Audit log

Every denial, revert, and misfire — appended to one file, so the enforcement plane can be read after the fact.

A refusal that leaves no trace can’t be reviewed. Every interesting decision the enforcement plane makes — a gate denial, a sweep revert, a policy that failed to load — is appended as one JSON line to /var/log/operator-authority/violations.jsonl. Each record carries the agent, the tool, the target, the rule that fired, the task id, and the outcome.

The outcomes

The outcome field is the most telling part of a record. The ones that appear:

Outcome	Meaning
blocked	The gate denied the action.
reverted	The post-hoc sweep undid a protected-path change.
policy-load-failed	The policy couldn’t be read — the gate denied as a result.
shim-init-failed	The shim couldn’t start cleanly (e.g. Landlock couldn’t install).
hook-missing-input	The gate was called with no path/command — a misconfigured hook. Allowed (fail-open) and logged.

Operational snapshot · observed 2026-06-09

The histogram of the live log this day — a point-in-time reading of operations, not a property of the architecture:

  11,203   hook-missing-input
      54   reverted
      47   blocked
      20   policy-load-failed
      12   shim-init-failed
  ───────
  11,336   total records (2.6 MB)

The reverted and blocked lines are the system working: ~100 real protected-path actions stopped or undone. The hook-missing-input line dominating everything else is the finding below.

What the snapshot reveals

Eleven thousand hook-missing-input records that day was not noise — it was a real configuration problem. The interactive gate hook was being called the old way (the deprecated environment-variable form that passes an empty value), so every one of those write/command checks took the gate’s fail-open branch: allowed, with a diagnostic, rather than enforced at write time. The gate chose fail-open deliberately — denying would have bricked every tool call until the configuration was fixed — but it meant interactive write-time enforcement was, on that day, inert, leaning on the other layers (Landlock, the post-hoc sweep, CODEOWNERS) to hold the line.

Resolved · 2026-06-19

The hook has since been migrated to the stdin form. ~/.claude/settings.json now invokes the gate as gate --hook-input-stdin --agent=claude_code for Write, Edit, and Bash, so the interactive checks pass a real payload and enforce at write time again — the hook-missing-input fail-open path is no longer the common case. The histogram above is kept as the dated record of the gap that drove the fix.

A companion observation from the same day: the one on-disk scope manifest had already expired (back on 2026-05-31), so there were zero live token grants — the deny-by-default posture was fully in effect for protected paths.

Why this page keeps the finding

The point of an audit log is that it tells you uncomfortable truths. The design was sound — the gate fails open only on a misconfiguration it can’t safely block — and the log surfaced a real gap between “designed correctly” and “configured correctly.” That gap has since been closed (above), which is exactly the arc an audit trail exists to drive: surface it, then fix it.

The complete trail

Because the gate logs allows-on-misconfiguration as well as outright denials, the log is a full record of everything the enforcement plane decided, not just its refusals. That is what makes it auditable: you can reconstruct not only what was stopped, but what was let through and why.

See also

• The gate — the source of blocked and hook-missing-input.
• Post-hoc sweep — the source of reverted.
• Scope manifests — the expired-grant observation.
• Landlock — one of the layers still holding while the hook is inert.