Security Audit Trail

Audit is now a filter

This page remains at /dashboard/audit and in the command palette for anyone who wants only the retained record. In the navigation, audit history is the Audit filter of the Activity Center, which puts it on one timeline beside live runtime data while keeping it visibly distinct from it.

Cloud Harness MCP records an immutable audit log of all tool invocations and lifecycle operations in SQLite.

Recorded Events

• Workspace lifecycle (workspace_open, workspace_close, TTL terminations).
• Command executions (exec_run, shell_open, shell exits).
• File mutations (files_write, files_delete, files_apply_patch).
• Git operations (git_push, branch switches, commits).
• Security events (authentication failures, permission denials, rate limits).

Logs record timestamps, authenticated principal ID, target repository, and exit status.