The audit record
What is recorded about a run's network: its policy, the policy's identity, and each connection decision — and how far each can be read back today.
On every run
Each run's record carries its egress posture.
| field | what it says |
|---|---|
| policy source | which policy judged the run: baseline:<name>, baseline:<name>+workload:<name>…, named:<path>, or open:<reason>, <actor>. Empty for a run with nothing to judge (proc) |
| policy digest | the identity of the exact policy the door loaded — the digest of its compiled form |
| enforcement note | the posture the run actually got, for example egress: WALLED, and for a sealed run whether model egress was sealed and, if not, why |
These fields answer the first questions an auditor asks: was this run governed, by what, and if it
was opened, by whom and why? An opened run cannot be mistaken for a governed one — its source
starts with open: and names the actor.
saphan run prints the enforcement note as the enforce line of its report. The policy source and
digest are stored on the run record; this release has no command or console page that displays
them — read them from the installation's database (egress_policy_source, egress_policy_digest).
On every connection
For a run whose door runs on the dispatching machine, each connection decision is written as one row:
| field | content |
|---|---|
| run | the run it belongs to |
| host, port | the destination. Host and port only — never a URL path or any content |
| verdict | permitted or refused |
| reason | the refusal class, for a refused connection |
| time | when the decision was taken (UTC) |
| policy digest | the policy that took it |
A permitted row is written only after the connection succeeded, and once per run, host and port.
Every refusal taken by the door is written. If a permitted decision cannot be written, the
connection is refused rather than allowed unrecorded.
⚠ On the Linux network wall and the container bridge, some refusals never reach the door: a name the policy does not list fails at name resolution inside the run, and a port the policy does not name is reset by the kernel. Neither is recorded.
What you can read back today
⚠ Be precise about the current state when you rely on this record:
| state | |
|---|---|
| policy source, digest and enforcement note on the run record | written for every run. The enforcement note is printed by saphan run; the source and digest are only in the database |
| per-connection rows, local runs | written; there is no command or console page to read them in this release — they are in the installation's database |
| per-connection rows, runs on a machine reached over ssh | not written in this release: the remote door judges and enforces, but does not record each decision |
| per-connection rows, interactive console sessions | not written in this release |
If your audit requires per-connection evidence for remote runs, treat that as a gap in this release — see Limits and known gaps.