---
name: grix-audit-data
description: Use the typed `grix_audit_data` tool to read conversation audit replay data. Trigger when the user asks to inspect an audit by audit ID, fetch audit manifest/structure, list audit spans/timeline, or read audit text/content chunks.
trigger: 当用户要求按 audit_id 查看对话审计、读取审计总体结构、调用时间线或正文分块时
---

# Grix Audit Data

Use `grix_audit_data` only for read-only conversation audit replay. The owner must grant this Agent the `conversation.audit.read` scope; without it, the tool returns a scope error.

## Workflow

1. Start from an `auditId` supplied by the user or by audited-turn metadata.
2. Call `grix_audit_data` with `action: "get_manifest"` and `auditId`.
3. Read the returned `result`:
   - `content_refs` tells you which text bodies can be fetched. Each item includes byte/char counts, capture level, and an estimated token count.
   - `has_spans` tells you whether a span/timeline page is available.
   - `revision` should be reused in later calls when present.
   - `quality.raw_requests_status` distinguishes `not_requested`, `unavailable`, `partial`, and `complete` raw provider body capture. Prefer it over treating the legacy boolean `raw_requests_complete` as proof that raw model requests were stored.
   - `statistics.input_token_attribution` compares provider-reported input tokens with captured input content refs. A large `unattributed_provider_input_tokens` value usually means runtime context such as system/developer instructions, tool schemas, or adapter-added context was included in the model request but was not captured as replay content.
4. Only fetch what is needed:
   - For timeline/structure details, call `action: "list_spans"` with the same `auditId`, optional `revision`, and pagination `cursor`.
   - For a specific text body, call `action: "get_content_chunk"` with `auditId`, `contentId`, optional `revision`, and pagination `cursor` until `eof` is true.

## Actions

### `get_manifest`

Required:
- `auditId`

Optional:
- `revision`

Returns the audit overview/manifest: metadata, stats, `content_refs`, raw request capture availability, input token attribution, `has_spans`, and related structure. It does not return full text bodies or span pages.

Example:

```json
{
  "action": "get_manifest",
  "auditId": "audit-123"
}
```

### `list_spans`

Required:
- `auditId`

Optional:
- `revision`
- `cursor`
- `limit` (max 200)

Returns one page of span/timeline metadata: `items`, `next_cursor`, and `has_more`.

Example:

```json
{
  "action": "list_spans",
  "auditId": "audit-123",
  "revision": 2,
  "limit": 50
}
```

### `get_content_chunk`

Required:
- `auditId`
- `contentId` from `get_manifest.result.content_refs`

Optional:
- `revision`
- `cursor`
- `maxBytes` (max 131072; use smaller chunks such as 32768 for interactive inspection)

Returns one UTF-8 text chunk: `value`, byte offsets, `next_cursor`, and `eof`. Continue with `next_cursor` only when the user actually needs more text.

Example:

```json
{
  "action": "get_content_chunk",
  "auditId": "audit-123",
  "contentId": "content-456",
  "revision": 2,
  "maxBytes": 32768
}
```

## Rules

- Do not guess or fabricate `auditId`, `contentId`, or cursors.
- Do not prefetch all content. Fetch manifest first, then the smallest span page or text chunk that answers the user.
- Treat cursors as opaque; pass back exactly the `next_cursor` returned by Grix.
- This tool reads only the current Agent's own audit data as authorized by Grix.