From 3f271122ecef0d124173c4d1cdd094d4f1b3fd95 Mon Sep 17 00:00:00 2001
From: Levi Neely <lkn@darkstar.example.net>
Date: Wed, 18 Mar 2026 23:53:02 +0100
Subject: [PATCH] Replace fabricated audit logging claims with actual
 observability (event stream, mailbox archives)

---
 docs/code-execution-security-guide.md |  2 +-
 docs/code-execution-security.md       | 11 ++++-------
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/docs/code-execution-security-guide.md b/docs/code-execution-security-guide.md
index d6066d2..24ea1cc 100644
--- a/docs/code-execution-security-guide.md
+++ b/docs/code-execution-security-guide.md
@@ -144,7 +144,7 @@ Validation is basic pattern matching. Not comprehensive - relies on sandbox for
 **Mitigations**:
 1. 9P socket permissions (Unix socket, user-only)
 2. anvilsrv enforces access control
-3. Audit logging in anvilsrv
+3. Observability via event stream and mailbox archives
 
 **Residual risk**: If subprocess has 9P access, it has the same capabilities as any 9P client. This is by design.
 
diff --git a/docs/code-execution-security.md b/docs/code-execution-security.md
index 84e50aa..19c75c4 100644
--- a/docs/code-execution-security.md
+++ b/docs/code-execution-security.md
@@ -34,7 +34,7 @@ The code execution pattern allows agents to write and execute bash code in a iso
 ┌─────────────────────────────────────────┐
 │ 9P Operations                           │
 │ - Unix permissions                      │
-│ - Audit logging                         │
+│ - Event stream / mailbox archives       │
 └─────────────────────────────────────────┘
 ```
 
@@ -248,10 +248,7 @@ if agentID != session.AgentID {
 }
 ```
 
-3. **Audit Logging**: All 9P operations logged
-```go
-log.Printf("9P: agent=%s op=%s path=%s", agentID, op, path)
-```
+3. **Observability**: State changes visible via event stream, message history via mailbox archives
 
 4. **Operation Whitelist**: Only allowed operations exposed
 ```go
@@ -308,7 +305,7 @@ import { evil } from "/etc/passwd";
 1. **Data Isolation**: Intermediate data stays in subprocess — only stdout/stderr returned to the model
 2. **Privacy Preservation**: PII processed in subprocess, never enters model context
 3. **Explicit Control**: Agent explicitly chooses what to print (and thus what the model sees)
-4. **9P Access Control**: Unix socket permissions, audit logging
+4. **9P Access Control**: Unix socket permissions, event stream for observability
 5. **Process Isolation**: Separate landrun sandbox per execution
 6. **Code Validation**: Pattern matching rejects dangerous constructs
 
@@ -562,7 +559,7 @@ The code execution pattern provides strong security through multiple layers:
 2. **bash Subprocess**: Process-level isolation
 3. **Landlock LSM**: Kernel-level enforcement
 4. **Resource Limits**: Prevent exhaustion
-5. **Audit Logging**: Comprehensive trail
+5. **Observability**: Event stream and mailbox archives
 
 **Security Posture**: Data isolation and explicit control over information flow via sandboxed subprocesses.