Activity log and trail

The activity log

Every tool call by an agent (over MCP, the API or the RFX assistant) and every decision a person takes on a page is recorded: when, through what, which company and agent and how it was proven, which action, the result or error, how long it took, the client address and user agent, and the arguments.

• Keys, tokens, passwords, codes and signatures appear as [hidden]; document contents only as their length.
• Every call to the language model is a row too (through model): what it was for (reading sources, transcribing, drafting the vocabulary, the assistant), for which company, the model asked for and the model that answered (the fallback may answer with another), tokens, time, stop reason and the provider's request id. Its lineage: the product, the source files and a SHA-256 of the exact lines read, and of the input and output. Never the content.
• Optionally, they go to Langfuse through its SDK (set LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, and LANGFUSE_BASE_URL for another region). One trace per piece of work, under names dashboards and evaluators can rely on: handle-assistant-message for one message to the RFX assistant (the person's message and the reply on its root, a generate-response generation per model call, an observation per RFX tool it ran, all in the conversation's session; the person's Apply and Dismiss as apply-proposed-change and dismiss-proposed-change events), and read-vendor-sources, transcribe-document and draft-vocabulary for the reader. Each model call carries the model that answered, the tokens (cache reads and writes apart, so Langfuse prices them) and the tools it was offered; every observation carries the environment, the release (RFX_RELEASE), the person (a pseudonym unless content is sent) and, as tags, the feature and the side. Keys and tokens are masked everywhere. By default the assistant's conversations go whole and the reader's work as counts and hashes only, with companies as pseudonyms; RFX_LANGFUSE_CONTENT=all sends every prompt and answer, off none.
• The operator sees everyone's, on the login page and at GET /human/activity (filter with who, page with before). A vendor or buyer sees only its own, also in the vendor workspace.

The trail

The business record of what happened: requirements, NDAs, approvals, offers and counters, decisions, signatures. Each event is tagged with one of five capabilities (think, discover, trust, negotiate, transact) and chained by hash to the one before, so a changed or removed event is detectable: an event's hash is the SHA-256 of the previous event's hash followed by the event itself, cut to 16 hexadecimal characters, and the first event follows genesis. get_trail returns it; the order form carries its last hash.