audit

Invocation#

echo-cli audit list --since <ISO instant> [--actor-kind cron|agent|rule|approval] [--actor <id>]

Inputs and output#

An indented JSON array of the actions recorded since --since, newest first: id, occurred_at, actor_kind (cron, agent, rule, or approval for a run of the approval queue), actor (the job's route, the agent session, the rule id, or the reviewer who approved the run), action, trigger (for an approved run: approval_request_id, requested_by, requested_at and reason), inputs (for an approved run, the request's payload), effect (the records it changed by table and id, or the approved action's result, or null when it changed nothing), outcome (done, refused or failed) and error, which a refused or failed action always carries. --since is required: Echo reads no window it was not given. --actor-kind and --actor narrow the list to one kind or one actor. Approved runs do not count against a channel's autonomy budget (echo-cli autonomy), since automation did not take them alone.

State effect#

The command calls Echo Web's GET /api/automation/audit with ECHO_INTERNAL_BEARER at ECHO_WEB_BASE_URL; the Automation tab of /diagnostics and the Automation audit section of Echo Desktop's GEO screen show the same rows. Each action writes its own row once its outcome is settled, and nothing updates or deletes it. Campaign sends from /api/cron/crm-campaign-worker record each send, skip and failure with the recipient row they changed; /api/cron/needher-captions-publish records each caption shoot it published or the ingest refused, naming the needher-captions channel so each publication counts against that channel's autonomy budget, and, once, refused naming the cap and its use, each shoot past the budget it queues as publish_caption_shoot; /api/cron/needher-captions-loop records each tick that wrote frames (generate caption shoots: the frames generated with their stored objects, the frames that failed with why and the shoots the writer could not write, failed when no frame was generated); /api/cron/character-life-events records each life event it wrote with the state change, and each character whose event failed; /api/cron/warehouse-export records each export run with its load report; /api/cron/market-report records each weekly delivery (deliver weekly market report: the recipient, the week and the archived delivery, failed with the error that stopped it); /api/cron/metric-reports records each due schedule (write and deliver metric report: the report written, failed when the write or the delivery failed); /api/cron/metric-alerts records each check that raised alerts (raise metric alerts: the alerts and pending actions it made) and each that could not run, a check with every metric within range changing nothing and leaving no row; /api/cron/evergreen-requeue records each account that requeued posts (requeue evergreen posts: the requeues and the queued copies) and each whose run failed; /api/cron/privacy-retention records each store's run (delete personal rows past retention: the store, the cutoff, the rows deleted and the retention run, failed with its error); /api/cron/experiment-guardrails records each variant it stopped (stop variants past their guardrails: the guardrail, its bound and the share read, the stop and the quarantined variant) and each experiment it could not evaluate; /api/cron/playbook-steps records each held step it tried (queue held playbook step: the step and its run, done with the approval request it made, refused with the refusal); /api/cron/geo-runs records each due schedule it tried (start scheduled GEO run: the product and the run started, failed with the error that stopped it); /api/cron/ad-anomalies records each alert it raised that day (raise ad anomaly alert, or raise ad anomaly alert and pause campaign: the campaign, metric, value and band, the alert, its pending action and whether the campaign was paused) and, when the platform refused the pause, a failed pause ad campaign with its error, a watch within its band or already alerted leaving no row; /api/cron/funnel-dropoffs records each due schedule it ran (run scheduled funnel drop-offs: the funnel, window and drop, the run and the pending action it raised, failed with the error that stopped it); /api/cron/icp-scores records each due schedule it scored (score ICP profile on schedule: the profile, source and settings, the score stored, failed with the error that stopped it); /api/cron/changelog-sync records each release-note draft it made or could not make (draft release notes: the changelog entry and version, the draft post) and each product whose source could not be read (read changelog source, failed); /api/cron/competitor-pages records each page it captured (capture tracked competitor page: the page, the capture and the price alerts it raised with their pending actions, failed with the fetch error); /api/cron/seo-crawls records each due site it crawled (crawl scheduled site: the crawl, the crawl it was compared with, the findings and the regression's pending action, failed with the