THE FIELD GUIDE / OPERATIONS
History, audits & exports
Trace package changes, operator actions and investigation decisions.
Read the package ledger
Package history records observed installations, version changes, removals and state changes with before/after versions, timestamps and actor/job links when known. An initial inventory is a baseline; it cannot establish the original installation time.
Advisories and component inventory
Match affected and fixed versions through distribution advisory data, apply explicitly configured CVSS-derived priority policies, and export CycloneDX SBOMs with dependency relationships for downstream analysis. Advisory coverage remains visible for each distribution and source.
Follow the audit trail
Authenticated mutations retain actor, method, path and outcome without request-body secrets. AI run history includes model usage and estimated costs. Timelines make response reviews, patching and source changes inspectable.
Review rejected sign-ins
Failed password/MFA sign-ins, rate-limit lockouts and rejected SSO callbacks retain bounded audit reasons for investigation. Flood controls deduplicate repeated lockout/SSO failures. Provider validation errors use sanitized categories and a truncated hashed subject rather than raw tokens, provider responses or identity-provider subjects. Passwords and one-time codes never enter the audit record.
Export what you need
Use JSONL audit exports, CycloneDX inventory, integrity-verifiable response records and independent off-host audit retention. Scope export access to appropriate roles and protect retained records as operational data.
Open the application reference for capability scope and technical details.
Open Open AI_AND_PACKAGE_HISTORY.md on GitHub ↗