Audit timeline
Browse a verifiable Tessera log of daemon operations and optional Kubernetes API audit events. Entries are append-only with inclusion proofs — Cloud /audit filters by source, kind, action, actor, and time, then opens Tessera leaf JSON.
Verifiable timeline
Tessera leaves for daemon ops and optional Kubernetes API audit — append-only with inclusion proofs.
Tessera append-only log
Daemon intents and outcomes land as leaves. Cloud shows verified tree size against trusted size — inclusion proofs, not a scraped log file.
Daemon + optional Kubernetes
One timeline filters by source (daemon / k8s), kind, action, actor, and time. Fork detection when the log diverges from trusted history.
Kubernetes audit webhook
When enabled, guests POST to the fabric sink. Cloud shows accepts, unauthorized counts, and CA fingerprint — dry windows usually mean webhook/CA/guest ExtraArgs.
- 1
Operations leave leaves
Daemon fabric ops append intent/outcome rows as they run. Optional k8s audit joins the same Tessera tree.
- 2
Filter and open
Operators narrow the timeline, then open an entry for actor, action, resource, ok/error, and raw JSON.
- 3
Verify inclusion
Verified size tracks proofs against trusted history. A fork banner appears when the log diverges.
Lab snapshot (mock)
Site am-lab · verified size 12847 · k8s webhook on · CA a3f9c2e1b847…. Cluster create can enable Kubernetes audit → Tessera as a product path — see Managed Kubernetes.