chat.tool.federated_request	Initiating member	Turn correlation, federation name, GET or POST, receiver path, the receiver's HTTP status, and refusal (not_linked, link_revoked, route_not_allowed, unknown_federation, or issuer_unavailable) when Kaizen did not send the call, or failure (transport_error, cancelled) when the call got no answer and may have run. Outcome ok below 400; failed at 400 or above, for issuer_unavailable and for any failure; denied for every other refusal

Tokens, request bodies and response bodies are prohibited. A refused call carries no status, which is how an operator shows that a member without a link never reached the receiving cluster.

Projects and history search

Action	Safe fields
member.project.created, .updated, .archived, .restored, .deleted	Project id, revisions, changed field names, lifecycle state, bounded impact counts and digest
member.project.invitation.created, .accepted, .revoked	Invitation/membership ids, recipient digest, expiry, membership epoch
member.project.member.revoked, .left, .access_changed	Membership id and revision, owned-pointer and surviving-access impact categories
member.project.chat.linked, .moved, .unlinked	Conversation and Project ids already authorized, pointer and audience revisions, safe impact categories and digest
member.project.library.linked, .unlinked, .access_changed	Project id, item kind, and document Shared or Private pointer state; no item body
member.project.library.preference_updated	Project id and the member's boolean default for future links
member.conversation.search.denied, .partial	Scope/mode/provider kinds, bounded eligible and result counts, latency class, partial reason

These never include Project names or tags, queries, snippets, answer text, source/tool/file names, requirement descriptors, raw candidates, ACL members, tokens, or credentials.

Tasks

Action	Actor	Safe fields
member.task.created, .updated, .activated, .paused, .resumed, .deleted	Task owner	Task id, old/new revision where applicable, target and schedule kind; creation source when server-derived from Chat
member.task.run_now	Task owner	Task, occurrence, run, definition revision, manual trigger
member.task.cancel_requested	Task owner	Task/run id, resulting bounded state
member.task.goal_input_answered, .goal_steered	Task owner	Task/run id and exact accepted input or pending-request id; never message text
task.occurrence.created, .enqueued	Bound owner via task service	Task, occurrence, run, definition revision, trigger, test-mode boolean
task.run.started, .checkpointed, .retried	Fenced worker for bound owner	Task, occurrence, run, attempt, state, bounded error category
task.run.approval_waiting	Fenced worker for bound owner	Task, occurrence, run, attempt, approval request id, waiting state
task.run.succeeded, .failed, .cancelled, .policy_blocked	Fenced worker for bound owner	Task, occurrence, run, attempt, terminal state, bounded error category
task.run.model_grant.issued	Member API edge, inside the safe-test transaction	Task, run, capability grant id, purpose task_draft_test; never the bearer
task.run.model_grant.consumed	Fenced worker for bound owner, on the test run's execution resolution	Task, run, capability grant id, purpose
task.run.model_grant.refused	Fenced worker for bound owner	Task, run, capability grant id, purpose, reason (expired, binding_mismatch or invalid); outcome denied
task.run.expired	Handoff repair, attributed to the bound owner	Task, occurrence, run, attempt, expired, platform_execution_unavailable, for a run that waited past TASKS_BLOCKED_RUN_EXPIRY_SECONDS for platform execution authority
task.corpus.started, .phase_changed	Fenced worker for bound owner	Task/run ids, closed phase or operation
task.corpus.authorization_denied, .retried, .budget_exhausted	Fenced worker for bound owner	Task/run ids, closed phase, bounded reason category
task.corpus.published	Fenced worker for bound owner	Task/run ids, complete phase, partial or succeeded outcome

Idempotent run-now or retry requests converge on the existing occurrence and run. Replays do not mint another conversation, occurrence, run, credential, or logical audit outcome.

For source=chat_background_job, the Task ledger also keeps a content-minimized owner-scoped binding among conversation id, accepted input id, exact agent component/version, request digest, Task id, and run id. The binding is provenance and idempotency state, not copied chat content or a credential.

Never included: task input text, model output, tool arguments, credentials, identity envelopes, source titles or paths, record properties, locators, raw provider errors, hidden reasoning.

Delegated workload authority

Core records the platform side of unattended authority in the same append-only funnel. Kaizen correlates these records by opaque IDs and does not duplicate their sensitive payloads.

