dome audit

dome audit reads the evidence Dome records for every governed action. Query or tail events, follow one activity chain end to end, browse the event catalog, and export to a file or a SIEM destination. Refer to Audit for what each event carries.

Query events

dome audit query

Query audit events with optional filters.

Stream events

dome audit stream

Stream audit events in real-time via SSE. Accepts the same filters as query except --limit and --compact.

Get event

dome audit get [event-id]

Get a single audit event by ID.

Enum values — event class, result, actor kind, surface — render as short tokens (governing, denied, gateway_mcp) in both the table and --format json output, and the filter flags accept those same tokens. Refer to Enum rendering reference.

Export events

dome audit export

Export audit events in JSON-lines, JSON, CSV, OCSF, or CEF format. The command pages to exhaustion up to --limit; it never formats only the first server page. It refuses an artifact when any page is incomplete, repeats a cursor, or would exceed the 10,000-event hard maximum. An unknown payload type is retained with an @unresolved marker and a compatibility warning instead of dropping the event.

Accepts the same filters as query, plus:

# Export the last 24 hours as OCSF for a SIEM
dome audit export \
  --since 2026-05-26T00:00:00Z \
  --format ocsf > audit.ocsf.json

Catalog

dome audit catalog list

List every audit event type. Complete and unpaginated. Requires audit.view.

dome audit catalog show [event-type]

Show field detail for one event type.

SIEM

Continuous audit → SIEM streaming for Datadog or Grafana Loki. Distinct from dome audit stream (live tail) and from batch export.

Use dome integrations list to find the slug or instance ID of a connected destination.

dome audit siem list
dome audit siem enable <slug-or-id>
dome audit siem resume <slug-or-id> --skip-to-now --yes

Streaming is forward-only from enable time. enable creates a stream; if one exists, use resume. disable keeps the cursor. --skip-to-now abandons backlog permanently.

enabled and delivery state are separate. A disabled stream retains its last health state, so state=active does not mean it is delivering unless enabled=true. The CLI combines both facts as stopped, stopped (was erroring), or a corresponding paused label. A destination that has never been enabled is absent from list, and status returns not found.

Hash chains

List chains

dome audit chains

List activity chains in the active workspace. A chain is the set of audit events sharing one activity_id — a session, an LLM turn, a conversation thread, or a scripted run — computed at read time by grouping on activity_id within the workspace.

A chain is listed when any of its events matches the filter. Per-chain counts always reflect the full chain. Drill into one chain's events with dome audit chain <activity-id>. Refer to Activity chains reference for the model and trust labels.

Per-event identity filters (--trace-id, --operation-id, --parent-event-id) and payload filters identify a single event, not a chain, and are not offered here.

# Recent chains in the active workspace
dome audit chains --limit 20

# Chains that contain a denied governing event in the last day
dome audit chains \
  --classes governing \
  --results denied \
  --since 2026-06-05T00:00:00Z

Each row reports the chain's activity_id, event count, last activity timestamp, outcome breakdown, trust label (server-owned, caller-asserted, or mixed — refer to Activity trust reference), and distinct event-type count.

Show chain

dome audit chain [activity-id]

Show one activity chain's events in order. A drill-in into audit query filtered by activity_id. Accepts the same per-event filters as audit query to narrow the chain's events further.

# Every event in one chain
dome audit chain case-12345

# Only the denied events in that chain
dome audit chain case-12345 --results denied

Emit events

Set --activity (or DOME_ACTIVITY_ID) on the root command to assert a stable activity ID. Every Connect RPC the run makes carries X-Dome-Activity-Id, so the audit events all share one activity_id and form one chain.

# One run, many commands, one chain.
export DOME_ACTIVITY_ID="case-12345"

dome agents register --name worker
dome rules apply ./rules
dome audit query --limit 5

# Inspect the chain you just emitted.
dome audit chains --since 2026-06-05T00:00:00Z
dome audit chain case-12345

--activity overrides DOME_ACTIVITY_ID. The ID is opaque to Dome — pick whatever maps to your unit of work. The header is first-party only and is never forwarded to third-party LLM or MCP backends.

The --activity emit flag (root command) and the --activity-id filter flag (audit reads) are distinct: one stamps events, the other selects them.