navori AI harness
navori

audit

How the harness actually ran: where the tokens went, and which instructions nobody could follow.

Usage 

navori audit [--session <id>] [--days <n>] [--since <date>] [--until <date>] [--json]

Flags

--session <id> One session by id, prefix, or 'latest'.
--days <n> Only sessions marked in the last N days.
--since <YYYY-MM-DD> From this date.
--until <YYYY-MM-DD> Up to this date.
--json Print the JSON report to stdout without writing files.
--out <dir> Override the output directory.
--start <id> Mark a session as audited (used by the hook flow).
--arm Arm audit-mode: an open session in the repo activates on its next message (works in-session via `! navori audit --arm`); otherwise the next session opened does. The hook issues --start itself (exactly one session; --disarm cancels).
--stop <id> Seal the session's log and report on it.
--collect Run the OTel events receiver on 127.0.0.1:4318 until you stop it: the third source, the one that knows what the host decided (who approved each permission, which skill was active). Prints the address, the output directory and the variables to export in the audited session's terminal.
--cwd <dir> Repo to audit (default: current).

Examples

Turn audit-mode on

$ navori audit --start 8f3c1d2e
└  audit-mode active ~/.navori/audits/demo/session-8f3c1d2e.log

No marked sessions

$ navori audit
└  No sessions marked with audit-mode for 'demo'. Activate it with 'navori audit --start <session-id>'.

One session's report

$ navori audit --session latest
◇  demo · 2026-09-01 → 2026-09-01 ─╮
│  1 sessions · 19 agents          │
│  billable  2.3M tok              │
│  startup  346k tok               │
│  findings  1 high · 3 warn       │
└  Report ~/.navori/audits/demo/sessions/2026-09-01-8f3c1d2e/report.md

Notes

  • Opt-in and per session: with no prior '--start' there is no log to audit, and navori observes nothing.
  • Two sources feed it and neither replaces the other: the event log the hooks write (what the harness did) and Claude Code's transcript (the only place token usage exists).
  • The report is written as markdown and JSON under ~/.navori/audits/<repo>/, beside a copy of the session's log.
  • Hook counts are partial when the recorder started late: the orchestrator's card says so, with the share of the session it did observe.