Trace one action through the audit trail
What else happened around this action?
Start from one envelope in the audit trail and follow the thread it belongs to, backwards and forwards.
What you get: the context around a single recorded action. One envelope tells you what happened; its neighbours tell you what led to it and what it set off.
Ask Quox
Section titled “Ask Quox”Give Quox an envelope id and ask what surrounds it, in your own words:
For envelope ENV_MW2RJA45_W1AXWAH8, show me what came before it and what followed from it.
▤ AOCL │ L1 identity complete · allowed · 1ms
▤ AOCL │ L3 policy gate complete · proceed · 9ms
◐ GET │ envelope chain ✔ GET │ envelope chain │ 1 chain length, 1 chain, 2 same corr · 2.7s
⛓ AEE │ envelope opened · ops.tool · get_envelope_chain ok
⛓ AEE │ envelope opened · stream_success
The chain for ENV_MW2RJA45_W1AXWAH8 is short. It has no parent and no children. The envelope itself • Type and intent: an event, aocl.tool.execute • Route: from agent.quox to system.aocl • Time: 2026-11-04 23:43:46.421Z • Chain length: 1. It has no reply links in either direction. Same correlation ID ( cli-mw2rj8kn-cicmatka ) • Before: ENV_MW2RJA3Z_63HJNY2J is an event, ops.tool.executed , from agent.quox to system.tools . It was logged at 23:43:46.415Z, 6 ms earlier. • After: nothing. Your envelope is the last one with this correlation ID. This looks like one governed tool call from agent Quox, and the audit trail recorded it as two events. The first logged the tool run. The second passed it to the AOCL layer. The link between them is only the shared correlation ID and the timing, not a reply link. I can't say from this result which tool was called, because neither envelope carries the tool name or arguments here. I can check the WARD witness receipt for either envelope if you want to confirm it's in the tamper-evident chain.
23.3s · 1 tool · 0 approvals
quox.✔ Machine verified against the CLI on 4 Nov 2026 · test report mw2rjj
Quox read the envelope’s chain. It had no parent and no children, so it looked at the other envelopes sharing its correlation id: one came 6 ms before it, and none came after. It said plainly what the trail does not show, which tool was called, rather than guess.
Do it yourself
Section titled “Do it yourself”1. Open one envelope
Section titled “1. Open one envelope”quox aee get ENV_MW4196IY_B2O4CQ5Ytype eventfrom agent.quoxto system.aoclintent aocl.tool.executecorr cli-mw4190yv-lt0k4izjpayload tool_name: backup_status agent_id: quox duration_ms: 656 success: yes source: mcpid ENV_MW4196IY_B2O4CQ5Yts 2026-11-05T21:03:37.546ZThe corr line is the correlation id. Every envelope written for the same piece of work carries it.
2. Pull everything on the same thread
Section titled “2. Pull everything on the same thread”quox aee query --corr cli-mw4190yv-lt0k4izjID Type From To Intent TimeENV_MW4196IY_B2O4CQ5Y event agent.quox system.aocl aocl.tool.execute 2026-11-05T21:03:37.546ZENV_MW4196IP_LOIE3ZIZ event agent.quox system.tools ops.tool.executed 2026-11-05T21:03:37.537ZNewest first. The tool ran (ops.tool.executed), and 9 ms later the same call was handed to the policy layer (aocl.tool.execute). That is the same two-event shape Quox described in the conversation above.
What just happened
Section titled “What just happened”You started from one record and found the rest of its thread by correlation id, without trusting anyone’s summary. The envelopes are the audit trail itself; Quox only read them for you.
Check it yourself
Section titled “Check it yourself”Run quox aee get on the other envelope in the list: it carries the same corr value.