CLI Reference

Local Audit Commands

Read the repository-local alpha audit log. It is a diagnostic facility, not a complete or tamper-proof record.

Not a compliance control

The log is a local JSON-lines file under .dits. A user with filesystem access can edit or remove it, and current commands do not record every repository operation. It provides no remote identity, append-only evidence, retention guarantee, certification, or hosted audit policy.

Command	Current behavior	Usage
audit	Show recent local events or filter by event type	dits audit [--last <N>] [--event-type <TYPE>]
audit-stats	Summarize outcomes in the local log	dits audit-stats
audit-export	Export the local log as JSON	dits audit-export [--output <PATH>]

`dits audit`

Shows the newest 20 events by default. Each printed row includes the timestamp, event type, outcome, and optional resource stored in the local record.

# Show the newest local records
dits audit

# Choose a count
dits audit --last 50

# Filter by a recognized event type
dits audit --event-type logout

Recognized filter names include login, logout, login_failed, password_changed, keystore_created, repo_init, commit_created, file_added, file_accessed, and encryption_enabled. A recognized name means the reader understands that event schema; it does not mean every corresponding command currently emits that event.

`dits audit-stats`

Counts total, successful, failed, and denied records and reports the oldest and newest timestamps present. The figures describe only the current local file.

dits audit-stats

`dits audit-export`

# Print one JSON document to standard output
dits audit-export

# Write the same export to a local file
dits audit-export --output audit-export.json

Protect exported metadata

Events can contain repository paths, timestamps, outcomes, and client version information. Apply your own access, retention, and redaction policy before sharing an export.

See security architecturefor the current trust boundary and the status and roadmap for planned multi-user controls.