Activity & evidence

Filter by agent, event, outcome, date and session, and read the human summary before the technical detail. The first place to look for most questions.

Identity, Ability, context, decision and outcome — the five things every evidence record carries, and how to read one without needing the agent’s source code.

A stable digest of the request that lets an approval bind to exact inputs. What it proves, what it does not, and how to use it when comparing two requests.

HMAC-SHA-256 chaining with a signed head means the record can prove it has not been edited. How to run a full-chain verification and when it is worth doing.

Treat a verification failure as serious and preserve the state before changing anything. The legitimate causes, the ones that are not, and what to do first.

The request ran but the result could not be confirmed. Check what WordPress actually holds before repeating anything; a blind retry doubles the change.

Sensitive input is redacted on the way out — when a record is displayed or exported — not discarded on the way in. Why that ordering matters.

Retention is opt-in and bounded: 7–365 days and 1,000–1,000,000 events. Extending is routine; shortening destroys evidence and must be confirmed.

Get decision records out of the site for review, with redaction applied and fingerprints intact, and know when to export before you lose the chance.