The third of the audit catalogue's five pages: the seats themselves, the servers they reach for and the network they touched. Who stood in for a seat that failed, an agent from outside taking a turn, an MCP server changed or answering oddly, a run slowed by a rate limit, and the hosts a run connected to.
Seats, servers and the network
| Type | Reported by | When | Detail carries | |
|---|---|---|---|---|
seat.stand_in | Mac | A seat whose provider failed answered through our route instead. | seat, model, reason | |
seat.external | Mac | A seat filled by another company's agent took a turn, or could not: the door out, never what went through it. | seat, host, answered, why | |
mcp.note | Mac | An MCP server answered in a shape its own published schema does not describe, or published a schema too loose to check; the seat was told once rather than the workflow broken. | message | |
seat.local | Mac | A seat ran on a local model. | seat, model | |
seat.free_fallback | Mac | A Free Key seat fell back to another source. | seat, from, to | |
seat.budget | Server | A member's seat reached 80% or 100% of its budget. | member, share, period | |
rate.limited | Mac | A seat's tokens a minute or an MCP server's calls a minute were reached, so the run waited. | kind (seat | mcp), who, limit, used, waitMs — or waitedMs and gaveUp when the wait ran out |
egress.connections | Mac | A run ended; the hosts it connected to, allowed and refused. | hosts (host, seat, allowed, calls), refused, more, limit | |
workspace.read | Mac | A discussion was allowed to read another folder. | dir | |
worktree.setup | Mac | A fresh worktree was prepared before anyone worked in it. | steps | |
worktree.linked | Mac | A worktree was linked to its main repository. | repo | |
project.folder | Mac | A project was given a folder. | project, dir | |
project.moved | Mac | A discussion was moved into a project. | project | |
spec.kept | Mac | An agreed plan was kept as a spec with its success criteria. | path, criteria | |
test.proof | Mac | A bug fix showed its new test failing on the old code. | command | |
repo.notes_kept | Mac | Architecture and lessons notes were written back into the repository. | path | |
package.flagged | Mac | An install named a package that is absent, under thirty days old, barely used, or listed as malicious: asked, or refused. | command, packages, verdict | |
instructions.asked | Mac | A seat asked to edit a file that instructs the room; asked in every mode. | path, speaker | |
instructions.changed | Mac | Such a file changed during a run, whoever wrote it. | path, speaker | |
source.removed | Mac | A source the room had been given was removed. | kind | |
artifact.deleted | Mac | An artifact the room made was deleted. | path | |
outcome.reverted | Mac | A commit the room wrote was reverted, or failed CI after merge. | sha, what | |
pr.monitor.switch | Mac | The pull request monitor was switched on or off for a discussion. | on, number | |
pr.monitor.pushed | Mac | The monitor pushed a fix to the pull request branch. | number, checks | |
pr.monitor.archive | Mac | The monitor archived a merged discussion. | number |
What these do not carry
A seat event names the seat and, where there is one, the host it spoke to — never the prompt, the answer, or what went through the door. egress.connections is hosts only, and says so: it is the record of what the sandbox saw, and a CLI seat that reaches the network from its own process is outside it.