audit:reported

Full payload

{
  "summary": "Window 2026-06-08T09:00:15Z – 10:00:15Z contains 5 events from 2 actors. Agent '12-rbqm-analytics' fired 4 consecutive 'compute-rankings' events (≈every 15 min) versus 1 event from the only other actor, constituting a relative rate spike. No 'promote' actions were observed, so no missing-signature violations on that action type. No A4 autonomy-class references detected. All compute-rankings events carry null signature_id, which is noted but consistent with automated cron invocations; QA lead should confirm whether cron-sourced agent actions are exempt from signature requirements per platform policy.",
  "anomalies": [
    {
      "kind": "high-rate-spike",
      "message": "Actor '12-rbqm-analytics' fired 4 out of 5 events in the window (80%), all 'compute-rankings', at approximately 15-minute cron intervals. While individually each is a scheduled cron invocation, the volume dominance relative to the only other actor ('27-audit-trail', 1 event) and the rapid cadence warrants QA review to confirm the scheduler has not misconfigured the interval or triggered duplicate jobs.",
      "eventIds": [
        "ba05c45b-2425-4973-b5f9-13965725e786",
        "8030e262-7b86-4ef2-b2e1-266869679736",
        "3fd3566a-3101-4e51-b1fb-f24ac24c5f5d",
        "fa81622b-815a-4cbf-949e-ad8c1299c444"
      ],
      "severity": "medium"
    },
    {
      "kind": "other",
      "message": "All 5 events in the window carry null 'signature_id', including the 'audit:reported' event from '27-audit-trail'. While none are 'promote' actions (which would trigger a hard missing-signature violation), the absence of signatures across all event types — including audit trail reports — should be confirmed as intentional per platform policy for agent-originated cron and audit events.",
      "eventIds": [
        "c6e17486-27c7-4bb4-b64e-9fed38b9e025",
        "ba05c45b-2425-4973-b5f9-13965725e786",
        "8030e262-7b86-4ef2-b2e1-266869679736",
        "3fd3566a-3101-4e51-b1fb-f24ac24c5f5d",
        "fa81622b-815a-4cbf-949e-ad8c1299c444"
      ],
      "severity": "low"
    }
  ],
  "windowEnd": "2026-06-08T10:00:15.152Z",
  "payloadHash": "1cd62642acb774ee5cdbb28b75d7ffa61e8c4c5bf4945b83849068122dbd120c",
  "windowStart": "2026-06-08T09:00:15.191Z",
  "modelVersion": "claude-sonnet-4-7-20260101",
  "eventsExamined": 5
}