Action	Safe fields and outcomes
delegated_workload.registration_reconciled, .resource_registration_reconciled	Registrar, deployment/revision/descriptor digests, role or resource contract, desired state; created, idempotent, staged, activated, draining, retired, revoked, stale, conflict, or denied
delegated_workload.attestation_profile_selected, .attestation	Role, workload revision, acceptable-profile-set digest, selected profile and closed reason; preferred, portable fallback, recovered, unavailable, succeeded, denied, expired, or stale registration
delegated_workload.intent_created, .consent_viewed, .consent_decided, .grant_transitioned	Intent/grant/member/client/revision/policy correlation; succeeded, approved, denied, expired, conflict, or CSRF denied
delegated_workload.run_reserved, .run_claimed, .run_claim_expired, .run_transitioned	Grant/run/claim, occurrence-key and queue-reference digests, workload revision, authority deadline, lease, and fence digest; queued, claimed, idempotent, requeued, terminal, succeeded, conflict, fenced, ambiguous, or denied
delegated_workload.capability_issued, .capability_rejected	Capability family/class, audience, scope digest and expiry, never token material; succeeded, denied, replay, expired, or revoked
delegated_workload.effect_reserved, .approval_decided, .effect_transitioned	Run/claim/fence, exact-effect digest, resource registration, action, policy, quota and approval IDs; reserved, pending approval, executing, succeeded, failed, cancelled, ambiguous, replay denied, fenced, conflict, or denied
delegated_workload.quota_attributed	Member charge owner, workload budget subject, adapter, correlation, bounded units and settlement reason; reserved, committed, released, ambiguous, or denied
delegated_workload.credential_use, .provider_credential_revoked	Binding/lease, operation and destination digest, revocation-handle digest and acknowledgement; reserved, succeeded, failed, expired, revoked, ambiguous, acknowledged, or pending
delegated_workload.revoked, .readiness	Revoked parent and closed reason, or contract version and component states; succeeded, already revoked, denied, ready, degraded, unavailable, or incompatible

Every event uses the shared correlation chain from intent to grant, run, effect, quota, and credential use. Safe digests prove equality; they never authorize viewing the underlying descriptor or request. Assertion bodies, DPoP material, capabilities, nonces, credentials, prompts, provider bodies, raw exceptions, and unbounded labels are rejected before persistence rather than redacted afterward.

Member preferences

Action	Actor	Safe fields
member.compression.preference.updated	Authenticated member	Master, Tool-result, and Plain-speak boolean values
member.compression.stats.reset	Authenticated member	Reset timestamp
member.approval.preference.updated	Authenticated member	Selected global mode
member.agent.approval.preference.updated, .deleted	Authenticated member	Agent id and selected mode when present
member.identity.avatar.updated, .cleared	Authenticated member	Target kind member_identity and the new picture version; never the image bytes, the original file name, or its type
tool.approval.requested, .sandbox_released, .sandbox_release_failed, .consumed	Shared runtime for authenticated owner	Agent id, tool name, task run id when present, canonical arguments digest
member.tool.approval.approved, .denied	Authenticated member	Approval id, tool name, task run id when present, and whether the approved tool was remembered for that Chat

Reading preferences, listing approval requests, reading statistics, and folding per-turn operational measurements emit no audit events.

The conversation journal also appends tool_approval_requested and the causally linked tool_approval_approved or tool_approval_denied fact. An approval that remembers the tool adds decision_scope=tool_chat to the approved fact; it does not record raw arguments or change the Chat mode. Those are room-replay records rather than security audit actions. They retain only member-safe identifiers and the request's argument digest; the mutable one-shot approval row can later be consumed without rewriting either journal.

Task run trace event families

task_run_event is a member timeline, not an audit row. Its families:

• occurrence.created, .skipped, .expired
• run.queued, .claimed, .started, .retry_scheduled, .succeeded, .failed, .cancelled, .policy_blocked
• authority.resolved, .blocked
• target.resolved, .blocked
• step.started, .progress, .retry, .completed, .failed
• approval.waiting, .approved, .denied, .expired, .drifted
• goal.awaiting_input, .input_answered
• output.published
• cancellation.requested, .acknowledged

Source detail inside a trace envelope is re-authorized at read time and returns authorized, redacted, or payload_unavailable.

Denial reason codes

Bounded categories used across the surface:

not_found · forbidden · agent_not_shareable · conversation_not_shareable · participant_limit · idempotency_conflict · resource_not_linked · source_not_visible_to_audience · sandbox_scope_unavailable · missing_kamiwaza_identity_envelope · invalid_kamiwaza_identity_envelope · kamiwaza_identity_missing_email

Delegated-workload reason codes are a separate closed platform vocabulary, including current-authority denial, inactive or mismatched registrations and grants, unavailable capability or credential binding, quota or destination denial, cancellation, replay, policy drift, claim/effect commitment, and provider-revocation state. Unknown or duplicate codes fail before append.