Summary

Add a small, metadata-only audit ledger for agent runs and tool actions so operators can answer who acted, what action ran, when it happened, and how it ended without reading transcripts or enabling raw-content telemetry.

Problem to solve

OpenClaw already has the right source signals, but they serve different jobs:

• session transcripts preserve conversation artifacts;
• the agent event stream carries sequenced run and tool lifecycle updates;
• task and cron records cover detached/background work;
• diagnostics and hooks support live observation and optional export.

There is no single durable, bounded query path for interactive agent runs and their tool actions. Reconstructing that history from transcripts or logs risks exposing prompt, argument, result, and error content, while task records intentionally do not cover every interactive run.

Proposed solution

Add one canonical shared-SQLite audit event table and a typed read contract with:

• stable event identity and global ordering;
• agent, session, actor, run, and tool-call provenance;
• closed action, status, and error-code fields;
• metadata-only redaction as an invariant: no prompt, message, tool argument, tool result, command output, or raw error text;
• bounded pagination plus filters for time, agent, session, run, action kind, and status;
• a read-only Gateway RPC and CLI JSON output for bounded export.

Project records from the existing sequenced agent run/tool lifecycle rather than creating another conversation or transcript store. Use the shared state database and Kysely. Keep retention fixed and bounded; do not add configuration in this foundation.

Initial scope:

• agent run started and terminal records;
• tool action started and terminal records, including failure/timeout/denial codes when the existing lifecycle proves them;
• read-only query/export surface;
• persistence, ordering, filter, redaction, and terminal-path tests;
• operator documentation.

Non-goals:

• Control UI work;
• prompt/body/tool payload capture;
• replacement of transcripts, task records, hooks, or diagnostics exporters;
• broad policy, approval, or workflow modeling;
• new audit configuration.

Alternatives considered

• Parse transcripts or logs on demand: content-heavy, difficult to bound, and duplicates existing artifact semantics.
• Add a JSON/JSONL audit file: conflicts with the shared SQLite state boundary and creates another lifecycle/retention owner.
• Depend only on diagnostics export: useful for telemetry, but optional exporters are not the canonical local operator record.
• Extend background task records to every interaction: changes the task ledger's detached-work contract and still does not model individual tool actions cleanly.

Impact

Operators gain a privacy-preserving local history for run and tool accountability. The main risks are write amplification, unbounded retention, accidental content capture, and ambiguous terminal classification; the implementation should address those with selective lifecycle projection, fixed pruning, a column-only metadata schema, and tests against failure/cancellation/timeout paths.

Evidence/examples

Related requests and current candidates:

• Add agent activity timeline view #54577 asks for an operator activity timeline; this issue supplies the durable metadata foundation without UI.
• Feature: emit plan/session lifecycle events to /var/log/openclaw-events.jsonl #73603 asks for lifecycle event logging; this keeps persistence in the shared state database rather than adding a file sink.
• Tool call observability: input sanitization, error categorization, and context writeback #55806 asks for safer tool observability and error categories; this records only normalized metadata and codes.
• [Feature]: Add AI safety and quality observability events #82548 is a broader observability design; this issue is limited to durable run/tool accountability.
• Persist gateway restart audit events #97189 covers gateway restart records; it remains a separate producer/candidate and is not changed here.
• feat: add session thread management #98510 changes session management and Control UI; this issue does not depend on it and should avoid its session/UI files.

Current source provides sequenced lifecycle events with run/session context, normalized run terminal outcomes, sanitized tool result handling, and a shared Kysely-backed state database. Those seams are sufficient for a bounded first implementation without a new dependency.