Audit reference

Generated file — do not edit by hand. Regenerate from the repo root with CGO_ENABLED=0 go run scripts/gen-audit-md.go.

Every audited action SHC records to the tamper-evident audit chain. An event is audited iff its code begins with A — the one rule log.Event and the daemon’s audit bridge apply (core/log/typed.go). Before an A-prefix event reaches the bus it appends a scoped row (tenant / stack / environment) to the hash-chained audit table via the wired AuditWriter, so the audit log survives even when best-effort event delivery does not.

Codes follow A<CLASS><SEQ><MNEMONIC>. The Outcome column is the code’s 3-digit class: 2xx records a successful action, 4xx a denied attempt (auth / authz / validation), 5xx a failed operation. Action is the canonical message template a module publishes (AuditMessageTemplates) or the payload type it emits. The Payload column lists the JSON fields of the registered payload struct — the exact shape written to the audit row’s payload column; a trailing ? marks a field omitted when empty.

This doc is the audit-focused view of the event reference: a code appears here iff a module registers it with an A-prefix name.

Total: 54 audit codes across 11 modules.

Index

app — 12 codes
auth — 6 codes
backup — 7 codes
clone — 6 codes
cluster — 4 codes
node — 3 codes
quota — 1 code
repo — 3 codes
schedule — 4 codes
stack — 5 codes
vault — 3 codes

`app`

Count: 12

Code	Outcome	Action	Payload (JSON fields)
`A200100STKINS`	success	installed stack {stack_name}	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A200101STKUNI`	success	uninstalled stack {stack_name}	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A200102STKUPD`	success	updated stack {stack_name}	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A200110STKLSE`	success	lease expired for stack {stack_name}, reaping	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A200400STKSCL`	success	scaled service {service} in stack {stack_name} to {replicas} replicas	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A200401STKUNO`	success	Stack	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A200402STKUOC`	success	Stack	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A400401STKUOF`	denied	Stack	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A500100STKINF`	failure	failed to install stack {stack_name}: {error}	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A500101STKUNF`	failure	failed to uninstall stack {stack_name}: {error}	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A500102STKUPF`	failure	failed to update stack {stack_name}: {error}	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`
`A500400STKSCF`	failure	failed to scale service {service} in stack {stack_name}: {error}	`name`, `stack_name?`, `environment?`, `tenant_name?`, `service?`, `replicas?`, `old_status?`, `error?`, `index?`, `total?`, `version?`, `success_count?`, `total_count?`

`auth`

Count: 6

Code	Outcome	Action	Payload (JSON fields)
`A401000AUTHFL`	denied	Auth failed	`reason`, `user?`
`A401001TOKEXP`	denied	Token expired	`user`
`A401002TOKINV`	denied	Token invalid	`reason?`
`A403000AUTHZF`	denied	Authz failed	`reason`, `user?`
`A403001PERMDNY`	denied	Permission denied	`user`, `scopes`, `resource`
`A403002TENTDNY`	denied	Tenant denied	`tenant_name`, `user`

`backup`

Count: 7

Code	Outcome	Action	Payload (JSON fields)
`A200400BKPCRT`	success	created backup {backup_id} for stack {stack_name}	`backup_id`, `stack_name`
`A200401BKPDEL`	success	deleted backup {backup_id}	`backup_id`
`A200402BKPRST`	success	restored backup {backup_id} to stack {stack_name}	`backup_id`, `stack_name`
`A200403BKPVFY`	success	verified backup {backup_id}	`backup_id`
`A200800RLBKST`	success	rollback started for {stack_name} to backup {backup_id}	`stack_name`, `backup_id`
`A200801RLBKCP`	success	rollback completed for {stack_name}, {stacks} stacks rolled back	`stack_name`, `stacks`
`A500800RLBKFL`	failure	rollback failed for {stack_name} {error}	`stack_name`, `error`

