GuidesPanduan
Read the audit trail and verify a replayBaca audit trail dan verifikasi replay
The log is append-only and the state is derived from it. Here is how to read one entry, how to spot the near-misses, and how to run a replay check and read its result.Log bersifat append-only dan state diturunkan darinya. Ini cara membaca satu entri, cara menemukan near-miss, dan cara menjalankan pemeriksaan replay lalu membaca hasilnya.
Updated October 2026 · 8 min read · Applies to the Kinship control-plane log
Two different questions get mixed together all the time. The first: what actually happened? The second: can the record be trusted? The first is answered by the contents of the log. The second is answered by a replay.
The log is the state
In this runtime, the state is not stored separately from the log. The state is the result of folding the entries. The consequence is large: if entries could be edited, the state could be edited too, and the audit trail would only prove what someone chose to leave in it.
Entries are appended one at a time, sequence-numbered, and never edited in place. Every state change is a new entry — not an edit of an old one.
Reading one line
Every line follows the same shape: a sequence number, then what happened, then who or what caused it.
#9 card c-2 approved by organiser #10 authorization a-1 issued for draft.promote (revision 7f3c…) #11 card c-3 rejected by organiser: "sudah diumumkan kemarin" — kept as a near-miss record #12 commit commit.individual-message by event-ops refused: class_unavailable
The third line is the most valuable line in the whole log: a draft you rejected, with your reason, kept. A near-miss is the only way to see the system coming close to doing something you did not want — without letting it do it.
Refusals have codes, and the code matters
Every refusal is recorded with its code before the error is thrown. Two codes are the most often confused:
- class_unavailable — the action class is absent from that role's toolset. No grant could bring it back.
- grant_not_found — the action class exists, but no live grant covers it. A grant can close the gap.
The difference decides what you do next: in the first case the problem is in the pack; in the second it is in your permissions.
Running the replay check
A replay means running the log back through the same reducer the live run used, then comparing the two event sequences entry by entry.
If the sequences match, the result reads like this:
matches: true eventCount: 12 detail: 12 event diputar ulang melalui reducer yang sama — hasilnya identik.
If they differ, the check does not stop at "failed". It names the first position where the two sequences differ:
matches: false eventCount: 12 detail: Replay menyimpang di event ke-9. Log tidak lagi menggambarkan state.
A divergence like that means the log no longer describes the state. That is not a cosmetic warning — it is a finding worth stopping for and tracing.
An important note on what a replay proves: it proves the log is sufficient, not that the decisions were good. It cannot tell you whether the right thing happened — only that the record of what happened is faithful.
What the log does not contain
This log does not record how the community feels. That is deliberate: a community health score, an engagement level, whether members feel more valued — none of those can be derived from a sequence of entries, so none of them are claimed as measurements. The effect on members is unmeasured, and the log does not pretend otherwise.
One more thing that is not there: delivery status. In version 0 nothing is sent, so there is no entry claiming a message reached a person. What is there is the authorisation that was issued and the transport refusal that was recorded.
The kinds of entry you will see
| Group | Entries | What it means |
|---|---|---|
| People | MemberRegistered · MemberInputReceived · SuppressionRecorded | Who is in the community, when a member wrote something, and when a member asked to stop. |
| Permissions | GrantIssued · GrantRevoked · GrantConsumed · GrantSuperseded | A permission was issued, revoked, spent, or superseded because the class it covered changed. |
| Proposals | CardCreated · CardDecided | The fleet proposed something, and a human answered approve, edit, or reject — with a reason. |
| Delivery | AuthorizationIssued · AuthorizationConsumed · CommitExecuted · CommitRefused | The authorisation behind a send, and what happened when the transport was asked to deliver it. |
| Event lifecycle | PhaseEntered · PhaseCompleted · PhaseOriginClaimed · EventCheckedOut | Which phase the event is in, and which agent claimed the origin for it. |
| Safety | ShatterTripped · ShatterReleased · EscalationRaised · BudgetStopRaised | A guard fired, a lane froze to draft, someone was escalated to, or a budget stopped the run. |
Frequently asked questions
Why is the log append-only?
Because the log is the state. If entries could be edited, the state could be edited too, and the audit trail would only prove what someone chose to leave in it. Append-only means the only thing that can change the system is a new entry.
Why are refusals in the log?
A refusal is an outcome. A log that only records successes cannot tell you how close the fleet came to doing something you did not want — and the near-miss is usually the entry you will want six weeks later.
What does a replay actually prove?
That the log is sufficient. Replaying it through the same reducer the live run used reproduces the same event sequence, which means the state you are looking at could have been derived from the log alone. It does not prove the fleet made a good decision — only that the record is faithful.
What happens when the replay diverges?
The check names the first position where the two sequences differ, instead of returning a bare boolean. A divergence means the log no longer describes the state — which is a finding worth stopping for, not a cosmetic warning.
Can I run the replay check myself?
Yes. The hosted console exposes it as an action on the same log it uses for the cycle, and the control plane is open source so you can run the same check against your own deployment.
See the log for yourselfLihat lognya sendiri
Run the cycle, then read the trail it left behind.Jalankan siklusnya, lalu baca jejak yang ditinggalkannya.