Automated Cyber
Solutions
← Project indexThomas “Tom” Cappetta

Original development · Local implementation · 2026

AI Logging

A source-linked history of AI sessions, tool events, and artifact versions for investigation, integrity checks, and context recovery.

The problem

AI work spreads across sessions, tools, and generated files. The next investigation needs more than a recollection of what the model said: it needs retained sources and the artifact version associated with the work.

My contribution

I built collection adapters, a SQLite journal, source references, artifact snapshots, search and context tools, and a local dashboard. I separated collection from presentation so closing the dashboard does not stop collection.

Interactive demonstration · synthetic trace

Follow a session to its artifact.

Inspect a retained session, its tool event, and an artifact version. Compare the artifact’s current bytes with its recorded baseline to see what an integrity check can—and cannot—tell you.

  1. Session / demo-01Investigate a parsing discrepancySource reference: synthetic-session:1
  2. Tool event / demo-02Run a local regression checkParent: demo-01 · retained event
  3. Artifact / notes-v1Recorded content: baseline evidenceParent: demo-02 · explicit version
Select “Check baseline” to compare the current artifact with its recorded version.

This uses SHA-256 in your browser. A matching digest supports consistency with a retained baseline; it does not prove the content is true or supply a trusted external timestamp.

Engineering decisions

Duplicate handling and restart checkpoints support replay of retained records. Explicit artifact versions connect a session to a particular output, rather than assuming the current file is the file that was reviewed.

Unknown cost stays unknown when reliable pricing or charge data is absent. Coverage gaps are recorded separately from a healthy collector process; an active service alone cannot establish complete capture.

Evidence & validation

Retained operating notes document local ingestion, integrity checks, backup and rebuild behavior, collector crash recovery, and replay after an outage. Source tests address rewrites, journal changes, and artifact corruption.

This portfolio did not rerun or install the collector. Its synthetic demonstration tests digest mismatch and recovery concepts without loading real conversations.

What the work demonstrates

Searchable records help recover project context, follow tool actions, and inspect the source and artifact version behind a finding.

Scope & limitations

Collection depends on retained and accessible source records. Deleted or unavailable events remain gaps; session elapsed time is not a measure of active human work.

Hashes and a hash-linked journal support baseline consistency checks, not truth, legal admissibility, or externally trusted time. Continuous cloud transcript access is not established by local collection.

What you can inspect

Inspect the synthetic trace above and the described data relationships. Private conversations, source paths, artifact contents, and local storage are excluded from this public account.

Get in touch

Have a challenge
worth solving?

Start a conversation about engineering, research, or a problem that needs a closer look.