raxit audit (tail & verify)
raxit audit tail and raxit audit verify -- stream and verify the audit chain.
raxit audit tail streams recent decisions from the audit log. raxit audit verify walks the
hash chain and confirms no record has been tampered with since it was written.
raxit audit tail
$ raxit audit tail --n 50 --audit .raxit/var/daemon-audit.jsonl
SEQ CALL_ID TIME AGENT ACTION->RESOURCE EFFECT REASON
------------------------------------------------------------------------------------------------------------------------
1 reload-b33c5def94c29b0b 2026-07-11T22:27:39Z default-agent policy.reload->polic.. permit policy.reload
2 reload-74e197fdff0a476d 2026-07-11T22:27:54Z default-agent policy.reload->polic.. permit policy.reload
3 e5c17818a2c942bbb830dce66cbae312 2026-07-11T22:28:06Z default-agent tool.call->calc permit permit
4 916d497a38234529abe69b55e4339a96 2026-07-11T22:28:06Z default-agent tool.call->read_cust.. permit permit
5 d867c63661454e8497369a08ebaec35d 2026-07-11T22:28:06Z default-agent tool.call->post_to_w.. defer defer.policy--json emits one line per record (dev-audit.jsonl shown here, which only has policy-apply
events at this point):
$ raxit audit tail --n 3 --json
{"seq":1,"call_id":"apply-50ed596f1cdbb735","time":"2026-07-11T22:27:39Z","agent":"default-agent","action":"policy.apply","resource":"policy","effect":"permit","reason_code":"policy.apply"}
{"seq":2,"call_id":"apply-1504320438e99f8d","time":"2026-07-11T22:27:54Z","agent":"default-agent","action":"policy.apply","resource":"policy","effect":"permit","reason_code":"policy.apply"}Note dev-audit.jsonl records the client leg of an apply as policy.apply (apply- call-id
prefix), while daemon-audit.jsonl records the daemon's own reload as policy.reload
(reload- prefix) — these are two logs recording two legs of the same operation, not
duplicates.
Each raw JSONL record is the dpr/2 schema (Decision Provenance Record):
{"schema":"dpr/2","seq":5,"prev_hash":"0bc499dda5170ebf7336bd67582d4f15a14097c9c22fcba562a1c7dd0a6ed0dd","record_hash":"fc9d708826e4acdb6a8ea5a213b072d649a5967c9d7244b033794b76546c80fd","call_id":"d867c63661454e8497369a08ebaec35d","session_id":"testbed","agent_id":"default-agent","action":"tool.call","resource":"post_to_webhook","effect":"defer","decision_type":"DEFER","policy_ids":["defer-post_to_webhook"],"reason_code":"defer.policy","denial_token":"dt_1373bb3e0bcf139d","adapter":"sdk","policy_version":"49e46c6a86004454","args_hash":"ced38803a54f367c9786c099db83b5dcf22eba7d448223e27c462e25796e4201","created_at":"2026-07-11T22:28:06.360152Z","prior_actions":["calc","read_customer_db"]}raxit audit verify
$ raxit audit verify --audit .raxit/var/daemon-audit.jsonl
audit verify: OKA genuinely tampered record (content edited without recomputing record_hash) fails with a
distinct message:
$ raxit audit verify --audit .raxit/var/daemon-audit-tampered.jsonl
audit verify: FAIL: record 5 (seq 5): record_hash mismatch (tampered)
audit chain integrity check failed: record 5 (seq 5): record_hash mismatch (tampered)
$ echo $?
1Flags
tail --n <count> [--json] [--audit <path>]verify [--audit <path>] [--agent <id>]
Gotchas
audit's default --audit path is .raxit/var/dev-audit.jsonl, but a daemon started with
raxit serve writes to .raxit/var/daemon-audit.jsonl. If you started serve, always pass
--audit .raxit/var/daemon-audit.jsonl explicitly, or tail/verify will read an empty or
stale log.
A "divergent genesis" failure is not tampering. The chain's genesis hash is seeded from the
agent id at chain-creation time; verifying with the wrong --agent produces a distinct,
explicitly-worded message rather than misreporting a genesis mismatch as a broken chain:
$ raxit audit verify --audit .raxit/var/daemon-audit.jsonl --agent totally-different-agent
audit verify: FAIL: this audit log's genesis was seeded for a different agent than "totally-different-agent" (not tampering); pass --agent <the id the chain was created with>, or start a new chain
$ echo $?
1--agent defaults to the agent: field in security.yaml — never guessed — so a real record
hash mismatch (genuine tampering, shown above) and a genesis mismatch (wrong --agent flag) are
always distinguishable in the output text.