autonomy audit query

Query retained audit records

Synopsis

Reads audit records from the local audit store and prints matching records.

When --pg-url is set (or AUTONOMY_AUDIT_PG_URL is in the environment), records
are read from the PostgreSQL audit_events table. Otherwise the local JSONL file
store is used (--audit-dir).

Filters (all optional, ANDed together):
  --event-type        exact event name (e.g. "rollout.plan.created")
  --category          audit domain: rollout | ha | relay | cert | auth | system | rollback
  --actor             operator identity (e.g. "alice@example.com")
  --outcome           result: success | failure | denied | pending
  --source            emitting component: orchestrator | edge | cli
  --start-time        RFC3339 inclusive lower bound (e.g. "2026-01-01T00:00:00Z")
  --end-time          RFC3339 inclusive upper bound
  --limit             maximum records to return (default 100, 0 = no limit)
  --include-preflight also merge ContractRefine preflight verdicts from the
                      local telemetry WAL (event_name="autonomy.preflight")
  --with-explainability also merge runtime decision events from the local
                      telemetry WAL (event_name="autonomy.decision"), with
                      the #747 C05+C06 explainability fields (matched_rule_id,
                      matched_rule_file, matched_rule_line, matched_rule_column,
                      evaluation_trace, remediation_hint, rule_effect)
                      surfaced in the record's Fields
  --telemetry-dir     override telemetry WAL directory (only relevant with
                      --include-preflight / --with-explainability;
                      default: AUTONOMY_WAL_DIR / XDG)

Output:
  --output text  tabwriter table (default): TIMESTAMP EVENT ACTOR RESOURCE OUTCOME SOURCE
  --output json  pretty-printed JSON array

Usage

autonomy audit query [flags]

Options

      --actor string           filter by operator identity
      --audit-dir string       audit storage directory (default: AUTONOMY_AUDIT_DIR or XDG state path)
      --category string        audit domain filter: rollout | ha | relay | cert | auth | system | rollback
      --end-time string        inclusive RFC3339 end time
      --event-type string      exact event name filter (e.g. "rollout.plan.created")
      --include-preflight      also merge ContractRefine preflight verdicts from the local telemetry WAL
      --limit int              maximum records to return (0 = no limit) (default 100)
      --outcome string         result filter: success | failure | denied | pending
      --output string          output format: "text" (tabwriter table) or "json" (array) (default "text")
      --pg-url string          PostgreSQL URL for DB-backed audit query (env: AUTONOMY_AUDIT_PG_URL)
      --source string          component filter: orchestrator | edge | cli
      --start-time string      inclusive RFC3339 start time (e.g. 2026-01-01T00:00:00Z)
      --telemetry-dir string   telemetry WAL directory (only with --include-preflight / --with-explainability; default: AUTONOMY_WAL_DIR)
      --with-explainability    also merge autonomy.decision events from the local telemetry WAL, surfacing the #747 C05+C06 explainability fields (matched_rule_id, matched_rule_file, matched_rule_line, matched_rule_column, evaluation_trace, remediation_hint, rule_effect) on each record. Composes with --include-preflight.

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also