Skip to main content
By the end of this page you can answer “who did what”, “how is the server doing”, and “what just happened” — from the audit log, the metrics route, and the daemon log respectively.

​
Audit log

Every permission decision — allowed or denied, over WebSocket sync or MCP — is recorded durably in oracle.db with the acting user, capability, workspace, decision and timestamp. Entries are kept for auditRetentionDays (default 90; raise it for compliance retention — there is no upper cap) and pruned hourly.
list resolves actor names through the current user directory at view time; export emits the raw rows as JSONL, oldest first. Both work while the daemon runs — reads are lock-free. --since/--until take ISO date-times or relative forms (30m, 24h, 7d).

​
Metrics

GET /metrics on the daemon’s bind returns a JSON snapshot of operational state: version and uptime, bind lifecycle, connected peers (same-device vs LAN), workspace count, per-subsystem status, stored mutations (total and last 24h), audit decision counts, and the observability ring size. The route is read-only and token-gated — every request presents a paired token, loopback included, validated against the same ledger as WebSocket sync and MCP.
Browser-originated requests are refused outright (same posture as /mcp), and a wrong token counts toward the per-peer rate limit.

​
Logs

The daemon appends to <data dir>/logs/daemon.log, one line per event:
Authentication rejections include the peer address and reason on a single line, so log scanners can match them directly. Tune verbosity with --log-level (error, warn, info, debug; persisted like every install flag).