error that stopped it); /api/cron/competitor-releases records each watched changelog it checked (check competitor changelog: the capture and the releases stored for the first time, failed when the page could not be read or no heading matched the watch's pattern); /api/cron/battlecards records each card it refreshed (refresh battlecard: the version written and the captures it read, failed with the error that stopped it); /api/cron/product-comparisons records each comparison it changed (refresh product comparison: the version written, whether it was published or why it was held, and the competitors discovered, failed with the error that stopped it), a comparison whose pages did not change leaving no row; /api/cron/market-size-weeks records each week that kept new values (keep market sizing week: the week and each assumption's assumed and measured value) and each run that failed; /api/cron/segments-refresh records each segment whose members changed (refresh segment members: who entered, who left and the lifecycle enrolments made for those who entered) and each segment whose refresh failed; /api/cron/search-updates records each daily sync (sync search update register: the updates the register holds, failed with the error that stopped it); /api/cron/geo-corrections records each product whose check opened corrections (check GEO corrections: the facts opened and their pending actions) and each watch whose check failed; /api/cron/geo-model-watch records each watch that saw new models (watch model catalogue: the routes first seen and whether they were proposed) and each watch that failed; /api/cron/ad-conversion-feedback records each conversion it sent to its ad platform (send ad conversion: the conversion and its send status, failed with the platform's error); /api/cron/certificates records each watched host it checked (check TLS certificate: the expiry and days left read and the watch's expiry and mixed-content alerts, failed with the error that stopped the read); /api/cron/email-domain-checks records each sending domain it checked (check sending domain: the reading stored, its health and what failed in it, failed with the error that stopped the check); /api/cron/automation-effects records each due schedule it attempted (email automation effect report: the recipient and the period sent, failed with the error that stopped it); /api/cron/scheduled-actions records each scheduled account action it started or resumed on Weles (start scheduled account action: the action log) and each Weles refused, failed with Weles' error; /api/cron/settle-dispatched records each dispatched account action it settled (settle dispatched account action: the action log), each Weles holds no run for, failed, and each whose run could not be read, failed with Weles' error; /api/cron/onboarding-optimize records each onboarding experiment it reweighted (reweight onboarding experiment: the adaptive experiment and each variant's weight before and after), refused when the experiment moved since it was read, failed when the run stopped; /api/cron/burn-attribution records each burn it wrote (attribute burn: the failed and paired action logs, the factor and the domain or exit IP burned); /api/cron/email-domain-burn-watchdog records each domain whose signup count it corrected (recount domain signups: the count before and after, failed with the write's error); /api/cron/lifecycle-recalibrate records each recalibration (recalibrate routine caps: the calibration written per platform, failed with the error that stopped it); /api/cron/classify-formats records each run (classify formats: how many were classified, failed naming how many were not); /api/cron/health-probe and /api/cron/login-refresh record each Weles run they start per active account (start account health probe, start account login refresh: the platform, account and run) and each Weles refused, failed with its answer; /api/cron/reddit-shadowban-sweep records each shadowban check it queues for an active or flagged Reddit account not checked within ECHO_SHADOWBAN_RECHECK_HOURS hours (queue shadowban check: the account, the run and when it is scheduled) and each queue Weles refused, an account checked recently leaving no row; each /api/cron/<platform>-routine records each run its tick queues (queue routine action: the account, the action, its parameters and when it is scheduled, under the tick's id), each queue Weles refused (failed) and each promote the identity's cap or the character's rules refused and replaced (promote from routine, refused with why), an account a gate skips leaving no row; /api/cron/simulate-characters records each character state it wrote (simulate character state: the mood and activity before and after) and each character whose update failed; /api/cron/campaign-scheduler records each campaign it completed at the end of its window (complete campaign), each that enqueued due items (schedule campaign items: the accounts and how many were enqueued and skipped) and each whose due items could not run, refused with why; /api/cron/crm-email-sync records