Administration
The audit log
Every decision that changes what the gate does, or hides what it found, is recorded with who made it.
What is recorded
| Action | Recorded detail |
|---|---|
| Dismissing a finding | Actor, rule_id, repo#pr, and the reason |
| Muting a rule | Actor, rule id |
| Adopting, shadowing or un-adopting a catalog rule | Actor, rule id, new state |
| Break-glass | Actor, reason, scope, ticket if given |
| Editing or deleting a convention | Actor, what changed |
| SSO configuration changes | Actor, and the fields changed — never the secret |
| Policy setting changes | Actor, old and new value |
The pattern is consistent: the actor, the subject, and what changed. A record that says “settings were updated” is not an audit log.
Retention
GARBOARD_AUDIT_RETENTION_DAYS sets the window. Unset, zero, negative or non-numeric all mean keep forever — the safe direction, because a misconfigured retention variable should not quietly destroy evidence.
A periodic pruner enforces whatever you set, organisation-scoped, and records its own count. A prune that deleted rows without saying how many would itself be an unauditable action.
Export
The audit log exports as CSV for the period you choose. It is the companion to the evidence bundle: receipts say what the gate decided, the audit log says what people decided about it.
Why reasons are required
Dismissing a finding requires a reason, and the reason is not paperwork — it feeds convention decay. A convention whose findings are repeatedly dismissed loses confidence and eventually stops being enforced.
So the audit log is not only a record. It is an input: the reasons people give are how the system learns it was wrong.