feat(#742): agent audit trail — structured action logging#745
Closed
feat(#742): agent audit trail — structured action logging#745
Conversation
Adds a queryable audit trail for all agent actions. Every ability
invocation, permission change, and resource mutation is recorded in
a new datamachine_agent_log table with agent_id, action, result,
resource info, and JSON metadata.
New components:
- AgentLog repository (DB table + CRUD + pagination + pruning)
- AuditLogger static helper (resolves agent context automatically)
- REST API: GET /datamachine/v1/agents/{id}/log (with period/action/result filters)
- CLI: wp datamachine agents log <slug> (with --period, --action, --result)
- AuditCleanup Action Scheduler task (daily, 30-day retention)
Audit hooks at 8 trigger points:
- flow.run (RunFlowAbility)
- job.complete (JobCompleteHandler)
- job.fail (FailJobHandler)
- pipeline.create (CreatePipelineAbility)
- pipeline.delete (DeletePipelineAbility)
- agent.access.grant (AgentAccess)
- agent.access.revoke (AgentAccess)
- memory.write (AgentMemoryAbilities)
Closes #742
Homeboy Results —
|
Member
Author
|
Closing — this adds a redundant log layer instead of fixing the existing one. The real work is modernizing the Monolog system to use agent_id instead of AgentType (pipeline/chat/system). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a queryable audit trail for all agent actions. Every ability invocation, permission change, and resource mutation is recorded in a structured database table — separate from Monolog operational logs, designed for compliance queries and debugging.
Part of the agent-as-service-account architecture (follows #738, precedes #740 agent runtime auth).
What's new
Database
datamachine_agent_logtable — structured rows withagent_id,action,result,resource_type,resource_id, JSONmetadata, timestamps(agent_id, created_at),action,(result, created_at),(resource_type, resource_id)Core
AuditLogger::record()— static helper that resolves agent context fromPermissionHelperautomatically, then writes to DB and firesdatamachine_audit_eventaction for extensibilityAgentLogrepository — full CRUD with paginated filtered queries and bulk pruneREST API
GET /datamachine/v1/agents/{id}/log— paginated, filterable byperiod(1h/24h/7d/30d/all),action,result,resource_typecan_access_agent($id, 'operator')— operators and adminsCLI
wp datamachine agents log <slug>with--period,--action,--result,--limit,--formatRetention
AuditCleanupAction Scheduler task — daily recurring, 30-day default (filterable viadatamachine_audit_log_max_age_days)Audit hooks (8 trigger points)
flow.runjob.completejob.failpipeline.createpipeline.deleteagent.access.grantagent.access.revokememory.writeArchitecture
Testing
php -lsyntax checkBaseRepository,ActionSchedulercleanup, REST API registrationFuture hooks (when #740/#741 land)
auth.token.used— bearer token authenticatedauth.token.failed— invalid token attemptpolicy.denied— tool policy blocked an abilityCloses #742