Quantum Trust Protocol Audit Log
Overview
The Quantum Trust Protocol Audit Log tab (panel title Quantum Trust Protocol — Message History) shows the full ML-KEM-1024 encrypted message history between the console and all registered vault agents. Every message exchanged over the Quantum Trust Protocol (QTP) appears here, regardless of which agent sent or received it.
Why the Audit Log Exists
All console-to-agent and agent-to-console messages are encrypted using ML-KEM-1024 post-quantum key encapsulation. Plain API calls are not used — every message in this table was sealed before transmission and can only be read by the intended party. The audit log gives operators a verifiable audit trail of every encrypted exchange without exposing message content.
Message Table Columns
| Column | Meaning |
|---|---|
| Type | The message category, as a short label (see types below) |
| From | Who sent the message: Console or the vault agent's name |
| To | Who received it: Console or the vault agent's name |
| Detail | Human-readable description of the message content (or its size when there is no description) — hover for the full text |
| QTP Msg ID | The full QTP message UUID |
| Conv | On the first row of a conversation: N msgs (or 1 msg) — hover for the Conversation ID; — on the other rows |
| Status | The 3-stage delivery pipeline Req › Del › Ack — Req (initiated), Del (received by the peer), Ack (decrypted and acted on); completed stages show ✓. A failed message shows ✗ Failed |
| Time | When the message was created, shown as clock time with relative age (e.g. 14:05 (3m ago)) |
Conversation Grouping
Messages that belong to the same exchange are grouped by a shared Conversation ID (correlationId). A colored left border indicates grouped messages — all rows with the same color are part of one conversation.
For example, a credential delivery conversation shows two rows:
- Console > Agent: credential package sent (Req › Del)
- Agent > Console: acknowledgement (Ack)
The N msgs badge in the Conv column shows how many messages are in a group. Groups are sorted newest first; inside a group the messages run oldest first (request, then response, then acknowledgement).
Message Types
The Type column and the All Types filter show each type by a short label (in brackets below, e.g. HB Check-in); the table gives the full message type name:
| Type | Direction | Meaning |
|---|---|---|
HEARTBEAT_CHECKIN (HB Check-in) | Agent > Console | Every heartbeat POST from the vault agent. Confirms the agent is alive and reachable. Auto-ACKed at receive time. |
HEARTBEAT_RESPONSE (HB Response) | Console > Agent | Encrypted reply to the heartbeat — carries the settings block (heartbeat interval, log level, console public key) and any flags (upgrade available, poll-health request). |
HEARTBEAT_CONFIG (HB Config) | Console > Agent | A specific config change (e.g. heartbeatIntervalMinutes=60, vaultLogLevel=DEBUG, vaultAgentLogRetentionDays=7) — created when an operator saves the value; delivered inside the next HEARTBEAT_RESPONSE. |
CONSOLE_RESPONSE (Console Resp) | Console > Agent | Encrypted reply to non-heartbeat agent queries — sync group list, device list, sync status, planned sync, sync readiness, window status, etc. Multiple may appear per cycle, one per API call the agent made. |
CREDENTIAL_DELIVERY (Credential) | Console > Agent | An encrypted device credential bundle (ObjectScale management or SSH switch password) delivered to the agent. |
KEY_ROTATION_REQUEST (Key Rotation) | Console > Agent | Service-account key rotation instruction (queued by the Target Auth tab). |
LOG_UPLOAD (Log Upload) | Agent > Console | The agent's zipped log archive, uploaded over the QTP channel. Auto-ACKed at receive time. |
VAULT_OPEN (Vault Open) | Agent > Console | Vault agent announced opening of the vault network. Sent once per open period — when the first operation (a heartbeat, or a protection group's sync) needs the vault; the subject's reason names that operation (heartbeat, sync:<group> (scheduled), (retry), (adopt)). Operations that start while the vault is already open don't send another one. |
