Know the result before you verify
On the verified 0.8.3 instance, audit-chain verification fails at sequence 513. That known result does not, by itself, mean somebody entered the computer.
Read the summary before the record
armaraos security status
This describes configured security mechanisms. It does not prove that the recorded chain currently verifies.
Read an event as five fields
armaraos security audit --limit 20
| Field | Question it answers |
|---|---|
| action | What kind of event was recorded? |
| agent_id | Which agent was involved? |
| detail | What extra context was stored? |
| outcome | How did the action finish? |
| seq | Where is it in the ordered record? |
These entries record the disposable agent created and ended in Module 2.2. New schedule events can push older actions outside the last twenty.
Request machine output only when needed
armaraos security audit --limit 20 --jsonThe current human rendering already looks JSON-shaped. The explicit flag is still the contract to use in a script. Inspect and redact either form before sharing.
Run the known failing verification
armaraos security verify
A chained audit log links each entry cryptographically to the previous one so a change becomes detectable. This result means the current record cannot prove that it remained unedited.
Use the record without overstating it
| Reasonable claim | Claim this build cannot support |
|---|---|
| ArmaraOS recorded this action and outcome. | The chain proves nobody edited the log. |
| The sequence helps reconstruct order. | The record is forensic evidence. |
Module 7.3 uses this distinction in a professional report.
Do not invent missing approval events
The CLI approval exercise produced no queued decision.
There is no genuine reject or approve action for the course to point at. This lesson uses the spawn and kill pair that the audit actually recorded.
Check it / read your own record
Name one event precisely.
armaraos security audit --limit 20Identify one action, outcome, and sequence. Then run verify and explain why the result makes this record informative rather than forensic.
Audit details can contain prompt text, IDs, local paths, and tool output. Read and redact them before sharing.
Troubleshooting for this sitting
| What you see | Likely cause | What to do |
|---|---|---|
| An expected event is absent | Newer entries pushed it past the limit. | Increase the limit cautiously and review before sharing. |
| Human output looks like JSON | That is the current rendering. | Use the fields normally. |
| Verify reports failed | The known 0.8.3 chain break. | Treat the log as informative, not forensic. |
verify --json errors | Verify has no JSON option. | Run the human command. |