Audit and Replay

Evidence proves what was tested. The audit log answers what actually ran: which rule version, which artifact, which input, which output, and which runtime.

Write and verify provenance

devlish run pricing.dvl \
  --input '{"amount": 100}' \
  --audit-log audit.jsonl

devlish audit-verify audit.jsonl

Every completed governed run appends a record containing:

• rule identifier and version
• artifact, input, and output hashes
• runtime kind and version
• instruction count and success state
• the previous record hash

Failures are recorded too. If the audit record cannot be persisted, the governed run does not report success.

Journal effects

An audit record identifies the run but does not contain the live HTTP, file, or service responses that influenced it. Add an effect journal:

devlish run pricing.dvl \
  --audit-log audit.jsonl \
  --journal audit.jsonl.attachments

The content-addressed attachment archives the exact bytecode, full input, and each host-effect request and response in order. Credentials are resolved below the journal boundary and are not written into it, but request and response bodies may contain sensitive data.

Replay without the live world

devlish replay audit.jsonl
devlish replay audit.jsonl --line 3

Replay verifies the log chain and attachment hashes, then executes the archived bytecode with the captured effect responses. Effect requests must match in type, shape, and order; the final output hash and instruction count must also match.

The result is stronger than asking the system to repeat a task against a world that may already have changed.