Audit and evidence
Note
Guide: draft. The source build implements the current behavior below; remaining design work is marked explicitly.
Audit log
The audit log is an append-only JSON Lines file of audit events linked by a hash chain. It is tamper-evident, not tamper-proof.
Evidence
Hook requests and decisions produce audit events before the hook responds.
Offline check and explain do not write hook audit events.
Approval and grant events exist in the Unix daemon’s source implementation.
Command and URL values are recorded as digests, as described in audit events.
Verification
shiin verify checks that the log’s hash chain is intact.
Replay
shiin replay re-evaluates captured requests with the originating replay key and can compare a different policy.
Receipts
Signed receipts attest that a decision was made when evidence recording is enabled in the daemon. A receipt proves who signed a statement about a decision, not that the action’s real outcome was correct.