VAULT_CLOSE (Vault Close) | Agent > Console | Vault agent announced closing of the vault network, with the open period's duration. Sent once, when the last operation holding the vault finishes. The records of every operation in between (heartbeat, start-sync, sync-status polls, …) appear between the VAULT_OPEN and the VAULT_CLOSE. A vault agent restart during an open period leaves that period without a VAULT_CLOSE and the restarted agent sends a new VAULT_OPEN — the vault isn't closed when the agent stops, so running copy jobs aren't cut off. |
MY_GROUPS_REQUEST (Groups Req) | Agent > Console | Agent requested its assigned sync group list. |
SYNC_READINESS_REQUEST (Sync Check) | Agent > Console | Agent asked the console whether a window is safe to start (preconditions met, no in-flight conflicting job). |
START_SYNC_REQUEST (Start Sync) | Agent > Console | Agent reported it is starting a sync window. |
SYNC_STATUS_REQUEST (Sync Status) | Agent > Console | Agent reported window progress or completion. |
PLANNED_SYNC_REQUEST (Plan Sync) | Agent > Console | Agent announced its planned window schedule for a group. |
WINDOW_ABANDONED (Win Abandoned) | Agent > Console | Agent abandoned a window (e.g. health check failed or aborted mid-cycle). Triggers alarm CV-114. |
SYNC_MISSED (Sync Missed) | Agent > Console | A run day's schedule window ended without its scheduled sync having started (vault agent, vault or console down). Triggers alarm CV-117; the next run is the next calendar day. |
SYNC_TIMEOUT (Sync Timeout) | Agent > Console | A sync's jobs were still running after the Sync Time Limit (Vault Data Sync Dashboard > Settings). Triggers alarm CV-116; the agent then closes the vault and re-adopts the jobs at its next heartbeat. |
DEVICE_HEALTH_REQUEST (Health Req) | Console > Agent | On-demand device health poll (operator clicked Request Health). |
DEVICE_HEALTH_REPORT (Health Report) | Agent > Console | Per-device health snapshot (alarms, storage, connectivity). Sent every heartbeat for assigned devices. |
NODE_INVENTORY_REPORT (Node Inventory) | Agent > Console | The vault ObjectScale system's nodes for node-tier licensing: each node's usable capacity and hardware product name, read by the agent from inside the airgap. Sent once a day per vault ObjectScale device, and right after a credential Re-Sync that changes the credentials or SSH settings (a Re-Sync with nothing changed does not send one early). A report that fails is not retried: the next one comes a day later. FAILED means the console refused it, for example because another agent holds the device's credentials, or that the agent could not read the vault at all (for example the management login failed); the error column gives the reason. |
PROVISION_NAMESPACE (Provision NS) | Console > Agent | Instruction to create vault-side namespace + service account for a group entering Vault Mode. |
PROVISION_NAMESPACE_ACK (Provision ACK) | Agent > Console | Agent confirmed namespace provisioning completed and reported the new service account credentials. |
RETRY_AVAILABLE | Console > Agent | Signal flagged inside heartbeat response — tells the agent there are windows in a retryable state to pick up. The agent then starts a retry-only sync for every group not already syncing. A sync that fails while the agent watches it retries on its own without waiting for this signal; this is the safety net for failures it didn't see. It no longer shortens the heartbeat interval. |
UPGRADE_MANIFEST (Upgrade Mfst) | Console > Agent | Self-upgrade manifest (SHA-256 + single-use download token) returned to the agent when self-upgrade has been triggered. |
Filters
- Type (All Types) — filter to a specific message category, picked by its short label
- Direction (All Directions) — show only Agent > Console or Console > Agent messages
- Clear — appears while a filter is active; removes the filters and shows all messages
Filters apply server-side. Changing a filter resets to page 1 immediately.
Auto-Refresh
The panel refreshes automatically every 30 seconds. The countdown timer appears next to the Refresh button. Click Refresh at any time for an immediate reload.
Pagination
Records are shown 50 per page, newest first. Use ← Prev / Next → to navigate. The footer shows the record count (marked (filtered) while a filter is active) and Page N of M.