each inbound email it recorded as a CRM reply (record inbound email reply: the Resend email id), each it could not record and a listing that failed, failed with the cause; /api/cron/crm-dm-sync records each finished inbox run it ingested (ingest inbox run: the run, account and messages recorded), each read_inbox run it started or could not start (start inbox read) and a sync that failed; /api/cron/crm-enrich-contacts records each lead it enriched (enrich CRM lead: the niche and tags written) and each whose enrichment failed; /api/cron/crm-discover-leads records each query that inserted leads (discover CRM leads: the query and the emails inserted) and each query that failed; /api/cron/crm-deliverability-canary records each run (send deliverability probe: the probe sent and the previous probe's verdict, failed with the error that stopped it); /api/cron/charge-reconciliation records each run that marked topup rows verified (verify topups by bank charges: each row with the charge's transaction id, and the charges it could not match with why) and each run that could not read the rows, failed with the cause; /api/cron/paid-ads-sync records each active ad account it synced (sync ad account: the account and the day it synced from, failed with the platform's error); /api/cron/needher-lifestyle-loop records each frame it generated (generate lifestyle frame: the character, series and pose and the stored object, failed with the frame's error); /api/cron/lora-post-training records each completed training job it registered or compared (register trained LoRA: the registration and the comparison images completed), a job already registered with every comparison done leaving no row; /api/cron/lora-training-watchdog records each job it marked completed because its output exists (complete LoRA training job) and each job it relaunched on its recorded GPU class (relaunch LoRA training job: the ended machine job and the new one), failed with the error when either was refused; /api/cron/blog-generation records each queued run it resumed (resume queued blog generation run), each scheduled run it enqueued with the config's next run (enqueue scheduled blog generation), each run whose processing failed (process blog generation run, failed) and each scheduler failure, a tick with nothing due leaving no row; /api/cron/scrape-creative-center, /api/cron/scrape-trend-reports and /api/cron/scrape-apify record each source they scraped (scrape trend source: the source and its counts, failed with the source's error); /api/cron/scrape-explainer-metrics records each explainer whose TikTok numbers it stored (read explainer metrics: the numbers and the engagement rate) and each whose read failed; /api/cron/scrape-viral records each run that stored or summarized references or failed (scrape viral references: the declared format and its hashtags, what was saved and summarized and every failure, failed when nothing was saved or summarized); every tool the agent chat runs is recorded under its conversation with the tool's input and result, failed when the result carries an error; the rules record each person or campaign they act on as actor kind rule with the rule's, trigger's or programme's id — a lifecycle trigger each enrolment and each end (enrol in lifecycle sequence, end lifecycle enrolment: the event behind it), a segment bound to a trigger each enrolment on entry (enrol on segment entry), an expansion rule each offer (offer expansion: the uses, the limit and the offer and enrolment rows), a win-back rule each enrolment (enrol in win-back: when the person was last seen and the rows), a churn risk rule each flag and rescue (flag churn risk and enrol in rescue: the events that dropped, the billing issues and the rows), a review programme each request (request review: the success event), a product's referral programme each referral it qualifies (qualify referral and grant reward, actor referral-programme:<product id>: the reward granted), and an ad budget rule each pause or budget change it made or was refused (pause ad campaign or scale ad campaign, actor ad-budget-rule:<rule id>: the metric, threshold and value seen, the budget before and after, refused with why); every approved request of the approval queue (echo-cli approvals approve) records its run, done with the action's result or failed with its error. A wrong invocation is refused before anything is sent: an unknown flag names the flags there are, a flag without its value says so, and a missing --since says it is the start of the window to read. Echo Web refuses a since that is not an ISO instant and an actor kind that is not cron, agent, rule or approval, naming the value.

Refusals#

• Without NEXT_PUBLIC_SUPABASE_URL it prints exactly "NEXT_PUBLIC_SUPABASE_URL is not configured" to stderr and exits 1.
• After the URL is present, without SUPABASE_SERVICE_ROLE_KEY it prints exactly "SUPABASE_SERVICE_ROLE_KEY is not configured" to stderr and exits 1.
• If Supabase refuses a SELECT, the CLI prints the returned database error message to stderr and exits 1.