What did your agent actually do?
When an agent session goes wrong, the other side gets handed recollection, unless a record was already being written. We built that record as public research: controls declared before the run, a hash-chained transcript of what the declared sensors saw, and a human verdict that cites those bytes.
Cloud-hosted agent sessions, where the vendor runs the sandbox, are out of scope today.
- Who invoked the agent?
- What was it allowed to do?
- What did the declared sensors see it do?
- What left the boundary those sensors watched?
- Was the control you promised actually on?
Today the answers get rebuilt from a laptop image and a Slack thread. The format fills that hole only as far as the declared sensors reach, and it states that reach in numbers.
Before the agent starts, the manifest is frozen: environment, policy, permissions, scenario, and the controls that must hold. Those bytes are hashed into the opening record.
A hash-chained transcript of what the declared sensors saw: the tool calls they hooked, the egress the boundary watched, the approvals that went through the recorded path, and the gaps the sensors report. Completeness is measured coverage, not a promise. A bundle that cannot show each sensor armed and calibrated inside the record is INVALID, not clean.
Two roles on two keys. The operator attests process, custody, coverage. A second human attests the conclusion: CONTROLS_HELD, CONTROL_FIRED, SCOPE_BREACH, INCONCLUSIVE, or INVALID, each with its evidence identified by hash.
- Not prevention. Nothing in this format stops an action in real time.
- Not an LLM verdict. Every claim must resolve to deterministic evidence identified by hash. The judge is a hash function plus a named human.
- Not a certification. A clean verdict is a statement about this scenario, these controls, this environment. Nothing more.
- Not a claim about sessions we did not record.
- Not magic against ourselves: whoever holds the signing keys can rebuild a coherent bundle. The format is designed to shrink that window with run-start anchoring; that anchoring is in the design, not live on the bundles we can show today.
- Not protected against a lying recorder in this format version. An off-box sink under a separate operator is the design answer and is not in this version.
- Not redactable. A run ships whole or does not ship.
- Not for cloud-hosted agent sessions. If the vendor runs the sandbox and we cannot instrument the host, we cannot record it.
- Not your panel forensics firm, not a law firm, not an insurer. Nothing here is a service, and no engagement exists or is promised.
Independence terms, in public: no contingent fee; no client veto over a verdict; discarded runs are disclosed in the artifact.
- Observability platforms: the record lives in a first-party store whose retention and deletion are set by the party with an interest in the answer.
- Red-team reports: findings chosen after the attack lands, not controls registered before the run with a pass/fail rule fixed in advance.
- Platform audit logs: attested by the same vendor whose product is in question, and silent the moment your agent runs anywhere else.
Those products were not built to survive a hostile reader. That is the reader we design for.
Read it. Break it. Tell us.
The spec, the recorder, the verifier, and the sample set are public. If you find a hole in the format, that mail is read.
Email is not confidential and reaches a shared inbox. Do not send incident detail, client data, or anything privileged. Research correspondence only.