---
id: "concept-dual-logging-system-events"
type: "concept"
source_timestamps: ["00:15:38"]
tags: ["observability", "auditing"]
related: ["concept-structured-streaming-events", "claim-80-percent-plumbing"]
definition: "Maintaining an immutable log of deterministic system operations (routing, permissions, tool execution) entirely separate from the LLM's conversational transcript."
sources: ["s46-anthropic-25b-leak"]
sourceVaultSlug: "s46-anthropic-25b-leak"
originDay: 46
---
# Dual Logging and System Events

## Definition
Maintaining an **immutable log of deterministic system operations** — routing, permissions, tool execution — entirely separate from the LLM's conversational transcript.

## The Two Channels
While [[concept-structured-streaming-events|streaming events]] capture the model's thought process, **system event logging** captures the operational reality of the agentic harness.

[[entity-claude-code-d46|Claude Code]] maintains an immutable history log of system events that records:

- context loading
- registry initialization
- routing decisions
- execution counts
- permission approvals / denials

## Why Two Logs
If an agent fails, the **conversational transcript** might only show the LLM's confusion. The **system event log** will reveal the exact operational failure — e.g., a tool execution timed out, a permission was denied, a registry lookup missed.

## Why It Matters
This dual-logging approach is vital for:

- **auditing** (compliance, security review)
- **debugging** (separating model errors from harness errors)
- **proving deterministic behavior** of the non-AI plumbing surrounding the model

This primitive directly supports [[claim-80-percent-plumbing]] — most of the engineering value lives in the deterministic harness, not the LLM call.

## Validation (Enrichment)
Standard in observability. LangSmith separates LLM traces from system logs for auditing. OpenTelemetry for agents is becoming the canonical dual-logging substrate.