Agent Route Observability Runtime

One recorded trail is checked end to end

It replays one agent's recorded trail — route, work, events, evidence, and declared authority limit — and checks the whole thing is well-formed and self-consistent. This component takes a recorded trail of one agent's local run, the route it picked, the work it logged, the events it emitted, the evidence it pointed to, and the authority limit it declared, and checks that the trail is well-formed and self-consistent. It is a replay validator over synthetic fixtures, not a live tap on a running agent.

Six checks share the declared scope limit

Because the record states its authority limit up front, the runtime runs six checks and writes six metadata-only result records that each carry status, findings, and the scope limit. The record is built to state up front where the agent's authority was supposed to stop, so the limit is written down and checkable rather than taken on faith. The runtime reads that record, runs six checks over it, and writes six small JSON result records. Each result record carries a status, the negative cases it saw, the findings, and the scope limit. Large or private payloads are dropped before anything is written.

Recorded evidence cannot prove live compliance

It reads recorded evidence only, inspecting no live session and proving nothing about whether an agent actually stayed in bounds. It reads recorded evidence. It does not inspect live sessions, mutate a route, install a hook, authorize a provider, or prove that any agent actually stayed in bounds.

Purpose

A raw log reads as proof

A raw agent log is hard to trust because a behavior-change claim or a quiet authority grab reads as proof while nothing checkable is recorded. A raw agent log is hard to trust. Someone reading it by hand cannot easily tell whether a row that claims "I changed how the agent behaves" is backed by anything, or whether an advisory step quietly asserted authority it never had. Loose logging fails here in a specific way: a trace that reads as proof, with nothing recorded that a reader can check.

No claim counts unless the record backs it

It refuses to treat a claim as evidence unless the record supports it: advisory rows cannot claim mutation authority, behavior-change needs named trace ids, and private bodies are redacted. This component closes that gap by refusing to treat a claim as evidence unless the record supports it. An advisory row cannot also claim live mutation authority. A behavior-change claim is blocked unless it names the trace ids that evidence it. A private transcript body is rejected and redacted. The useful output is a compact result record: one command, one selected route, one work-event-evidence chain, one validator handle, and one scope limit.

How it works

run scans, then calls six validators

run loads the fixture, scans the inputs for forbidden non-public-state classes before any check, then calls six validators in order and merges what they observed. The default entrypoint is run. It loads the first-wave fixture, resolves the public root for the input path, and scans the inputs for forbidden non-public-state classes before any check runs. It then calls six validators in order and merges what they observed.

A green run means every rejection fired

The fixture is deliberately adversarial, so a green run means every expected negative case fired and nothing unexpected did, not that the trace was clean. The fixture holds 10 trace rows, 6 hook-shadow cases, 6 egress cases, and 2 anti-pattern debt rows. It is deliberately adversarial: it is built to trigger every planned rejection. A green run therefore means every expected negative case fired and nothing unexpected did, not that the trace was clean.

validate_route_compliance classifies each row

validate_route_compliance checks each trace row for duplicate ids, a missing lease, a route miss, a private payload, an advisory authority claim, or unevidenced behavior change, passing only on expected cases. validate_route_compliance classifies the trace rows. It counts duplicate event ids, and for each row it checks for a missing route lease, a route miss where the observed route differs from the expected route, a private transcript payload class, an advisory row that claims mutation authority, and a behavior-change claim with no evidence ids. Each check that fires records a typed finding and marks the row rejected. The check passes when every negative case it saw is one of the expected cases.

validate_route_lease_mode_control reads leases

validate_route_lease_mode_control flags kernel bloat before direct action and leases that offer static route metadata in place of consumed trace feedback. validate_route_lease_mode_control reads the same trace rows as route leases. It flags KERNEL_BLOAT_BEFORE_DIRECT_ACTION when a lease returns to broad kernel context before acting, and ROUTE_LEASE_NOT_CONSUMED when static route metadata is offered in place of consumed trace feedback.

validate_hook_shadow keeps hooks projection-only

validate_hook_shadow replays each hook case, requiring projection_not_authority, metadata-only fields, and every live-state field false, so any read of live operator, provider, or operator UI state is rejected. validate_hook_shadow replays the hook intervention cases. Each case must map a case id, hook id, coverage claim, repair class, and expected intervention, must declare projection_not_authority, must stay metadata-only, and must keep every live-state field false. A case that reads live operator, provider, browser, HUD, cockpit, or ledger state is rejected.

