展示HN：欧盟人工智能法案的开源文章12日志基础设施
欧盟立法（在许多情况下影响英国和美国公司）要求能够真实重构代理事件。我在多个受监管的行业工作了多年，最近意识到了这个缺口。
我们已经具备了强大的可观察性，但如果有人让我证明几个月前某个特定AI决策的确切发生情况（并证明日志记录没有被篡改），我做不到。
欧盟人工智能法案已经生效，其第12条将在今年8月生效，要求对高风险系统进行自动事件记录，并保留六个月，许多法律评论员认为这更像是一个仅附加的账本要求，而不是标准的应用日志记录。
考虑到这一点，我们为使用Vercel AI SDK的Node应用构建了一个小型的免费开源TypeScript库，该库将推理捕获为仅附加的日志。它将模型包装在中间件中，自动将每次推理调用记录为结构化的JSONL格式到您自己的S3存储桶中，使用SHA-256哈希链条进行篡改检测，强制执行180天的保留期，并提供命令行界面以重构决策并验证完整性。还有一个覆盖命令，用于标记可能的缺口（在实践中，遗漏比编辑更具风险）。
该库故意设计得很简单：使用TypeScript，针对Vercel AI SDK中间件，支持S3或本地文件系统，采用线性哈希链条。它也与Mastra（代理框架）兼容，我乐意通过拉取请求扩展其集成。
博客文章及仓库链接： [https://systima.ai/blog/open-source-article-12-audit-logging](https://systima.ai/blog/open-source-article-12-audit-logging)
我非常重视反馈、想法和任何批评。
查看原文
EU legislation (which affects UK and US companies in many cases) requires being able to truly reconstruct agentic events.<p>I've worked in a number of regulated industries off & on for years, and recently hit this gap.<p>We already had strong observability, but if someone asked me to prove exactly what happened for a specific AI decision X months ago (and demonstrate that the log trail had not been altered), I could not.<p>The EU AI Act has already entered force, and its Article 12 kicks-in in August this year, requiring automatic event recording and six-month retention for high-risk systems, which many legal commentators have suggested reads more like an append-only ledger requirement than standard application logging.<p>With this in mind, we built a small free, open-source TypeScript library for Node apps using the Vercel AI SDK that captures inference as an append-only log.<p>It wraps the model in middleware, automatically logs every inference call to structured JSONL in your own S3 bucket, chains entries with SHA-256 hashes for tamper detection, enforces a 180-day retention floor, and provides a CLI to reconstruct a decision and verify integrity. There is also a coverage command that flags likely gaps (in practice omissions are a bigger risk than edits).<p>The library is deliberately simple: TS, targeting Vercel AI SDK middleware, S3 or local fs, linear hash chaining. It also works with Mastra (agentic framework), and I am happy to expand its integrations via PRs.<p>Blog post with link to repo: <a href="https://systima.ai/blog/open-source-article-12-audit-logging" rel="nofollow">https://systima.ai/blog/open-source-article-12-audit-logging</a><p>I'd value feedback, thoughts, and any critique.