Agent behavior events: the record surface, field by field

This page describes exactly what the collector writes on your machine — no more, no less. It is the reference-shaped sibling of the narrative post (see "The audit trail for agent actions, line by line" in the blog), and it stays inside the same honesty rule: the current build is a Phase 0 monitor. It observes, evaluates, and records; a would_block verdict is written into the record, never enforced.

The five anchors of one event

Each observed action becomes one JSONL line with five anchors:

• Agent family — which agent runtime the action came from (Claude Code, Codex, OpenClaw, an MCP-connected tool)
• Process lineage — the chain of spawned processes, so a child’s action still names its parent
• Command shape — the normalized form of what was attempted, against which kind of resource (shape, not private payload)
• Timestamp — wall time at the moment of observation
• Policy verdict — the evaluation in force when the action happened: would_block or allow, never silently dropped

The guarantees wrapped around the file

• Strict validation before write — a malformed event is rejected and zero bytes land; the file is trustworthy because of the gate, not because the writer promised
• Redaction before logging — credentials, key-value secrets and key-file paths are stripped from every string the OS hands us
• Append-only on disk with owner-only permissions, size caps and daily rotation — history cannot be quietly rewritten by whoever can edit a file
• Zero outbound calls from the collector — what it sees never leaves the machine; the dependency closure is machine-checked in CI
• Deterministic replay — a replay engine reads an existing corpus against a candidate rule file and emits per-event verdicts, twice byte-identical, zero side effects

Reading the record

• agent-collector status — what the runtime sees right now
• agent-collector audit-tail — the recent lines as they are written
• agent-collector timeline — the log rendered as a timeline in the terminal
• All three are read-only control-surface commands; none of them phone home

What this page does not claim

No content-level surveillance, no cloud sync, no tamper-proof hash chain — none of those are shipped in the current build line. Enforcement and recovery are roadmap phases, stated as such on the <a href="/en/roadmap/">roadmap</a> and the <a href="/en/security/">security model</a>. Per-platform and per-agent observation depth lives on <a href="/en/docs/supported-os-matrix/">the OS capability matrix</a> and <a href="/en/supported-agents/">supported agents</a>.

To see the record on your own machine: the <a href="/en/docs/install/">install guide</a> walks through first run, quiet operation and clean removal; binaries with per-file SHA-256 are on the <a href="/en/download/">downloads page</a>; live build status is on <a href="/en/status/">the status page</a>.