[kohtatsu]

I was (naturally) skeptical at first as well, but this looks great.

I saw on another page that audit logs are sent off server, presumably append-only, but can Teleport pause execution until after log replication is verified?

For plain logs this would be straightforward, but for enhanced logging I suppose it'd be a matter of deciding when to pause execution, e.g. after downloading a file.