Activity record

Activity capture records what the agent did in a session, such as model calls, tool calls, edits and approvals, and sends these records to your organisation's Govern deployment, the same service the Editor reports to.

By default each record holds metadata and SHA-256 hashes only. Your prompts, the model's answers, file contents, diffs, terminal output, setting values and your environment are not sent.

Capture is off unless your organisation's policy turns it on or you turn it on yourself. It never runs while you are signed out of Govern, unless your organisation runs its own receiver.

Run neuralinverse activity (or /activity in a session) at any time to see whether capture is on, why, and exactly what is recorded about you.

When capture is on

The CLI decides in this order; neuralinverse activity status says which rule applied.

1. No destination: off. Capture is off while you are signed out, unless a self-hosted endpoint and token command are configured, or an embedding host takes the events.
2. activity.required: true in managed policy: on, and locked; you cannot turn it off.
3. activity.enabled: false in managed policy: off, and locked.
4. Your own activity.enabled: false: off.
5. activity.enabled: true in managed policy: on. This is a default you may opt out of with step 4.
6. Your own activity.enabled: true: on.
7. Otherwise off.

"Managed policy" means any managed layer: managed-settings.json, a remote policy, or your organisation's signed Govern policy.

What is captured

The CLI posts events to <Govern API>/api/v1/ingest/events. The body is a JSON array of flat snake_case events, gzip-compressed. Every event carries this envelope:

The CLI never sends an organisation id or a user id; Govern derives both from your sign-in token.

Never captured

In any mode: terminal and tool output, setting values, environment variables, file contents, and paths outside the workspace (they appear only as outside_workspace: true).

Raw content (organisation policy only)

An organisation can set activity.content: "raw" in its managed policy. Raw mode adds the prompt text, the model's response text, diffs and shell commands. Each field first passes the built-in secret scanner, which replaces every credential it recognises with [REDACTED:<rule>], and is capped at 32 KB. activity.content in your own or a project's settings has no effect.

Exclude paths

activity.exclude takes workspace-relative globs. Tool calls and edits that touch a matching path are not captured at all. A pattern without / matches a file name anywhere.

{ "activity": { "exclude": ["secrets/**", "*.pem", "customer-data/**"] } }

Inspect what is recorded

neuralinverse activity            # on or off and why, endpoint, queue size, last upload
neuralinverse activity log [n]    # the n oldest queued events as JSON, exactly as they will be sent
neuralinverse activity flush      # upload queued events now
neuralinverse activity purge      # delete queued events (capture continues if your organisation requires it)

In a session, /activity shows the status, /activity log [n] the events this session recorded, exactly as sent, and /activity flush uploads now.

Delivery

• Durable queue. Events are appended to ~/.neuralinverse/activity/queue/<account>/ (folder 0700, files 0600) before anything is sent. The queue survives crashes, restarts and offline periods, and is kept per signed-in account, so events are never uploaded with another account's token.
• Several processes. Each CLI process appends to its own segment; one process at a time uploads, coordinated by a lock file.
• Bounded. Past 50 MB or 200,000 events (configurable), the oldest events are dropped and a capture_dropped event records how many.
• Batches. At most 500 events or 1 MB per request, gzip-compressed, with plain JSON as a fallback if the server refuses gzip.
• Retries. Network errors, 408, 429 and 5xx are retried with exponential backoff and jitter (1 second doubling to 5 minutes), honouring Retry-After. A batch is removed only after the server accepts it; a resend carries the same event_ids. A batch rejected for good (any other 4xx) is dropped and reported as capture_dropped.
• Sign-in. On a 401 the CLI refreshes your token once and resends. If that fails, uploads pause until you sign in again; the events stay queued.
• Shutdown. When a session ends, the CLI tries to upload for up to 2 seconds. The rest is sent by the next session or by activity flush.

For administrators

To turn capture on for everyone signed in to your organisation, put this in the managed policy:

{
  "activity": {
    "required": true,
    "exclude": ["**/*.env", "secrets/**"]
  }
}

Use "enabled": true instead of "required": true to make capture the default while letting people opt out. Add "content": "raw" only if your organisation needs prompts and diffs, and has told its developers.

Self-hosted receivers

To send events somewhere other than Govern, set both activity.endpoint and activity.tokenCommand. The first line the command prints is used as the bearer token; it is cached for five minutes and run again after a 401. This works while signed out too. The receiver gets exactly the requests Govern would.

Inside a governing host

When the CLI runs inside a host such as the Editor's shared agent host, events go to the host instead of the CLI's queue, with the same envelope and privacy rules. Capture is then on unless your settings or managed policy turn it off. The host applies your organisation's policy and forwards the events with its own sign-in.

Known gaps

On the Govern side, the current ingest route POST /api/v1/ingest/events runs on the telemetry plane's own listener, is protected by a service token rather than a person's access token, and expects an object of the form {"events": [...]} rather than the CLI's flat, gzip-compressed array. Several of the CLI's event types (for example prompt_submit, edit_applied, capture_dropped) are not among the types the ingest plane lists. Delivery of the CLI's activity to Govern is therefore not confirmed end to end; events stay queued locally when the server refuses them for a retryable reason, and are dropped and reported as capture_dropped when refused for good. A self-hosted receiver works as described above.

Separately, the CLI writes its own audit log on the machine, which does not depend on Govern.