drop spinnaker audit log · parse pipeline + stage events
flags manual judgment bypass · pipeline config edits · artifact account changes · timeline + actor rollup
heuristic screener · log format varies by spinnaker version and distro — not definitive proof