Answer “who accessed this, and when?”

Chronicle

A tamper-evident audit log of every operation.

In Moat, the engines record their operations to Chronicle: who called, what they did, and whether it succeeded. Query by engine, operation, actor, or time range. Events are hash-chained, and VERIFY reports whether any have been altered or removed.

Use it from your app

terminal

# Every Cipher decrypt since a point in time (Unix seconds)
$ curl -s localhost:8200/v1/chronicle \
    -H "Authorization: Bearer $AUDITOR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"args":["QUERY","ENGINE","cipher","OP","decrypt","SINCE","1759104000"]}'

# Check that no events were altered or removed
$ curl -s localhost:8200/v1/chronicle \
    -H "Authorization: Bearer $AUDITOR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"args":["VERIFY"]}'

What it does

Engines in Moat record their operations automatically.
Filter by engine, operation, actor, and time range.
Events are hash-chained. VERIFY detects edits and deletions.
Summaries: most active actors, busiest resources, error rates.
Ingest your own application events alongside ShrouDB's.

Turn it on

Chronicle runs inside Moat, the ShrouDB server. Add this to moat.tomland restart. It shares Moat's encrypted storage, access tokens, and audit log with the other engines.

moat.toml

[engines.chronicle]
enabled = true

Commands

Over RESP3, prefix each command with CHRONICLE. Over HTTP, send POST /v1/chronicle {"args": [...]}. The SDKs have a method for each.

Command	Args	Description
QUERY	[ENGINE <e>] [OP <op>] [ACTOR <a>] [SINCE <ts>] [UNTIL <ts>] [LIMIT <n>]	Find events
COUNT	[ENGINE <e>] [OP <op>]	Count matching events
ACTORS	[window]	Most active callers
HOTSPOTS	[window]	Most accessed resources
ERRORS	[window]	Operations by error rate
INGEST	<json>	Record an application event
VERIFY		Check the hash chain

Try Chronicle locally

The quickstart takes about five minutes.

Quickstart All engines