Audit & Logging

What the customer Account shows today

• lifetime Golden tool-call count;
• successful and failed/rejected activity counts for the current activity window;
• usage by tool type, such as command or file actions;
• a bounded list of recent activity with tool, outcome and timestamp;
• parallel/workflow and connection state where applicable.

Account activity is not a command transcript. It intentionally avoids showing command text, file paths, stdout/stderr and infrastructure secrets as commercial analytics.

What Golden stores for call activity

Current raw call rows are deleted after 30 days. Lifetime aggregate counters can remain so the Account can show durable usage value without keeping an infinite event log.

What foreground Session Mode shows locally

Windows and macOS foreground Session Mode have a local LIVE ACTIVITY surface. It displays only real runtime events.

• A real incoming command can be shown as a sanitized and truncated preview.
• Execution state can be shown as received/running/success/failed.
• Completion details may include exit code, elapsed time and stdout/stderr byte counts.
• The terminal scrollback remains local to that terminal session.

Golden Cloud does not gain a new persistent command-history store merely because the foreground UI shows the command locally.

Golden logs are not the same as OS or service logs

Your operating system and remote services may already keep their own logs: systemd journal, Windows Event Log, SSH logs, Docker logs, web-server logs, application logs or cloud-provider audit records.

Those remain separate evidence sources. Golden can inspect them when the current connected user or remote credential is allowed to read them. Reading a log does not automatically copy that whole log into Golden's commercial activity history.

What the commercial activity history does not store

• command arguments;
• raw stdout or stderr;
• project file contents;
• hostnames or network inventory as a permanent machine registry;
• local terminal scrollback.

This does not mean returned data never leaves the device. If a tool returns stdout, file contents or another result, that result travels back to the AI client and can become part of that AI conversation.

What is not a full audit trail yet

Golden does not currently provide a durable customer-facing forensic timeline containing every exact command, patch, argument and output forever. A richer audit trail would be a separate product capability with its own retention, privacy and secret-handling decisions.

Golden Secrets / Secure Input is also still in development. Today the preferred pattern is to keep raw credential values in existing local stores and let the AI reference them without printing them. See Golden Secrets / Secure Input.

Audit & Logging FAQ

Can I see the exact command later in my Golden Account?

Not from the current commercial activity history. The Account stores bounded metadata, not a durable command-text transcript.

Can I see the exact command while Session Mode is running?

The local foreground terminal can display a sanitized and truncated preview of a real command it receives. That local scrollback is not synced into a permanent Golden command-history database.

Does Golden store stdout and stderr?

The commercial call-history record does not persist raw stdout/stderr. Tool output returned for the task can still travel to the AI client and may be present in the AI conversation or in logs produced by the underlying system.

Where should I look after a security incident?

Use the appropriate evidence sources together: Golden Account metadata, the AI conversation, the local foreground terminal if still available, and the OS/application/SSH/cloud logs relevant to the action.