Egress log

List egress decisions

The session's egress decision log, oldest first - what its egress proxy let out and refused, by host, port, method and rule, with the change that would let a refusal out.

One entry per (host, port, method, decision, rule) of a window the worker reports about once a minute, for the owner and members. since and until keep the windows that overlap them. Every denied entry carries next, worked out at read time from its rule, the session's requester, the organisation's policy now and the session's template: vendor, no model or tool access from this session today (the model proxy and the MCP gateway are the paths); no_session_row, in a session an agent principal started an org admin's egress.agent (the agent cannot widen it), in a person's the organisation's egress.session when it does not cover the host, else the template's egress and dev up --recreate; no_agent_row, an agent's exec through the agent's own exit in a person's session, an org admin's egress.agent (the agent cannot widen it); egress.yaml, the installation's operator, who lists the row for product dev-session; address and secret, no row changes them. A renewal gives a session back at most the rows it was compiled with at dev up, so for no_session_row and no_agent_row next says the session's next renewal applies the policy change when those rows name the destination (a ceiling dropped it after dev up), and otherwise that it needs the template's egress and dev up --recreate (a ceiling dropped it at dev up, or the template never listed it). next is a policy change, never a retry. A worker released before reports no windows and the log is empty.