---
title: "Activity Log and audit upload"
---

# Activity Log and audit upload

What the Editor records in its encrypted, tamper-evident activity ledger, how to read it in the Activity Log, verify it, export an evidence bundle, erase your own content, and how uploading to your organisation's Govern deployment works.

The Editor records what people, agents, extensions and the command-line tools do, on the device, in an encrypted, tamper-evident ledger. You read it in the **Activity Log**. Capture is for security and compliance, not performance management. By default nothing leaves the device until someone exports an evidence bundle.

## What is recorded

- Your actions that matter as evidence: opening and trusting workspaces, saving files, running tasks and commands you invoke, git operations, settings changes (security settings with old and new values, others by key only), large pastes (size and digest only).
- Agent sessions, prompts, tool calls and edits, for every engine the agent host runs (Claude, Codex and the Editor's own agent), through the engines' own hooks.
- Extensions as actors: the child processes they start and the hosts they first contact in a session.
- Invocations of the command-line tools, including while no app runs.
- Every governance decision, approval, signature, waiver, gate result and policy change; every Checks decision; evidence builds and verifications.
- At every start, the app's integrity record: code signature, version, product checksums and debugging entry points.

Not recorded: keystrokes, clipboard content, the content of files you view, tokens, and setting values outside the security list. Paths are workspace-relative or digests. Secrets are removed before anything is hashed, encrypted or written.

### Capture levels

Your organisation sets the capture level:

| Level | What is kept |
|---|---|
| Minimal | Identities, actions, outcomes and digests; no paths, no command lines |
| Standard (default) | Adds workspace paths, redacted command lines, model and tool names, and digests of prompts, responses and diffs |
| Full | Adds raw prompt and response text, raw diffs and capped, redacted terminal output. Only a managed policy can set this. |

## Where the ledger is

The ledger lives in the data folder both apps share, `~/.neural-inverse-shared/` (folder `neural-inverse-audit/<quality>`), owner-only and never inside a repository. The Editor and the Agents app record into one ledger: whichever starts first writes it, and the other relays to it.

The key-encryption key is held in the OS keychain (macOS Keychain, Windows Data Protection, or the Linux Secret Service). Without a keychain, a managed install refuses to record; an unmanaged install asks you to create a passphrase-protected key file (at least 12 characters). Recording then waits until you run **Enter Audit Key File Passphrase**. Without the passphrase, recorded content cannot be read.

## Open the Activity Log

Run **Open Activity Log**, or open the **Activity Log** panel. It shows:

- **Recorded actions, newest first**, with filters: time range (Last Hour, Last 24 Hours, Last 7 Days, Last 30 Days, All Time), actor (User, Agent, Extension, System), minimum severity, an action prefix such as `git.`, and text search. **Load Older Actions** pages back.
- **Selected action**: everything recorded about it. Fields not kept at the current capture level read "Not captured at this capture level".
- **Show Trace**: every action of one trace in causal order, from prompt to commit. **Back to All Actions** returns to the list.
- **Ledger and Policy**: the recording state, ledger size and disk usage, the last signed checkpoint and head hash, key storage, the **Device signing key** fingerprint, legal hold, and the settings your organisation enforces.
- **What This Record Proves**, and what it does not.

**Refresh Activity Log** reads the ledger again.

## Verify the ledger

Run **Verify Ledger**. It checks every record and every signed checkpoint: "Checked N records and M signed checkpoints in K segments." A failure names the first affected record.

The ledger proves that the record on this device has not been altered, reordered, truncated or partially deleted since each signed checkpoint, by anyone without the device's keys; which identity performed each action; and what content was involved, as digests. It does not prove on its own that a person with administrator rights and your keychain did not rebuild the whole ledger before a checkpoint left the device. That needs an external anchor: an RFC 3161 time-stamp authority, if your administrator configured one (`NeuralInverseAuditTsaUrl`).

