Monitoring and Analytics

Audit monitoring protects the audit system itself before it analyzes application behavior. A green dashboard must mean the claimed mechanics are healthy, not merely that the last query returned rows.

Control-plane health

Monitor and alert on:

• recorder authentication, authorization, rate-limit, schema, and append failures;
• append-conflict retries, commit latency, and journal durability;
• producer outbox depth, oldest pending age, retry count, dead-letter count, and alarm health;
• source high-water lag, missing source sequences, and predecessor mismatches;
• missing lifecycle terminals and duplicate terminal events;
• checkpoint age, tree-size lag, proof-generation errors, and consistency failures;
• observer freshness, observation-chain breaks, and conflicting checkpoint views;
• anchor failures and verification-policy expiry;
• evidence write, digest, decryption, retention, and disposal failures;
• projection lag, reconciliation differences, and rebuild failures.

Source-gap reconciliation

Each durable producer advances a monotonic source sequence and links its previous event digest. Periodic audit.source_high_water events declare the producer's committed high-water mark. Reconciliation compares that claim with recorder history and reports:

• contiguous and current;
• lagging delivery;
• declared gap;
• conflicting source history;
• stale or unavailable source.

A checkpoint proves what the recorder contains. Source reconciliation provides evidence about what an instrumented producer says should have arrived. Both are required for AAP-3.

Search projections

Build explorer and analytics views from disposable projections. Useful dimensions include tenant scope, ledger and epoch, source, event family and type, outcome, action category, reason code, actor commitment, correlation, evidence disposition, and verification verdict.

Every view should expose:

• projection freshness and version;
• the authoritative entry digest and sequence;
• the effective AAP and health reasons;
• explicit gaps and unavailable ranges;
• a path to export a signed replay bundle.

Do not let projection writes participate in the journal transaction. A failed projection is recoverable; a failed or ambiguous append is not.

Behavioral analytics

After control-plane health is established, projections may detect patterns such as repeated proof rejection, unusual delegation use, policy denials, tool-call failure bursts, or key rotation anomalies. Treat these as derived signals with model and query provenance. They must never rewrite the journal or be presented as cryptographic facts.

Operational response

Runbooks should cover recorder outage, outbox backlog, source gap, checkpoint failure, observer conflict, key compromise, evidence-store failure, projection drift, restore, legal hold, and retention disposal. Each runbook must name the affected assurance claim, containment action, verification procedure, and recovery evidence.