Sample AI activity report
This is the document sourcevault report ai-activity writes, in full, for a quarter of activity. It was produced by SourceVault 1.58.3 from a seeded install: two small repositories with commits across the first two weeks of the quarter, three named agents, a Sentinel policy with deny and redact rules, and the reads, asks, denials and scrubs that follow. The names are invented; every number was computed by the product from the records it keeps, so the shape is exactly what your install produces.
Read it the way a reviewer would: the Coverage section says what the numbers rest on, the three middle sections say what AI read and what was stopped, and the last section says how to reproduce each figure from the exported chain, the commit history and the signed attestations. The same report is a dashboard route, and the chain behind it exports to a SIEM; the ten-minute guide gets a fresh install to this point.
Download the Markdown See the one-page evidence summary
AI activity report: 2026-10-01 to 2026-12-31
Generated 2026-10-13T00:22:55.532Z by SourceVault 1.58.3. What AI agents read through the Gateway, what AI wrote to the indexed repositories, and what policy stopped, with the evidence each number rests on. Nothing in this report left the machine that produced it.
Coverage
- Audit log: enabled. Sentinel: enabled. Provenance: enabled.
- Audit chain over the period: every month verifies.
| Month | Records in period | Chain |
|---|
| 2026-10 | 153 | intact, anchored by the signed head |
What AI read
- 153 audited events: 58 searches, 9 asks, 68 file reads, 2 resource reads.
- 9 distinct files were read; 2 distinct files were cited in answers.
- 13 data-path events carried no agent identity (see GATEWAY.md, "Agent identity").
By surface
| Surface | Count |
|---|
| mcp | 112 |
| http | 21 |
| dashboard | 20 |
By agent
| Agent | Count |
|---|
| claude-code | 88 |
| cursor-dana | 24 |
| ci-reviewer | 21 |
By repository
| Repository | Count |
|---|
| payments-api | 110 |
| web-frontend | 35 |
Most-read files
| repo:file | Reads |
|---|
| web-frontend:src/main.tsx | 15 |
| payments-api:src/routes/refunds.js | 11 |
| payments-api:docs/refunds.md | 9 |
| payments-api:src/routes/orders.js | 7 |
| payments-api:src/admin/invoices.js | 6 |
| payments-api:src/webhooks/verify.js | 6 |
| payments-api:src/auth/session.js | 5 |
| payments-api:src/index.js | 5 |
| web-frontend:src/checkout/Form.tsx | 4 |
Models that answered
What policy stopped
- 5 denials and 4 redaction events; 5 secrets scrubbed by DLP.
By rule
| Rule | Count |
|---|
| /.env,/.env.*,/secrets/,**/*credential* | 4 |
| /*.pem,/*.key,**/id_rsa* | 1 |
| dlp | 1 |
| services/payments/** | 1 |
Denied files
| repo:file | Denials |
|---|
| payments-api:config/secrets/stripe.json | 2 |
| payments-api:.env.production | 1 |
| payments-api:deploy/keys/prod.pem | 1 |
| payments-api:ops/aws-credentials.csv | 1 |
DLP findings by rule
| DLP rule | Findings |
|---|
| stripe-secret-key | 2 |
| aws-access-key-id | 1 |
| dlp | 1 |
| generic-api-key | 1 |
By agent
| Agent | Enforcements |
|---|
| claude-code | 4 |
| ci-reviewer | 3 |
| cursor-dana | 2 |
Identity and configuration
- Agent tokens: 3 minted, 1 revoked.
- Authentication: 1 dashboard login failures, 0 signed-API failures, 0 webhook signature failures.
- Configuration: 1 security settings changes (0 refused), 0 license installs (0 rejected), 0 token rotations, 0 self-updates.
- Sources: 0 added, 0 deleted. Provenance scans run: 1.
- Task relay: 0 delegated, 0 completed, 0 failed.
What AI wrote
- 12 commits across 2 repositories in the period; 7 disclosed AI authorship; 6 of those touched security-relevant code.
- AI authorship is a disclosure signal (trailers, footer markers, bot identities), not a forensic verdict; see PROVENANCE.md.
Security-relevant AI changes by category
| Category | Commits |
|---|
| authentication | 2 |
| ci_supply_chain | 1 |
| dependencies | 1 |
| network_egress | 1 |
| payments | 1 |
Disclosure signals
By author
| Author | AI-authored commits |
|---|
| Dana Whitfield | 6 |
| Priya Natarajan | 1 |
payments-api
8 commits, 4 AI-authored, 3 security-relevant.
| Commit | Date | Author | Categories | Evidence | Subject |
|---|
| a521035 | 2026-10-08 | Dana Whitfield | dependencies | path | Bump stripe SDK to 19.2 |
| 2d3a806 | 2026-10-06 | Dana Whitfield | network_egress | path | Rotate webhook signing to HMAC-SHA256 |
| e6878ee | 2026-10-03 | Dana Whitfield | authentication | path | Tighten session cookie flags |
1 further AI-authored commits touched no security-relevant path:
- e5f207d 2026-10-07 Dana Whitfield: Rename invoice columns in the admin view
web-frontend
4 commits, 3 AI-authored, 3 security-relevant.
| Commit | Date | Author | Categories | Evidence | Subject |
|---|
| cde2ef0 | 2026-10-11 | Priya Natarajan | ci_supply_chain | path | Add CI workflow for previews |
| cb9a987 | 2026-10-08 | Dana Whitfield | authentication | path | Login page copy and focus order |
| 0eb86c3 | 2026-10-05 | Dana Whitfield | payments | path | Checkout form validation |
Signed attestations
1 attestations were recorded in the period. Ledger chain: intact (1 records).
| Id | Recorded | Repository | Categories | Head commit | Key |
|---|
| 1 | 2026-10-13 | payments-api | authentication, cryptography | abaced6 | 9276645128261dc6 |
How to verify this report
- Reads and enforcement come from the hash-chained audit log under the state directory (
audit/audit-YYYY-MM.jsonl). Export it with sourcevault audit export --since ... --until ... and recompute the chain, or call GET /api/dashboard/audit/verify?month=YYYY-MM.
- Writes come from
git log over each indexed repository, classified as in PROVENANCE.md. Re-run GET /api/dashboard/repos/<repo>/provenance to reproduce.
- Attestations are DSSE envelopes signed with this install's attestation key (
attestation_key.pub in the state directory); verify any of them against that public key.