Durable permission-decision audit trail (approvals, sandbox scope, hook verdicts)

[jonathanKingston]

Summary

Persist an append-only, exportable, machine-readable log of every control-plane decision — tool approvals/denials, "remember" grants, sandbox-scope classifications, and hook allow/block verdicts — separate from the conversation transcript.

What #644 / #647 already cover

The filesystem-native chat store (#644, landing via #647) already gives an append-only, machine-readable, exportable substrate for the conversation: the events.jsonl spine + byte-preserving OKF message files + per-project catalog.jsonl + content hashing + a Phase-6 export reconciliation. So "what the agent did" (tool calls + their results) is already auditable and evaluatable.

What it does not cover — the gap

The permission/decision layer around those tool calls is not persisted anywhere durable:

• Tool approvals/denials and the "remember" checkbox — src/main/services/approval.ts, src/renderer/views/approval-dialog.ts (in-memory for the session only).
• Sandbox-vs-external scope classifications and any user override — src/main/services/safety-classifier.ts.
• Hook allow/block verdicts — src/main/services/cursor-hooks.ts.
• Sandbox scope grants — src/main/project-sandbox/.

None of these are queryable once the session ends, so you can't answer "what did I approve, when, at what scope, and did I make it sticky?"

Scope

• Define an append-only decision-event stream in the same machine-readable JSONL + OKF shape as Reference past threads across the workspace: a filesystem-native chat store the agent explores like files #644's spine (reuse the src/shared/threads/ patterns; land it under ~/.copse), keyed back to thread/turn.
• Record per event: decision type, actor (user / classifier / hook), subject (command / tool / path), verdict, scope granted, whether it was "remembered", timestamp, and a link to the originating spine event.
• Export command, plus a redaction policy for secrets that appear in recorded commands.
• Machine-readability / provability: evaluate this event schema (and Reference past threads across the workspace: a filesystem-native chat store the agent explores like files #644's) against draft-vaughan-machine-readability — declare a media type / conformance target so the logs are evaluatable by external tooling, not merely re-readable by us. (This folds in the earlier standalone "machine-readable output" idea, since Reference past threads across the workspace: a filesystem-native chat store the agent explores like files #644/Thread referencing: filesystem-native chat store + @ past threads (#644) #647 already deliver the substrate and provability belongs with the log it describes.)

Related

#644 / #647 (thread-spine substrate), #645 (OKF knowledge store), #639 (hooks parity).

[jonathanKingston]

Investigation #1078 separates two permission concerns that should share data without becoming one feature:

• this issue/Add a durable permission-decision audit trail #840: durable decision and approval audit records;
• the existing Codex architecture proposal: future declarative project/thread permission profiles.

The audit schema should ideally retain a normalized profile/capability identity plus actual platform enforcement, so later profiles do not need a second authorization history. Conversely, an audit record must not itself grant authority or turn remembered command text into a broad prefix allow-rule.

No new permission-profile issue was opened from the comparison; the recommendation is to refine that design after this audit trail lands.