Audit Repository

Jozu Hub maintains a centralized, tamper-evident audit log of every change event across all connected environments. The audit log is designed for compliance evidence: any retroactive modification is cryptographically detectable, and exports are formatted for direct import into governance systems.

The audit repository is available on both SaaS and self-hosted deployments. On self-hosted deployments, the audit log includes events from connected Agent Guard instances, giving a single record across the supply chain and runtime.

What gets logged

The audit log captures every event that affects an artifact, a policy, or a runtime decision:

• Artifact pushes and pulls
• Security scan results and attestation attachments
• Policy evaluations at pull, and runtime
• Agent Guard decisions on artifact loads, tool invocations, and inference requests
• Human-in-the-loop approvals and denials
• Organization, repository, and user changes

Every artifact has a full version history that shows its path from initial push through experiment, staging, and production. Each step records which scans passed, which policies it was evaluated against, and which attestations were attached.

Tamper-evidence

Each log entry is cryptographically linked to the entries before and after it using a Merkle tree structure. Any retroactive modification to a single entry breaks the chain and is detectable on next verification. The chain itself is the evidence: there is no separate "trust store" to maintain.

This makes the audit log usable as primary evidence in regulated environments where compliance teams must demonstrate that records have not been altered after the fact.

Audit log vs. timeline

Jozu Hub also exposes a timeline view on each repository. The two are distinct and serve different audiences.

• Timeline: Version history and changes to repositories and organizations. Useful for developers tracking artifact evolution and recent activity. Not cryptographically chained.
• Audit log: Tamper-evident record of all events for compliance evidence. Includes policy evaluations, runtime decisions, and approval events that do not appear in the timeline.

If you are answering a developer question (what changed, when), use the timeline. If you are answering a compliance question (prove it hasn't been altered), use the audit log.

Export

Administrators can download audit logs as CSV files directly from the Hub UI. The export is designed for import into SIEM, GRC, and audit tooling without manual transformation. CSV format preserves the chain hashes so verification can be re-run after export.

In demos and customer environments the audit log export typically completes in seconds, even across multiple repositories. This is the basis for the "compliance evidence in under one minute" claim used in customer conversations.

Connection to Agent Guard

When Agent Guard is connected to Hub, its local audit log entries sync to Hub's central audit repository. Agent Guard's audit log is also cryptographically chained and operates autonomously when disconnected. Once connectivity is restored, the entries sync upstream and are merged into the central chain in Hub.

This means a single audit query in Hub returns evidence spanning the supply chain (push, scan, sign, attest) and the runtime (artifact load, tool invocation, guardrail evaluation, HIL approval) for any artifact across any environment that has been connected.