# AI activity report: 2026-10-01 to 2026-12-31

Generated 2026-10-13T00:22:55.532Z by SourceVault 1.58.3. What AI agents read through the Gateway, what AI wrote to the indexed repositories, and what policy stopped, with the evidence each number rests on. Nothing in this report left the machine that produced it.

## Coverage

- Audit log: enabled. Sentinel: enabled. Provenance: enabled.
- Audit chain over the period: every month verifies.

| Month | Records in period | Chain |
| --- | ---: | --- |
| 2026-10 | 153 | intact, anchored by the signed head |

## What AI read

- 153 audited events: 58 searches, 9 asks, 68 file reads, 2 resource reads.
- 9 distinct files were read; 2 distinct files were cited in answers.
- 13 data-path events carried no agent identity (see GATEWAY.md, "Agent identity").

### By surface

| Surface | Count |
| --- | ---: |
| mcp | 112 |
| http | 21 |
| dashboard | 20 |

### By agent

| Agent | Count |
| --- | ---: |
| claude-code | 88 |
| cursor-dana | 24 |
| ci-reviewer | 21 |

### By repository

| Repository | Count |
| --- | ---: |
| payments-api | 110 |
| web-frontend | 35 |

### Most-read files

| repo:file | Reads |
| --- | ---: |
| web-frontend:src/main.tsx | 15 |
| payments-api:src/routes/refunds.js | 11 |
| payments-api:docs/refunds.md | 9 |
| payments-api:src/routes/orders.js | 7 |
| payments-api:src/admin/invoices.js | 6 |
| payments-api:src/webhooks/verify.js | 6 |
| payments-api:src/auth/session.js | 5 |
| payments-api:src/index.js | 5 |
| web-frontend:src/checkout/Form.tsx | 4 |

### Models that answered

| Model | Asks |
| --- | ---: |
| qwen3.5:9b | 9 |

## What policy stopped

- 5 denials and 4 redaction events; 5 secrets scrubbed by DLP.

### By rule

| Rule | Count |
| --- | ---: |
| **/.env,**/.env.*,**/secrets/**,**/*credential* | 4 |
| **/*.pem,**/*.key,**/id_rsa* | 1 |
| dlp | 1 |
| services/payments/** | 1 |

### Denied files

| repo:file | Denials |
| --- | ---: |
| payments-api:config/secrets/stripe.json | 2 |
| payments-api:.env.production | 1 |
| payments-api:deploy/keys/prod.pem | 1 |
| payments-api:ops/aws-credentials.csv | 1 |

### DLP findings by rule

| DLP rule | Findings |
| --- | ---: |
| stripe-secret-key | 2 |
| aws-access-key-id | 1 |
| dlp | 1 |
| generic-api-key | 1 |

### By agent

| Agent | Enforcements |
| --- | ---: |
| claude-code | 4 |
| ci-reviewer | 3 |
| cursor-dana | 2 |

## Identity and configuration

- Agent tokens: 3 minted, 1 revoked.
- Authentication: 1 dashboard login failures, 0 signed-API failures, 0 webhook signature failures.
- Configuration: 1 security settings changes (0 refused), 0 license installs (0 rejected), 0 token rotations, 0 self-updates.
- Sources: 0 added, 0 deleted. Provenance scans run: 1.
- Task relay: 0 delegated, 0 completed, 0 failed.

## What AI wrote

- 12 commits across 2 repositories in the period; 7 disclosed AI authorship; 6 of those touched security-relevant code.
- AI authorship is a disclosure signal (trailers, footer markers, bot identities), not a forensic verdict; see PROVENANCE.md.

### Security-relevant AI changes by category

| Category | Commits |
| --- | ---: |
| authentication | 2 |
| ci_supply_chain | 1 |
| dependencies | 1 |
| network_egress | 1 |
| payments | 1 |

### Disclosure signals

| Signal | Count |
| --- | ---: |
| trailer | 7 |

### By author

| Author | AI-authored commits |
| --- | ---: |
| Dana Whitfield | 6 |
| Priya Natarajan | 1 |

### payments-api

8 commits, 4 AI-authored, 3 security-relevant.

| Commit | Date | Author | Categories | Evidence | Subject |
| --- | --- | --- | --- | --- | --- |
| a521035 | 2026-10-08 | Dana Whitfield | dependencies | path | Bump stripe SDK to 19.2 |
| 2d3a806 | 2026-10-06 | Dana Whitfield | network_egress | path | Rotate webhook signing to HMAC-SHA256 |
| e6878ee | 2026-10-03 | Dana Whitfield | authentication | path | Tighten session cookie flags |

1 further AI-authored commits touched no security-relevant path:

- e5f207d 2026-10-07 Dana Whitfield: Rename invoice columns in the admin view

### web-frontend

4 commits, 3 AI-authored, 3 security-relevant.

| Commit | Date | Author | Categories | Evidence | Subject |
| --- | --- | --- | --- | --- | --- |
| cde2ef0 | 2026-10-11 | Priya Natarajan | ci_supply_chain | path | Add CI workflow for previews |
| cb9a987 | 2026-10-08 | Dana Whitfield | authentication | path | Login page copy and focus order |
| 0eb86c3 | 2026-10-05 | Dana Whitfield | payments | path | Checkout form validation |

### Signed attestations

1 attestations were recorded in the period. Ledger chain: intact (1 records).

| Id | Recorded | Repository | Categories | Head commit | Key |
| --- | --- | --- | --- | --- | --- |
| 1 | 2026-10-13 | payments-api | authentication, cryptography | abaced6 | 9276645128261dc6 |

## How to verify this report

- Reads and enforcement come from the hash-chained audit log under the state directory (`audit/audit-YYYY-MM.jsonl`). Export it with `sourcevault audit export --since ... --until ...` and recompute the chain, or call `GET /api/dashboard/audit/verify?month=YYYY-MM`.
- Writes come from `git log` over each indexed repository, classified as in PROVENANCE.md. Re-run `GET /api/dashboard/repos/<repo>/provenance` to reproduce.
- Attestations are DSSE envelopes signed with this install's attestation key (`attestation_key.pub` in the state directory); verify any of them against that public key.