0xlaiho/Apolysis Agent Audit
Record kernel-level evidence of what an AI agent (or any command) actually did in your workflow, and surface undeclared side effects.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- Apache 2.0
Pinned Snippet
uses: 0xlaiho/apolysis@c00a84650e306d01b44e2fbd6b80f1395c852f74 # v0.3.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| run | Command to run under observation (executed with bash -c). | yes | — |
| session | Session id written into every record. Defaults to apolysis-<run id>-<attempt>. | no | "" |
| agent-kind | Agent adapter hint, for example codex. Any non-empty label works. | no | ci-agent |
| policy | Path to an Apolysis policy file. A minimal audit-only policy is generated when omitted. | no | "" |
| intent-log | Optional Codex response-items JSONL to correlate declared intent against the observed timeline. | no | "" |
| version | Apolysis release tag to download when binary/bpf-object are not provided. | no | v0.3.0 |
| binary | Path to a pre-built apolysis binary (skips the release download). | no | "" |
| bpf-object | Path to a pre-built CO-RE observer object (skips the release download). | no | "" |
| output-dir | Directory for the timeline and reports, uploaded as a workflow artifact. | no | .apolysis-action |
Outputs
| name | description |
|---|---|
| timeline | Path to the recorded JSONL timeline. |
| exit-code | Exit code of the observed command. |