validate_debt_retirement needs behavior-change evidence

validate_debt_retirement retires a debt row only when it names behavior-change evidence trace ids, so evidence-only telemetry cannot retire debt on its own. validate_debt_retirement marks a debt row retired only when it names behavior-change evidence trace ids and carries no evidence-only trace ids. Evidence-only telemetry cannot retire debt on its own.

validate_agent_principle_lens mints nothing

validate_agent_principle_lens confirms the lens preserves its selected principle ids and route handles while minting no principle, promoting no axiom, and exporting no full body. validate_agent_principle_lens confirms the lens preserves its selected principle ids and its route handles back to the principle cards and the agent operating packet. The lens cannot mint principles, promote a candidate axiom, or export full principle bodies. Any of those sets a finding.

validate_egress_mirror recomputes each decision

validate_egress_mirror recomputes each detector decision against the declared one, requiring every private-read, provider-read, cockpit-read, and body-export flag to stay false. validate_egress_mirror recomputes each detector decision and compares it to the declared one. Every case must keep private_state_read, provider_payload_read, browser_hud_cockpit_state_read, and body_exported false.

A pass writes six metadata-only result records

run passes only when no expected case is missing, the scan is clean, and all six validators pass, after which write_receipts emits six metadata-only JSON records and result_card a compact card. run passes only when no expected negative case is missing, the non-public-state scan passes, and route compliance, hook shadow, route trace analytics, the principle lens, and the egress mirror all pass. It then calls write_receipts, which writes the six JSON result records under the public root and returns their public-relative paths. result_card compresses a full result into a start card and drops the full findings, private scans, source bodies, and scope-limit bodies.

Bundle runners over exported evidence slices

run_observability_bundle validates a larger exported bundle and blocks on any forbidden payload key or manifest drift, while companion runners check the same membrane over adjacent evidence slices. Alongside the fixture path, run_observability_bundle validates a larger exported bundle: route events, agent path observations, session diagnostics, hook-shadow rows, actor-axis checks, debt rows, process-audit rows, an observability policy, and a source-module manifest, blocking on any forbidden payload key or manifest drift. Companion runners such as run_agent_observability_store_bundle check the same membrane over adjacent public route, session, bridge, controller, and store evidence slices.

flowchart TD Fixture["Fixture inputs agent_trace, hook_shadow, debt, principle_lens, egress"] Scan["non-public-state scan forbidden classes rejected"] Checks["Six validators route, lease, hook, debt, lens, egress"] Merge["Merge observed negative cases"] Status["Status pass only if every expected case fired"] Result records["Six result records write_receipts"] Card["Compact card result_card"] Fixture --> Scan --> Checks --> Merge --> Status --> Result records --> Card

Negative cases

The full rejection set a green run needs

A green run needs the whole rejection set to fire — eight route and lease cases plus five hook-shadow cases — and a missing or unexpected case blocks the run instead. The fixture must trigger the full rejection set for a green run. The route and lease cases are: an actor-axis mismatch on an advisory row that claims mutation authority; a missing route lease; a private transcript body; a duplicate trace id; a route-compliance overclaim of behavior change with no evidence; kernel bloat before direct action; static route metadata without trace feedback; and a route miss replaced by a public route. The hook-shadow cases are: missing authority; a banned-route intervention; command displacement; a live-state read attempt; and a hook-shadow budget overrun. If any expected case fails to fire, or an unexpected case appears, the run is marked blocked rather than green.

Prior Art Grounding

Distributed tracing meets agent trajectories

Its shape borrows from distributed tracing — W3C Trace Context and OpenTelemetry — and from ReAct trajectories, exposing route, lease, trace id, evidence chain, validator, and scope limit together. This component borrows its shape from distributed tracing and agent trajectory work. The W3C Trace Context recommendation and OpenTelemetry set the observability pattern: propagate trace identity, collect events, and keep enough context to debug a distributed transaction. Agent work such as ReAct made the interleaved reasoning-and-action trajectory a first-class object for reading agent behavior. The traceability shape carries over: selected route, route lease, trace id, work-event-evidence chain, validator ref, and scope limit are exposed together.

