**Note** from Bead: Web Session Log · [canonical source](https://redfish.acequia.io/guerin/.agents/2eea4ddc-dca3-4b6f-8f77-61b1a8bdaec9/2026-06-17/notes/00-web-session-log-spec.md) · session 2026-06-17 · discussion: Talk: Web Session Log
*2026-06-17. Stephen: "on the bookmarklet, let's monitor use (eg web session log)" + "token use is something to be monitored with graduated sanctions." This bead is **Ostrom principle 4 (monitoring)** made concrete; it feeds **principle 5 (graduated sanctions)** in the relay. See [ostrom-governance-principles](https://redfish.acequia.io/guerin/.agents/ae0d5662-d1e7-40ff-a17e-0bf6b4303dff/2026-06-17/notes/00-ostrom-principles.md).*
## What it logs A **web session** = a run of the web-edit bookmarklet / its calls to the relay. The log is an append-only ledger of events — **metadata only, never content or keys** (privacy + the resource is the *quota*, not the text): ```jsonc { "ts":"2026-06-17T…Z", "session":"web-abc123", "ip":"…", "token":"<id or null>", "origin":"https://…", "action":"cognition|save|edit", "model":"gemini-2.5-flash", "bytes":1234, "status":200, "sanction":"ok|warn|throttled|blocked" } ``` - No `section`/`instruction` text, no replacement text, no API key, no full page — those are content; the ledger records *that* a call happened, its size, and its outcome. - `session` ties to the editor's session id; `token`/`ip` is the appropriator identity (boundary, P1).
## Storage — via the webdav-bead (the link Stephen asked for) The ledger lives in the **commons over WebDAV**, so monitoring is namespace-visible and governable — not a private server file. The **[webdav-bead `fe7fbaf5`](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/about.md)** is its persistence handler: an event is an **append** (a dock deposit or a `PUT` to a per-day path), and the webdav-bead's two-lane handler (sync verb / async dock) is exactly the write surface. Path shape: `…/web-session-log/<YYYY-MM-DD>.jsonl` (append-only, immutable provenance — same discipline as `chats/`). - Append over WebDAV: `PUT` a new event file per request (`…/<YYYY-MM-DD>/<ts>-<rand>.json`) the handler coalesces, or a true append the handler implements; either keeps it crash-safe and replicable.
## Graduated sanctions hook (P5, in the relay) The relay derives **per-ip/per-token counters** from the log (or a fast sidecar counter) and escalates: `ok → warn (logged + X-RF-Warning header) → throttle (429) → temporary block → token revocation` (cascade-revoke the chain). The log is the evidence; the sanction is proportional and reversible (apoptosis-not-necrosis). The relay's **v0** keeps a local daily counter (`.ht-usage.json`) + local event log (`.ht-usage.log`); **v1** writes events to this WebDAV ledger via the webdav-bead so monitoring is shared and the mayordomo (orchestrator) can see across endpoints.
## Privacy & governance - **Metadata, not content.** Retention window (e.g. rolling 30 days) then apoptose. Access-gated (authenticated, not `read:anonymous`) — usage data is not public. - **Accountable monitoring** (P4): the log is visible to the parciantes whose use it records, not a hidden surveillance file. A sanctioned holder can see why (the events) and appeal via the dock (P6).
## Status / phases 1. **v0 (now, in the relay):** local event log + daily counter + graduated 429 (soft warn / hard throttle). 2. **v1:** events `PUT` to the WebDAV ledger via the webdav-bead; orchestrator reads cross-endpoint. 3. **v2:** token-scoped quotas (P2 congruence — quota ∝ contribution); appeal/clear flow (P6); a small dashboard over the ledger (ties to `git-interactive-visualization`'s graph view).
**Links:** [webdav-bead `fe7fbaf5`](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/about.md) (persistence handler) · [ostrom `ae0d5662`](https://redfish.acequia.io/guerin/.agents/ae0d5662-d1e7-40ff-a17e-0bf6b4303dff/about.md) (P4/P5) · [cors-proxy `ff5ae03e`](https://redfish.acequia.io/guerin/.agents/ff5ae03e-0087-4d71-b60a-bf1c7b5449c3/about.md) (the relay it monitors) · [web-edit editor `e0cca7db`](https://redfish.acequia.io/guerin/.agents/e0cca7db-ed8c-43a5-a027-b406d985e402/about.md).
## References (bead cross-links) - Bead: Ostrom Governance Principles · [canonical](https://redfish.acequia.io/guerin/.agents/ae0d5662-d1e7-40ff-a17e-0bf6b4303dff/) - Bead: As Webdav Handler · [canonical](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/) - Bead: CORS Proxy · [canonical](https://redfish.acequia.io/guerin/.agents/ff5ae03e-0087-4d71-b60a-bf1c7b5449c3/) - Bead: E0cca7db · [canonical](https://redfish.acequia.io/guerin/.agents/e0cca7db-ed8c-43a5-a027-b406d985e402/)