---
title: "Record the result of a client-side Layer 5 codex review (sync.py merge gate) as a vault_events row. Body of the review is NOT stored — only an HMAC digest of the summary so operators can correlate without exposing review content. Opt-in: server skips writes (still returns success) unless ENV['AINOTE_LAYER5_AUDIT']='on' AND a versioned HMAC secret is configured. Used by the sync.py SessionStart hook + merge command to surface 'why was this blocked?' across multi-PC sessions."
method: POST
path: "/api/mcp/tools/sync_audit_layer5"
tags: ["sync"]
---

# Record the result of a client-side Layer 5 codex review (sync.py merge gate) as a vault_events row. Body of the review is NOT stored — only an HMAC digest of the summary so operators can correlate without exposing review content. Opt-in: server skips writes (still returns success) unless ENV\['AINOTE_LAYER5_AUDIT'\]='on' AND a versioned HMAC secret is configured. Used by the sync.py SessionStart hook + merge command to surface 'why was this blocked?' across multi-PC sessions.

`POST /api/mcp/tools/sync_audit_layer5`

## Request

- Base URL: `https://api.ainote.dev`
- URL: `https://api.ainote.dev/api/mcp/tools/sync_audit_layer5`
- Auth: API key in header `Authorization`

Record the result of a client-side Layer 5 codex review (sync.py merge gate) as a vault_events row. Body of the review is NOT stored — only an HMAC digest of the summary so operators can correlate without exposing review content. Opt-in: server skips writes (still returns success) unless ENV['AINOTE_LAYER5_AUDIT']='on' AND a versioned HMAC secret is configured. Used by the sync.py SessionStart hook + merge command to surface 'why was this blocked?' across multi-PC sessions.

## Request body

- object
  - `path` string, required: Vault path the review covered.
  - `verdict` string, required: One of: pass, flag, block, error.
  - `summary` string: Free-form codex output summary. Server HMACs this; raw text is NEVER stored.
  - `chunk_count` integer: Optional: number of diff chunks the client fed to codex.
  - `duration_ms` integer: Optional: wall-clock time of the codex review on the client.

## Response `200`

Tool executed successfully

- ToolSuccessResponse: Successful tool invocation. `content` mirrors the MCP `tools/call` result shape: an array of content blocks (text and optionally a structured resource payload).
  - `content` object[]
    - `type` 'text' | 'resource'
    - `text` string

## Other responses

- `400`: Invalid arguments or business-rule violation
- `401`: Missing or invalid McpKey

---

[API](https://skmtc.dev/ainote/apis/ainote-mcp-openapi-mirror.md) · [All operations](https://skmtc.dev/ainote/apis/ainote-mcp-openapi-mirror/llms.txt) · [OpenAPI document](https://skmtc.dev/ainote/apis/ainote-mcp-openapi-mirror/revisions/f6c91d85e027?raw)