opschain admin agent activity

packs:agentspacks:agent-governance

opschain admin agent activity <agent> [--server <url>] [--auth-token <token>]

Shows one agent's audit timeline (v2 AgentService.GetAgentActivity): every platform-emitted event for the agent, newest first, up to the server's default limit of 200. The timeline is composed from the durable audit events the platform already records — requests with their applied tiers (info:agent:request), refusals (warn:agent:request_refused), lifecycle verbs (drain changes, halts and resumes, forget, revoke), and tunnel denials — so it is the raw evidence behind opschain admin agent trust-review.

Each event carries id, type, payload (the event's own JSON fields, e.g. the applied tier or the halt reason and actor) and created_at.

<agent> is the agent's member id (the ID column of opschain admin agents list), <project>/<code>, or a bare agent code when exactly one project holds it. A bare code that several projects hold is refused with the project/code candidates to pick from, and a reference matching no agent is refused by name.

The timeline outlives the agent. A revoked or forgotten agent no longer appears in the fleet, but its audit history is never erased: name such an agent by its member id and the timeline is resolved through the durable audit rows that id keys, served read-only with "departed": true in the document. The live fleet verbs (show, drain, halt, trust-review) stay fleet-only and answer not-found for a departed id, and the project/code and bare-code reference forms resolve through the live fleet, so they do not reach departed agents.

Flags

Flag	Meaning
--server <url>	Server base URL. Default: the active context, then OPSCHAIN_SERVER.
--auth-token <token>	Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login for that server.

Output

Always a machine document (JSON unless -o yaml):

For a departed agent the document additionally carries "departed": true.

{
  "agent_id": "01999a7e-…",
  "events": [
    {
      "id": "…",
      "type": "info:agent:request",
      "payload": { "applied_tier": "supervised", … },
      "created_at": "2026-10-14T03:12:09Z"
    },
    …
  ]
}

Exit codes

Code	Meaning
0	The timeline was printed.
1	The server refused or failed the request (including a rejected admin token, or an unknown id).
2	Usage — wrong arguments, or no server / admin token resolvable.

Named errors

• a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>' — exit 2.
• this command needs a login or an admin token — run 'opschain login', pass --auth-token, set OPSCHAIN_ADMIN_TOKEN, or store one with 'opschain admin login' — exit 2.
• the server rejected the credential — run 'opschain login' again, or check the admin token — exit 1.
• agent <id> is not known to this estate — admin agent verbs take the ocr_ member id from 'opschain admin agents list' (a UUID is usually the identity-side service_account_id, not the member id) — an id with neither a fleet manifest nor any audit rows (or a runner id) 404s; a departed agent's member id answers its timeline instead. Exit 1.
• agent code "<code>" is ambiguous across projects — name it as project/code: <candidates> — a bare code several projects hold; exit 1.
• no agent matches "<ref>" — use the ocr_ member id, project/code, or an agent code from 'opschain admin agents list' — exit 1.

See also

• opschain docs cli/admin-agent-trust-review — the decision-support roll-up over this timeline.
• opschain docs cli/admin-agent-show — the agent's current state.