Source-Backed Doctrine Packet

Authority rows connect claims to runtime evidence

The registry, evidence-class row, and governing standard let readers trace the public claim to its exact semantic-validator boundary. A reader can move from the public claim to the runtime, standard, manifests, result records, and negative cases without guessing. The authority rows are core/organ_registry.json::implemented_organs[organ_id=agent_route_observability_runtime] and core/organ_evidence_classes.json::organ_evidence_classes[agent_route_observability_runtime]. The registry declares evidence class semantic_validator. The governing standard is standards/std_microcosm_agent_route_observability_runtime.json, whose authority boundary is public_route_observability_runtime_metadata_and_copied_macro_trace_bodies_not_live_session_provider_browser_hud_or_hook_authority.

Source manifests expose copied bodies without live sessions

The runtime and three source manifests keep copied bodies inspectable with body_in_receipt=false while granting no access to live sessions. The runtime source is src/microcosm_core/organs/agent_route_observability_runtime.py. Copied public source-module bodies stay inspectable through their manifests with body_in_receipt=false, including examples/agent_route_observability_runtime/exported_observability_bundle/source_module_manifest.json and the two shared projection-import manifests examples/macro_projection_import_protocol/exported_projection_import_bundle/agent_execution_trace_source_module_manifest.json and examples/macro_projection_import_protocol/exported_projection_import_bundle/agent_observability_source_module_manifest.json. The cross-module test tests/test_macro_projection_import_protocol.py::test_agent_execution_trace_body_import_is_unified_under_macro_projection_spine keeps that body import under one shared spine. This packet does not inspect live sessions.

The registry validator command is:

python -m microcosm_core.organs.agent_route_observability_runtime run --input fixtures/first_wave/agent_route_observability_runtime/input --out receipts/first_wave/agent_route_observability_runtime

The six result records this run writes are:

• receipts/first_wave/agent_route_observability_runtime/route_compliance_audit.json
• receipts/first_wave/agent_route_observability_runtime/hook_shadow_coverage.json
• receipts/first_wave/agent_route_observability_runtime/debt_retirement_receipt.json
• receipts/first_wave/agent_route_observability_runtime/route_lease_mode_control_receipt.json
• receipts/first_wave/agent_route_observability_runtime/agent_principle_lens_receipt.json
• receipts/first_wave/agent_route_observability_runtime/egress_mirror_receipt.json

Observable First Artifact Contract

One viewport in a fixed order

The first artifact fits one viewport in a fixed order — command, route, work, evidence chain, authority boundary — and any browser or video view is a projection that keeps those visible. The first artifact a reader sees fits one viewport and keeps this order: the local action command, the selected route with a short reason, the work transaction with its state, the event and evidence chain with its class, and the authority boundary beside the positive claim. A browser view, screenshot, or video is a projection of that board, not a separate claim, and it must keep the command, evidence ref, and scope limit visible before any decoration.

Validation Result record Path

From microcosm-substrate/, reproduce this page's proof boundary with temporary result records:

PYTHONPATH=src ../repo-python \
  -m microcosm_core.organs.agent_route_observability_runtime \
  run \
  --input fixtures/first_wave/agent_route_observability_runtime/input \
  --out /tmp/microcosm-agent-route-observability-runtime
PYTHONPATH=src ../repo-python \
  -m microcosm_core.organs.agent_route_observability_runtime \
  validate-observability-bundle \
  --input examples/agent_route_observability_runtime/exported_observability_bundle \
  --out /tmp/microcosm-agent-route-observability-bundle
../repo-pytest \
  tests/test_agent_route_observability_runtime.py \
  tests/test_macro_projection_import_protocol.py::test_agent_execution_trace_body_import_is_unified_under_macro_projection_spine

What a pass certifies, and does not

A pass means the fixture and bundle produced coherent, metadata-only route feedback within the scope limit and the focused regression still holds, but the result records certify no live behavior. A pass means the fixture and exported bundle produced coherent route feedback and metadata-only result records within the scope limit, and the focused regression still holds. The focused test is the proof consumer for this section, covering streaming JSONL loaders, duplicate-key rejection, source-module manifest contracts, digest and line-count helpers, redacted result records, and the required negative cases. These validation result records do not certify live behavior.

validates only public recorded route-feedback and observability metadata fixtures, including route-lease consumption, trace attribution, hook-shadow advisory status, anti-pattern debt retirement, behavior-change evidence gates, and public source body import refs; does not read live operator/provider/browser UI/account state, mutate work log or source, install hooks, certify runtime behavior, authorize pattern assimilation, whole-system equivalence, launch, public sharing, or whole-system correctness