Skip to main content

VCAL Audit

VCAL Audit is an optional commercial evidence service for retaining AI Cost Firewall execution events outside the gateway process.

AI Cost Firewall can send vcal.evidence.event schema version 1.1 records to Audit through a bounded, batched HTTP delivery path. Audit can then persist evidence, reconstruct request traces, apply licensed retention policies, export retained traces, and verify its authoritative tamper-evident record chain.

Integration point​

AI Cost Firewall
  -> bounded evidence queue
  -> batched HTTP delivery
  -> POST /v1/events/batch
  -> VCAL Audit

Typical AI Firewall configuration:

audit_enabled true;
audit_url http://vcal-audit:8092;
audit_api_key your-audit-key;
audit_producer_instance_id ai-firewall-01;

Basic service checks:

curl http://localhost:8092/healthz
curl http://localhost:8092/readyz
curl http://localhost:8092/version
curl http://localhost:8092/metrics

/healthz reports process liveness. /readyz also reflects Audit runtime and SQLite readiness and should be used by container orchestration for service readiness.

Delivery and backpressure​

The Audit delivery path is asynchronous and bounded.

AI Cost Firewall batches evidence events and retries transient delivery failures. VCAL Audit can apply bounded ingestion admission and return:

429 Too Many Requests
Retry-After: 1

when ingestion capacity is exhausted.

AI Cost Firewall treats Audit backpressure as retryable and honors Retry-After.

If delivery retries are exhausted, evidence that remains only in the current in-memory delivery queue cannot be replayed after the AI Firewall process restarts.

Integrity and retention​

VCAL Audit maintains an authoritative SHA-256 record chain independently of producer-supplied event hashes.

Licensed retention policies can physically prune expired authoritative records while preserving continuity through a persistent retention anchor. Chain verification starts from that retained anchor rather than incorrectly resetting to GENESIS.

Full-chain verification uses a dedicated SQLite verification connection and a consistent read snapshot so verification does not hold the primary store mutex and serialize ordinary Audit query traffic.

Licensing​

VCAL Audit licensing can independently control capabilities such as:

  • evidence ingestion
  • trace and event queries
  • NDJSON export
  • chain verification
  • maximum accepted events per day
  • retention period

AI Cost Firewall integration does not require every Audit capability to be enabled.

See Evidence events, Configuration, and Troubleshooting.

note

This page intentionally provides only the AI Cost Firewall integration overview. Full VCAL Audit API, storage, licensing, retention, verification, export, and operational documentation is maintained separately.