truss action

Manage action records — log agent actions, inspect records, detect anomalies, and track chain of custody.

Subcommands

`truss action list`

List action records.

Option	Description
`-l, --limit <n>`	Page size (default: 50)
`-p, --page <n>`	Page number (default: 1)
`-m, --mandate-id <id>`	Filter by mandate ID
`--from <iso-date>`	Filter records from this date onward (ISO 8601)
`--json`	Output as JSON

truss action list
truss action list -l 100
truss action list -m mnd_abc123
truss action list --from 2025-01-01T00:00:00Z
truss action list --json

`truss action get <action-id>`

Get action details — ID, type, agent, mandate, chain position, within_mandate flag, timestamp, HalluCase anomaly flags, and anomaly score.

Option	Description
`--json`	Output as JSON

truss action get act_abc123
truss action get act_abc123 --json

`truss action anomalies`

List anomalous actions detected by HalluCase.

Option	Description
`-l, --limit <n>`	Page size (default: 50)
`--json`	Output as JSON

truss action anomalies
truss action anomalies -l 20
truss action anomalies --json

`truss action record`

Record an action against a mandate. Provide options inline or pipe full JSON via --stdin.

Option	Description
`--mandate-id`	Mandate ID the action belongs to
`--action-type`	Type of action (e.g. `read`, `write`, `query`, `execute`)
`--input-hash`	SHA-256 hash of the action input
`--output-hash`	SHA-256 hash of the action output
`--timestamp`	ISO 8601 timestamp (default: now)
`--stdin`	Pipe full JSON payload via stdin

truss action record \
  --mandate-id mnd_abc123 \
  --action-type query \
  --input-hash abcdef... \
  --output-hash 123456...

echo '{
  "mandate_id": "mnd_abc123",
  "action_type": "write",
  "input_hash": "abcdef...",
  "output_hash": "123456..."
}' | truss action record --stdin