Skip to main content

Observing an agent

An agent estate you cannot inspect is an estate you cannot run. The question is not whether there are logs. It is whether what you are shown is the same thing that actually happened, and whether you can check.

Four layers, and what each one is for​

LayerWhat it isWhat it answers
The journalThe durable, per-step system of recordWhat ran, with what input and output
The hash chainA signed chain folded over every journal transitionHas the record been altered
The lineage indexA derived projection keyed by sub-agentWhich worker did which step
The transcriptA rendered view assembled from the three aboveWhat happened, readably

The relationship between them is the important part, and it is stated as a rule:

The transcript is a projection of already-signed journal data. It is never a second source of truth.

Rendering never re-signs, re-hashes or mutates anything.

The journal​

Every dispatched step writes an intent entry before it executes, then a completion or a failure. The pre-write is what makes recovery possible: a runtime that died mid-step resumes from a known position rather than guessing.

Entries are idempotent by construction, through a deterministic step identity and a uniqueness constraint, so a retry cannot double-write history.

Each entry carries an output hash, the signing agent and a signature. The canonical form used for verification deliberately excludes timestamps, so a replay on a different machine with a different clock still verifies. A verification that only passes on the original host would not be a verification.

Retention has a guard: a purge refuses to remove a run that has not terminated.

The hash chain​

Every transition folds into a per-run signed chain. It is symmetric by construction: each entry records both the signing agent (who wrote it) and the cell (where it was observed), inside the signed bytes.

An entry that cannot be hashed raises rather than being skipped, so the writer logs a structured warning instead of the chain quietly losing a transition. A chain that silently drops what it cannot process is not a chain.

Truncation is detectable separately, through chain heads.

The lineage index​

The chain folds lineage into its hashes, which means the chain itself cannot be queried by sub-agent. So a second, derived index captures the lineage-tagged events.

It is explicit about what it is:

  • Derived, not authoritative. The journal and chain remain the record.
  • Bounded per run, oldest events dropped past a cap, and the dropped count is reported. A ten-thousand-worker swarm cannot flood the console, and you are told when you are looking at a truncated view rather than shown a partial one that looks complete.
  • Per cell and in-process, with a durable ledger beside it for the mint records that must outlive an ephemeral cell.

That last point is worth its own sentence. Ephemeral cells are created for a job and destroyed with it. A spawn record living only in the memory of the least durable thing in the deployment is a record that will not be there when someone asks.

The transcript, and how a sub-agent's work rolls up​

Which sub-agent produced a step is not on the step row. It rides the lineage event stream, and the two are joined on the step index: a step tagged by a lineage event belongs to that worker; an untagged step is run-level work.

The result is that the transcript tree is literally the same tree the swarm view renders. Parent roll-up is not a separate aggregation that could disagree with the topology view; it is the topology.

Each rendered turn carries the journal's own content hash, signing agent and signature, so a reader can confirm that what they are looking at hashes to the value that was signed. The console does exactly that: it re-hashes the rendered content in the browser and shows an integrity indicator. You are not asked to trust the rendering.

A pathological run is capped rather than allowed to become an unbounded table walk, and a cell with no swarm producer wired returns an honest empty tree rather than a failed read.

Who can read it​

Two deny-closed layers:

  1. Permission and tenancy at the mount. A read requires the right permission, scoped to the workspace being asked about.
  2. Run-in-workspace at the data layer. Every run-addressed read resolves the run's own workspace and refuses on a mismatch, including for a global operator naming another workspace. The second check is not redundant; it is what stops a broad permission becoming a cross-workspace read.

Clean-room reads pass through the room's own governance on top of both.

What the console shows​

SurfaceWhat it gives you
Fleet viewHow many runs are live now, streamed rather than polled, with per-run saturation
Run detailThe transcript with per-turn integrity indicators
Lineage treeThe sub-agent tree with state per node, attached on demand
SpendCost per sub-agent for a run, ordered so the most expensive reads first
Trends and compareBehaviour across runs, and two runs side by side

Defaults are counts and state; the full tree is fetched on demand. That is a deliberate choice for swarm-scale runs, where eagerly loading everything would make the console the thing that falls over.

Telemetry from outside​

Traces from other agent frameworks can be ingested onto the same plane, and they are labelled as what they are: unsigned, attested as ingested, rendered without the integrity claim a native run carries. Their token counts are attributed but tagged as ingested and never folded into the signed native chain.

An honest provenance boundary is worth more than a uniform-looking dashboard.

What an agent can see about itself​

An agent can read its own status: its operating mode, its alignment vector, its reputation, its own consumption, and its decision-confidence mix.

It takes no agent identifier, resolving instead from the ambient run, so there is no enumeration surface, and it fails closed outside a run.

The reasoning is symmetry: an agent that can see its own consumption is being shown the same record the operator sees. A system that measures its actors while hiding the measurement from them is not one they can correct against.