## Export an evidence bundle

1. Run **Export Evidence Bundle**.
2. Choose what the bundle should contain: a time range or one trace (**Trace ID to export**).
3. Choose the export options:
   - **Reveal Sensitive Fields** includes decrypted prompts, paths and command lines where they were captured. Otherwise only their commitments are exported.
   - **Pseudonymise Identities** replaces identities with stable pseudonyms. The bundle still verifies but cannot by itself attribute actions to named people. Your organisation can require this.
   - **Also Write Checks Formats** writes the Checks ledger formats as well.
4. Save the bundle (`.niaudit.json`). It is signed with your device key, and the export is recorded.

When your organisation lists evidence builders (`NeuralInverseAuditEvidenceAllowedBuilders`), an export for someone else names its audience inside the signed bundle, and an audience not on the list is refused.

**Export Pseudonym Mapping** saves the mapping from pseudonyms to identities to a local file ending in `.nipseudonyms.json`. It is an explicit, recorded action.

Anyone can verify a bundle offline with the Neural Inverse source:

```sh
scripts/ni-audit-verify.sh --expect-key <fingerprint> <bundle.niaudit.json>
```

Exit codes: 0 verified, 1 error, 2 tampered. Give auditors your device key fingerprint from the Activity Log, through a different channel than the bundle. To combine bundles into an answer for a release or a period, build an [evidence pack](https://neuralinverse.com/docs/editor/evidence-packs/).

## Erase your own content

Run **Erase My Recorded Content**, choose which recorded content (by data class), and the first and last day (UTC, `yyyy-mm-dd`). The keys for that content are destroyed, so nobody can read it again, including you. The record that each action happened and its commitments stay, so the ledger still verifies. The erasure is itself recorded.

Erasure is refused while a legal hold is in force, and when your organisation does not allow it (`NeuralInverseAuditUserErasureAllowed`, off on managed installs by default).

## Legal hold and key rotation

- **Set Legal Hold** suspends erasure and retention deletion. **Release Legal Hold** ends it. Both are recorded.
- **Rotate Audit Keys** wraps the existing data keys with a new key-encryption key. Recorded events are not rewritten. The rotation is recorded.

## When the ledger cannot record

If the ledger cannot record (keychain locked, disk full, integrity failure), the failure mode decides:

- **Block** (default on managed installs): AI tool calls, agent-run terminal commands, extension installs, agent sessions and state-changing CLI commands wait until the ledger can record them. Editing and saving files keep working.
- **Alert** (default otherwise): work continues and you are told the ledger is unavailable.

While the ledger cannot record, the status bar shows **Audit Unavailable**; its tooltip gives the reason and clicking it opens the Activity Log. **Audit Locked** means recording waits for the key file passphrase; click it to enter the passphrase. Every refusal is recorded once the ledger recovers.

## Audit settings are governed

Audit settings take their value only from managed policy; a value in a settings file has no effect, so audit cannot be turned off from `settings.json`. When your organisation changes a policy to record less, the stricter values stay in force until the change is confirmed in the app, and the confirmation is recorded as a warning. Tightening applies at once. Every audit policy is listed in [Settings and policies](https://neuralinverse.com/docs/editor/settings/#audit).

## Uploading to Govern

Off by default. Your organisation can turn on:

| Policy | What is sent | Route |
|---|---|---|
| `NeuralInverseAuditUploadEnabled` | Audit events of AI agents, from the next event on | `POST /api/v1/agents/audit`, with the installation's agent token |
| `NeuralInverseAuditUploadPerson` | Also what you did yourself (metadata only). Needs upload enabled. | `POST /api/v1/audit/client-events`, with your own access token |
| `NeuralInverseAuditUploadContent` | Also the redacted content of prompts, responses, commands, paths, diffs and output of agent events, as far as the capture level recorded it | as above |

- Upload needs a signed-in session; without one nothing is queued or sent.
- A verified signed policy can carry the same switches. An off from any source wins; content needs every source that speaks to say yes.
- Prompts, responses, diffs and output never travel on the person lane. Extensions, the system and the ledger's own events are never uploaded.
- Events are queued durably before they are acknowledged, and delivered at least once; Govern records each once. Events Govern refuses for good are listed in `outbox/rejected.jsonl` and recorded as `audit.upload.rejected`.
- The Activity Log shows when upload is enabled, disabled, paused, resumed, rejected, has a gap, or recovered its queue.

Nothing is ever sent to Neural Inverse. The only other network call the ledger can make is the optional time-stamp request.