{"slug": "agent-forensics-in-five-minutes-what-it-did-and-proof-the-log-wasn-t-edited", "title": "Agent forensics in five minutes: what it did, and proof the log wasn't edited", "summary": "A developer released pod v0.3.2, an Apache-2.0 tool that gives AI coding agents a hash-chained audit trail for incident forensics. The tool records each tool call with an argument hash, decision, outcome, and the policy version in force, then lets operators verify the log hasn't been edited and export a portable evidence bundle. \"Edit any historical entry and verification fails immediately,\" the developer writes, arguing the chain proves \"the log itself wasn't edited after the fact.", "body_md": "An agent incident ends one of two ways.\n\nWithout an audit trail, you guess: what it did, when, with which arguments, under which policy, approved by whom. With a hash-chained audit, five minutes gets you a full timeline — and a way to show the timeline itself hasn't been edited since.\n\nI run agents on my own laptop (Claude Code, Cursor, OpenClaw, DSH), so I've had this happen. Here is the whole runbook, on real output.\n\nA real call from my machine — the policy stopped it:\n\n``` bash\n$ pod timeline --since 2h --tool delete_file\n\n2026-09-01 01:40:08  [deny   ] delete_file        filesystem   agent=openclaw-main  args=cb1533f3… pol=0.1.0  reason=tool \"delete_file\" is denied on \"filesystem\"  blocked\n~~~\n\nThree seconds to read three things: **who** (openclaw-main), **what it wanted to do** (delete_file), **why it didn't happen** (policy deny, with the policy version in force at that moment — 0.1.0).\n\n## Step 1 — replay the timeline (2 minutes)\n\n~~~bash\npod timeline --since 2h                       # everything, last two hours\npod timeline --since 24h --tool write_file    # only writes\npod timeline --agent openclaw-main            # only one agent\n~~~\n\nEvery row carries: time / tool / server / agent / **argument hash** / decision / outcome / approver / **the policy version in force**. Arguments are stored as hashes only — during an incident that means you don't leak more than you have to, while still being able to prove the call happened.\n\n## Step 2 — prove the log wasn't touched (1 minute)\n\n~~~plaintext\n$ pod verify-audit\n\n## openclaw-main/filesystem.jsonl\n- status: hash chain intact\n- entries: 8\n- head hash: f7a56fb90350…\n- tail hash: 06f31666c4e8…\n\nconclusion: every record verifiable, none modified\n~~~\n\nEach record locks in the hash of the one before it. Edit any historical entry and verification fails immediately. That's a stronger claim than \"the log shows it\": it's \"the log itself wasn't edited after the fact\".\n\n## Step 3 — package the evidence (2 minutes)\n\n~~~console\n$ pod export-evidence\nevidence bundle: ~/.pod/evidence/pod-evidence-2026-09-01.json\n  audit files: 1 | policy snapshots: 1\n  top-level hash: 9f9e6ed35ed1c0b9…\n  one-page report: ~/.pod/evidence/pod-evidence-2026-09-01.json.md\n\n$ pod verify-evidence --out ~/.pod/evidence/pod-evidence-2026-09-01.json\n✅ evidence bundle valid (top-level hash matches, nothing modified)\n~~~\n\nOne file to hand over: the audit, **the policy snapshot that was in force**, the self-check result, and a top-level hash. Whoever receives it can verify the bundle themselves — no need to trust your machine.\n\n## Optional: cross-agent evidence in the cloud\n\n~~~bash\npod sync\n~~~\n\nThe control plane lives in the same Apache-2.0 repo (`bash deploy/install.sh`). The data direction is one-way: only SHA-256 hashes go up, the audit text stays on your machine, and the cloud being down doesn't affect local enforcement.\n\n## Why a hash chain instead of plain logs\n\n| | Plain log | pod hash-chained audit |\n|---|---|---|\n| Records the call | yes | yes |\n| Records raw arguments | yes (that's the leak surface) | no — hash only |\n| Records the policy version in force | no | yes |\n| Provable that nobody edited it | no — anyone can edit a log | yes — one edit breaks the chain |\n| Portable, verifiable evidence bundle | no | yes |\n\nNot every agent behaves. The audit's job is narrower and more useful: what it did, it can't deny.\n\nInstall (v0.3.2):\n\n~~~bash\ncurl -fsSL https://gitee.com/suhuisoftwares/pod/raw/v0.3.2/scripts/install.sh | sh\npod init --template baseline\npod serve --agent <name> --server <name> --policy ~/.pod/policies/baseline.json --command <cmd>\n~~~\n```\n\n", "url": "https://wpnews.pro/news/agent-forensics-in-five-minutes-what-it-did-and-proof-the-log-wasn-t-edited", "canonical_source": "https://dev.to/waldenwuwei/agent-forensics-in-five-minutes-what-it-did-and-proof-the-log-wasnt-edited-31kb", "published_at": "2026-09-18 02:42:40+00:00", "updated_at": "2026-09-18 03:22:52.468901+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools", "ai-tools"], "entities": ["pod", "Claude Code", "Cursor", "OpenClaw", "DSH"], "alternates": {"html": "https://wpnews.pro/news/agent-forensics-in-five-minutes-what-it-did-and-proof-the-log-wasn-t-edited", "markdown": "https://wpnews.pro/news/agent-forensics-in-five-minutes-what-it-did-and-proof-the-log-wasn-t-edited.md", "text": "https://wpnews.pro/news/agent-forensics-in-five-minutes-what-it-did-and-proof-the-log-wasn-t-edited.txt", "jsonld": "https://wpnews.pro/news/agent-forensics-in-five-minutes-what-it-did-and-proof-the-log-wasn-t-edited.jsonld"}}