Problem
When a consent toast appears, there is NO queryable record answering 'who asked, for what capability, on which target, and what was decided'. Today diagnosing 'why did I get this toast' / 'why didn't agent X ever ask' means grepping raw sidecar logs (flooded, unstructured). Live incident 2026-07-12: user could not tell whether a toast came from an in-pane agent or an external one.
Wanted
- Structured consent ledger: {ts, requester label + display name, identity kind (pane/agent/anonymous), capability (drive/create/cap:sticky:access:), target, decision (approved/denied/expired), decided_at}. Persisted; queryable via an MCP tool + /api endpoint; surfaced in the dashboard.
- Related fix: /api/audit/search 'q' filter does not filter (q=/api/notes returns unrelated pulse rows) — repair or document.
- Related wording: 'No identity' is accurate for anonymous arrivals, but once identity forwarding ships (v0.16.2, c5027d1) the gate should distinguish 'anonymous' from 'identified but not granted' in its errors.
- Related design decision pending: anonymous callers on sticky ops should get the SoftWall consent path instead of a hard refusal (matches terminal semantics + what tool descriptions promise). See the 'Quiet Tiger' friction report sticky.
Problem
When a consent toast appears, there is NO queryable record answering 'who asked, for what capability, on which target, and what was decided'. Today diagnosing 'why did I get this toast' / 'why didn't agent X ever ask' means grepping raw sidecar logs (flooded, unstructured). Live incident 2026-07-12: user could not tell whether a toast came from an in-pane agent or an external one.
Wanted