{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-13T23:52:59.204Z",
  "record_id": "VXI-EXT-PROCUREMENT-GITHUB-AUDIT-01-v1",
  "record_kind": "external_reference",
  "title": "GitHub audit evidence: Event coverage and export history",
  "system": "GitHub Enterprise Cloud",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a GitHub audit export establish a complete history of repository activity?",
  "near_questions": [
    "Does a GitHub audit export include every Git operation?",
    "Which GitHub audit events are visible through the web interface?",
    "Does GitHub audit API access depend on the plan?",
    "Are GitHub web and Git events retained equally?",
    "Can a missing GitHub audit event prove nothing happened?",
    "What query parameters should accompany a GitHub audit export?",
    "Does a streamed GitHub archive establish continuous capture?",
    "Which organization role can obtain GitHub audit evidence?",
    "What evidence supports a claimed repository activity timeline?",
    "Can browser-triggered Git activity be missing from a Git export?",
    "What should I save alongside a GitHub audit-history review?",
    "When does a GitHub export need a coverage qualification?"
  ],
  "supported_claims": [
    {
      "claim": "GitHub documents different audit access methods and coverage for web and Git events. Plan, export method and retention affect what can be obtained. A returned export therefore needs an event-type and time-range check; an absent row does not by itself establish that no activity occurred.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "GitHub documents different audit access methods and coverage for web and Git events. Plan, export method and retention affect what can be obtained. A returned export therefore needs an event-type and time-range check; an absent row does not by itself establish that no activity occurred.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-SLACK-EXPORT-01-v1",
    "VXI-EXT-PROCUREMENT-VERCEL-AUDIT-01-v1",
    "VXI-EXT-PROCUREMENT-STRIPE-WEBHOOK-01-v1",
    "VXI-EXT-PROCUREMENT-CLOUDFLARE-LOGPUSH-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "GitHub organization audit access and retention",
    "source_url": "https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-GITHUB-AUDIT-01-v1",
    "candidate_record_sha256": "6e5a255316951dcab1bd8cf62f308fc80033b13caf0ab68405fb31e5fa5e85ad",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "GitHub documents different audit access methods and coverage for web and Git events. Plan, export method and retention affect what can be obtained. A returned export therefore needs an event-type and time-range check; an absent row does not by itself establish that no activity occurred.",
    "required_buyer_context": "Organization plan, export method, event types, requested interval and any external streaming archive.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "An audit export contains every repository action needed for this review.",
    "documented_statement": {
      "status": "documented",
      "statement": "GitHub documents different audit access methods and coverage for web and Git events. Plan, export method and retention affect what can be obtained. A returned export therefore needs an event-type and time-range check; an absent row does not by itself establish that no activity occurred.",
      "source_ids": [
        "github-audit"
      ]
    },
    "buyer_evidence_required": [
      "A dated export showing its query and event categories",
      "Plan entitlement and exporter role",
      "Streaming-destination continuity and retention, if longer history is required"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require additional evidence when the needed event type or time range is outside the demonstrated export coverage."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "github-audit",
        "url": "https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization",
        "final_url": "https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization",
        "title": "GitHub organization audit access and retention",
        "checked_on": "2026-10-14",
        "sha256": "fd60047bcbad42fe0a972ab0cf6a2d176b33d1f839ab9a9125b66df66de9b8b4",
        "bytes": 442192
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve why an activity-history claim was limited to a specific export method and interval.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck plan, available event categories, export method and archive retention."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#github-audit-export-evidence-check",
  "machine_readable_record": "/varexis-index/records/github-audit-export-evidence-check.json"
}