Service claw audit service

claw-audit-service

Rendered from .ai/manifests/ on every publish. Rules for this service: CLAUDE.md · guide: service guide.

Property	Value
Directory	apps/claw-audit-service
Port	4007
Database	mongodb
Test files	39 (vitest)
Internal packages	@claw/shared-auth, @claw/shared-constants, @claw/shared-entitlements, @claw/shared-rabbitmq, @claw/shared-types, @claw/shared-utilities

Persistence models

• AuditLog
• FeedbackCounter
• FeedbackTicket
• UsageLedger

HTTP API (18)

Method	Route	Source
GET	/audits	audits.controller.ts
GET	/audits/failures	observability.controller.ts
GET	/audits/stats	audits.controller.ts
POST	/feedback	feedback.controller.ts
GET	/feedback/admin	feedback-admin.controller.ts
GET	/feedback/admin/:id	feedback-admin.controller.ts
GET	/feedback/admin/:id/attachments/:fileId	feedback-admin.controller.ts
PATCH	/feedback/admin/:id/status	feedback-admin.controller.ts
GET	/feedback/admin/stats	feedback-admin.controller.ts
GET	/feedback/mine	feedback.controller.ts
GET	/feedback/mine/:id	feedback.controller.ts
POST	/feedback/public	feedback-public.controller.ts
GET	/health	health.controller.ts
GET	/usage	audits.controller.ts
GET	/usage/cost	audits.controller.ts
GET	/usage/latency	audits.controller.ts
GET	/usage/summary	audits.controller.ts
GET	/usage/tracing	observability.controller.ts

Events (inferred from source; verify before a critical change)

• Publishes: log.server
• Consumes: agent.capability.approved, agent.capability.auto_approved, agent.capability.cancelled, agent.capability.denied, agent.capability.executed, agent.capability.executing, agent.capability.expired, agent.capability.failed, agent.capability.policy_matched, agent.capability.proposed, agent.capability.rejected, agent.capability.rolled_back, agent.device_paired, agent.device_revoked, agent.mobile_action, agent.policy_violated, agent.session_connected, agent.session_disconnected, agent.token_reuse_detected, agent.token_rotated, ai_action.approved, ai_action.auto_approved, ai_action.denied, ai_action.edited, ai_action.executed, ai_action.expired, ai_action.pending_approval, ai_action.policy.created, ai_action.policy.deleted, ai_action.policy.updated, ai_action.rejected, ai_action.suggestion_created, billing.credit.topup_reversed, billing.credit.topup_succeeded, billing.entitlement.reconcile_requested, billing.payment.chargeback, billing.payment.refunded, billing.subscription.activated, billing.subscription.cancelled, billing.subscription.downgrade_scheduled, billing.subscription.downgraded, billing.subscription.expired, billing.subscription.past_due, billing.subscription.renewed, billing.subscription.suspended, billing.subscription.upgraded, chat.share.published, chat.share.revoked, chat.share.safety_rejected, chat.share.updated, chat.share.url_regenerated, chat.share.visibility_changed, connector.created, connector.deleted, connector.health_checked, connector.synced, connector.updated, file.archive_expanded, file.chunked, file.deleted, file.downloaded, file.extraction_failed, file.failed, file.ocr_completed, file.ocr_failed, file.ocr_started, file.retention_expired, file.upload_completed, file.upload_started, file.uploaded, file.video_process_completed, file.video_process_failed, file.video_process_requested, llamacpp.binary.installed, llamacpp.binary.updated, llamacpp.model.crashed, llamacpp.model.loaded, llamacpp.model.unloaded, llamacpp.preflight.overridden, llamacpp.pull.completed, llamacpp.pull.failed, llamacpp.pull.progress, llamacpp.pull.started, llamacpp.weights.deleted, memory.extracted, message.completed, routing.circuit_breaker.closed, routing.circuit_breaker.half_open, routing.circuit_breaker.opened, routing.decision_made, routing.learned_score.updated, routing.models.synced, routing.no_execution_model, routing.policy.changed, routing.profile.created, routing.profile.lifecycle_changed, routing.profile.updated, threads.generation_failed, user.activated, user.login, user.logout, user.temporary_password_issued, workspace.sync.dlq_sent, workspace.sync.manual_triggered, workspace.sync.paused, workspace.sync.rate_limited, workspace.sync.resumed, workspace.sync.run_completed, workspace.sync.run_failed, workspace.sync.run_started, workspace.sync.stale_detected, workspace_action.bulk_approved, workspace_action.edited, workspace_action.stale_blocked