Problem
Agent Zero autonomously executes commands, modifies files, and interacts with GitHub on behalf of users through the runner boundary. Currently there's no structured audit trail recording what actions were taken, when, by which agent run, and with what outcome. This makes it hard to review, debug, or demonstrate compliance for autonomous changes made to a repository.
Proposed solution
Introduce an audit logging system that records key events during an agent run, such as:
- Commands executed via the runner boundary (command, working directory, exit code, timestamp)
- File modifications (path, diff summary or hash, timestamp)
- GitHub API calls / webhook-triggered actions (PR comments, commits, status checks)
- Model/provider calls (which adapter, tokens/cost if available)
- State transitions (discovery, understanding, validation, planning, execution, verification, review)
Logs should be:
- Structured (e.g., JSON lines) and persisted (e.g., via the existing Drizzle/Postgres setup)
- Attributable to a specific agent run/session and PR
- Queryable/visible from the Dashboard (Nuxt) for review
- Exportable for compliance/security review
Why this matters
Given Agent Zero's security/sandboxing focus and its ability to autonomously execute commands and modify code, an audit trail is important for trust, debugging failed runs, and satisfying security/compliance requirements for teams adopting it.
Happy to help scope this further or contribute an initial implementation if that would be useful.
Problem
Agent Zero autonomously executes commands, modifies files, and interacts with GitHub on behalf of users through the runner boundary. Currently there's no structured audit trail recording what actions were taken, when, by which agent run, and with what outcome. This makes it hard to review, debug, or demonstrate compliance for autonomous changes made to a repository.
Proposed solution
Introduce an audit logging system that records key events during an agent run, such as:
Logs should be:
Why this matters
Given Agent Zero's security/sandboxing focus and its ability to autonomously execute commands and modify code, an audit trail is important for trust, debugging failed runs, and satisfying security/compliance requirements for teams adopting it.
Happy to help scope this further or contribute an initial implementation if that would be useful.