Skip to content
quoxcli

Look back in the audit trail

Machine verified A machine ran this on our install and checked the result against the CLI. A test report is linked. CLI 0.3.1, checked 2026-10-17.

What happened before that date?

Ask for the last things your agents recorded before a point in time. Then query the audit trail yourself.

What you get: the record of what your agents and workflows did before a given moment, for an incident review or an auditor’s question.

Ask Quox

Section titled “Ask Quox”

Ask in plain words:

quox · talking to Quox

From the AEE audit trail, list the 3 most recent envelopes sent before 2026-03-01: the envelope id and intent of each.

▤ AOCL │ L1 identity complete · allowed · 1ms

▤ AOCL │ L3 policy gate complete · proceed · 7ms

◐ QUERY │ envelopes ✔ QUERY │ envelopes │ 200 total, 3 showing, 3 sample · 5.9s

◐ AEE │ query envelopes ✔ AEE │ query envelopes │ 3 envelopes, 3 total · 6.8s

⛓ AEE │ envelope opened · stream_success

Here are the 3 most recent envelopes sent before 2026-03-01, newest first. All three
come from the same QuoxFlow run of the  mockup-regenerate  workflow.

# │ Envelope id │ Intent                  │ Sent (UTC)
──┼─────────────┼─────────────────────────┼────────────────────────
1 │ 01KJKA…     │ quox.flow.completed     │ 2026-02-28 23:54:10.120
2 │ 01KJKA…     │ quox.flow.node.complete │ 2026-02-28 23:54:10.116
3 │ 01KJKA…     │ quox.flow.node.log.info │ 2026-02-28 23:54:10.114

The run finished in 311 ms and affected no mockup mappings.

20.6s · 2 tools · 0 approvals

A real turn on our own install (CLI 0.3.0, 17 Oct 2026), replayed at speed. Names changed. Type the same words into quox.
✔ Machine verified against the CLI on 17 Oct 2026 · test report mvbuce

Quox queried the AEE audit trail for envelopes sent before the date and listed the three newest. It also said they all came from one workflow run, and what that run did.

Do it yourself

Section titled “Do it yourself”
audit trail 
quox aee query --before 2026-03-01 --limit 3ID         Type     From              To            Intent                     Time01KJKA…    event    agent.quoxflow    quox.audit    quox.flow.completed        2026-02-28T23:54:10.120Z01KJKA…    event    agent.quoxflow    quox.audit    quox.flow.node.complete    2026-02-28T23:54:10.116Z01KJKA…    event    agent.quoxflow    quox.audit    quox.flow.node.log.info    2026-02-28T23:54:10.114Z
From a real run on our own install. IDs shortened.

Each row is one envelope: who sent it, to whom, what it was for (Intent) and when. quox aee get <id> opens one in full.

What just happened

Section titled “What just happened”

Quox read the audit trail. Reading it changes nothing.

Next

Section titled “Next”