> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/arcus/arcus-execution-audit.md).

# Execution audit

Use this runbook when the terminal's Arcus `Signer audit` panel is locked, unavailable, empty unexpectedly, account-mismatched, or missing a review/submission/reconciliation event. Keep the Arcus entry kill switch active while evidence is incomplete.

## Normal evidence path

1. Start the isolated Arcus testnet signer and verify `pnpm signer:health` reports the exact account/index, schema 8, integrity `ok`, and journal `wal`.
2. Unlock the local NIGHTSHIFT operator session.
3. Inspect the same registered Arcus account in the terminal.
4. Open the bottom `Signer audit` tab. NIGHTSHIFT displays at most 100 newest Arcus-only events with event type, status, opaque client ID, and local signer time.
5. Treat public funding/transfers and the private signer audit as independent rails. A deposit or fill row cannot prove that an execution review was persisted.

An approved execution review must produce `ARCUS ORDER REVIEW / APPROVED` before its ten-second confirmation can be used. Submission, cancellation, automatic cancellation, emergency stop, and reconciliation add their own signer events. HTTP acknowledgement is not a final fill or cancellation state.

## Locked or mismatched

* `Signer audit locked`: configure and unlock `NIGHTSHIFT_OPERATOR_SECRET`; do not expose the secret in a URL, prompt, repository, or browser storage.
* `Exact signer account required`: inspect the account shown by authenticated signer status. Do not relax the eligibility account or route scope to read another account's evidence.
* `Signer audit unavailable`: run `pnpm signer:status` and `pnpm signer:health`. Preserve the database and follow [`arcus-execution-store-recovery.md`](/nytshift-docs/arcus/arcus-execution-store-recovery.md) for storage failures.

Do not start a new signer against a copied database, edit audit rows, or change the configured account merely to make the panel populate.

## Missing or ambiguous event

1. Keep the kill switch active and do not retry the order/cancel.
2. Preserve the client ID shown by the confirmation or lifecycle panel.
3. Reconcile the client ID through the authenticated NIGHTSHIFT control, then confirm the public Arcus order/fill lifecycle reaches an exact state.
4. Verify alert-delivery and execution-store health. A signer audit event is durable local evidence, not venue-final state.
5. Create a stopped-runtime signer backup only after the incident state is preserved and the signer is stopped cleanly.

If an execution review response says audit recording is unavailable, no approval token was delivered. Correct signer storage/connectivity and request a completely new live review; never reuse an older token or inferred intent.

## Disclosure boundary

The browser receives no signer detail JSON, account address, account index, quantity, price, policy metrics, API key, internal token, signature, webhook configuration, or database path from this route. Investigate richer local evidence only on the protected signer host and handle the execution database as sensitive state.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://nytshift.gitbook.io/nytshift-docs/arcus/arcus-execution-audit.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.