`clone`

Count: 6

Code	Outcome	Action	Payload (JSON fields)
`A200600STKCLN`	success	Stack operation	`source`, `target?`, `stacks?`, `fast_path?`, `dry_run?`, `operation?`, `reason?`, `rollback?`, `backups?`, `recovered?`, `uninstalls?`
`A200601STKMOV`	success	Stack operation	`source`, `target?`, `stacks?`, `fast_path?`, `dry_run?`, `operation?`, `reason?`, `rollback?`, `backups?`, `recovered?`, `uninstalls?`
`A200602STKRNM`	success	Stack operation	`source`, `target?`, `stacks?`, `fast_path?`, `dry_run?`, `operation?`, `reason?`, `rollback?`, `backups?`, `recovered?`, `uninstalls?`
`A400600CLNFAL`	denied	Stack operation	`source`, `target?`, `stacks?`, `fast_path?`, `dry_run?`, `operation?`, `reason?`, `rollback?`, `backups?`, `recovered?`, `uninstalls?`
`A400601MOVFAL`	denied	Stack operation	`source`, `target?`, `stacks?`, `fast_path?`, `dry_run?`, `operation?`, `reason?`, `rollback?`, `backups?`, `recovered?`, `uninstalls?`
`A400602RNMFAL`	denied	Stack operation	`source`, `target?`, `stacks?`, `fast_path?`, `dry_run?`, `operation?`, `reason?`, `rollback?`, `backups?`, `recovered?`, `uninstalls?`

`cluster`

Count: 4

Code	Outcome	Action	Payload (JSON fields)
`A200201CLSPRO`	success	Cluster role change	`node`, `node_id`, `previous_role`, `new_role`, `actor?`
`A200202CLSDEM`	success	Cluster role change	`node`, `node_id`, `previous_role`, `new_role`, `actor?`
`A200400CLSDRN`	success	Cluster drain	`node`, `node_id`, `migrated_count`, `stopped_count?`, `failed_count?`, `duration_ms`, `reason?`
`A200400CLSFRC`	success	Cluster force leader	`node_id`, `removed_nodes?`, `actor?`

`node`

Count: 3

Code	Outcome	Action	Payload (JSON fields)
`A200200NODCRT`	success	Node created	`name`
`A200201NODUPD`	success	Node updated	`name`
`A200202NODRMV`	success	Node removed	`name`

`quota`

Count: 1

Code	Outcome	Action	Payload (JSON fields)
`A200503QTASCA`	success	Quota scan triggered	`tenant_name`

`repo`

Count: 3

Code	Outcome	Action	Payload (JSON fields)
`A200000REPCRT`	success	Repo created	`name`
`A200001REPRMV`	success	Repo removed	`name`
`A200002REPSYN`	success	Repo sync triggered	`name`

`schedule`

Count: 4

Code	Outcome	Action	Payload (JSON fields)
`A200600SCHCRT`	success	Schedule	`job`, `cron?`, `stack_name?`, `environment?`, `source?`, `actor?`
`A200601SCHENB`	success	Schedule	`job`, `cron?`, `stack_name?`, `environment?`, `source?`, `actor?`
`A200602SCHDIS`	success	Schedule	`job`, `cron?`, `stack_name?`, `environment?`, `source?`, `actor?`
`A200603SCHRMV`	success	Schedule	`job`, `cron?`, `stack_name?`, `environment?`, `source?`, `actor?`

`stack`

Count: 5

Code	Outcome	Action	Payload (JSON fields)
`A200100STKSTR`	success	started stack {stack_name}	`stack_name`, `tenant_name?`, `environment?`, `service?`, `services_affected?`
`A200101STKSTP`	success	stopped stack {stack_name}	`stack_name`, `tenant_name?`, `environment?`, `service?`, `services_affected?`, `force?`
`A200102STKRST`	success	restarted stack {stack_name}	`stack_name`, `tenant_name?`, `environment?`, `service?`, `services_affected?`
`A200103STKEXC`	success	executed command in stack {stack_name} service {service}	`stack_name`, `tenant_name?`, `environment?`, `service`, `command`, `exit_code`
`A200104PODRST`	success	restarted container {container_id} on node {node_id}	`container_id`, `node_id`

`vault`

Count: 3

Code	Outcome	Action	Payload (JSON fields)
`A200300VLTCRT`	success	Secret	`key?`, `scope?`, `stack_name?`, `environment?`, `tenant_name?`, `actor?`, `error?`
`A200301VLTUPD`	success	Secret	`key?`, `scope?`, `stack_name?`, `environment?`, `tenant_name?`, `actor?`, `error?`
`A200302VLTDEL`	success	Secret	`key?`, `scope?`, `stack_name?`, `environment?`, `tenant_name?`, `actor?`, `error?`