Audit Reports

check answers a question. audit produces the document, the artefact you hand a customer, an auditor, or your own engineering team six months from now.

Like check, it needs no model endpoint, no network and nobody's inference budget. The report is the deliverable, so producing it must not depend on any of those.

Running an audit

# Every module this build has
oasis-agent audit

# One module
oasis-agent audit --profile preempt-rt

# What profiles this build actually has
oasis-agent audit --list-profiles

Profiles

A profile is all, or the name of one module. Membership is resolved from the catalogue at run time rather than from a maintained list, so a descriptor added to a module joins that module's profile automatically.

Profile	Runs
all (default)	Every check applicable to the subject
preempt-rt	The 33 real-time readiness checks
opc-ua	The 5 OPC UA checks
ethercat	The 4 EtherCAT checks
modbus	The 2 Modbus checks
iec-61131	The 1 toolchain check

Module profiles appear only when the corresponding pack is compiled into your build. --list-profiles answers for the binary in front of you.

Subjects and targets

Identical to check.

Flag	Default	Meaning
--subject	device	One of repo, artefact, device, endpoint
--target	This machine for device; the working directory for repo	A hostname, a path, an address
--catalogue	—	A directory of descriptor TOML layered over the built-in catalogue

oasis-agent audit --profile opc-ua --subject endpoint --target opc.tcp://10.0.0.5:4840

What the report contains

The report is written for a reader who was not in the room, months later, holding the report and not the box, and quite possibly arguing with it. Four properties follow from that.

It states its own limits

The report carries the tool version and a fingerprint of the catalogue that produced it, so a later reader can tell whether they are looking at the same questions. It says on its face that it is evidence, not a conformity assessment.

Unevidenced is nowhere near passed

Checks that returned not_applicable or error get their own section, under a heading that says in words that they are not passes. They are never added into a total a reader could mistake for a score.

Confidence is surfaced where the reader stops

If any finding short of proven contributed to the assessment, the report says so in the summary block, in capitals, not in a footnote nobody reaches.

It is diffable

Two runs over unchanged input produce byte-identical text apart from a single generated: timestamp line. That is tested, not asserted.

This is what makes drift detection across a fleet possible. A report you cannot diff is a report you cannot compare, and every re-run would look like a change.

Exit codes

Same contract as check.

Code	Meaning
0	Nothing failed, including checks that could not be measured
2	Something failed

A pipeline that turned red because a tool was missing would teach its owners that a red audit means nothing, which is the one lesson this must never teach.

In CI

#!/bin/sh
set -e

# Fails the job on a real failure; stays green when a probe could not run
oasis-agent audit --profile preempt-rt > rt-evidence-$(date +%F).txt

Commit the output, or archive it as a build artefact. Because reports are byte-stable, the diff between two runs is exactly the set of things that changed on the machine.

From a conversation

The Audit tool exposes the same profiles to the agent, so a conversation can produce the report and then discuss it. Audit is a safe-tier tool and never prompts.

Pair it with the check-triage skill, which covers what each verdict and confidence class licenses you to claim before you report results to anyone.

Over the control protocol

audit.run and checks.run are available over OCP, but they are host-mutating methods and are off by default. Start the server with --allow-host-mutations to enable them. See OCP Method Reference.