Integrity and redaction
How a recording can be checked, what is removed from it, and what is deliberately left in.
Integrity
| mechanism | what it gives you |
|---|---|
| raw transcript digest | the SHA-256 and size of the agent's raw output, written on the run record and in the journal's final entry. The journal can be checked against the raw file |
| hash chain | each model transcript event carries the digest of the event before it, so a removed or reordered event breaks the chain |
| original-body digest | each event carries the SHA-256 of the original request or response, before redaction |
| sealed, signed segments | the model transcript is written in segments, sealed at 8 MiB, 10,000 events or 15 minutes. Each sealed segment is signed with the device key of the machine it was written on |
| custody on return | for a remote run, each segment is copied home with its digest checked, stored, and recorded with the key that signed it |
⚠ What a signature proves, precisely: which machine's key signed the segment. It does not prove
that the bytes match the traffic — the segment is written in a directory the agent can also write to.
On lanes where the engine does not jail the agent (codex and qwen-code on macOS), the agent can
also read the device key. A machine without a device key, or without a device certificate that
matches it, seals its segments unsigned and says so; a failure to sign never stops a run.
⚠ If the transcript itself cannot be opened for writing, the recorder does not start the agent.
⚠ Segments are taken into custody only for remote runs, when they are returned. A local run's model transcript stays in its working directory until that directory is torn down; teardown archives it, with the audit file, into the working directory's signed evidence archive.
Redaction
The live journal and the stored body of each model transcript event are redacted before they are
written. Redaction is deterministic — no model is involved — and replaces a match with [REDACTED]:
- AWS access key ids, PEM private keys, JSON Web Tokens and bearer tokens;
- credentials embedded in connection strings and URLs;
password=andtoken:-style pairs;- the values of the process's own environment variables whose names look secret;
- long, high-entropy tokens.
Deliberately left in:
- file paths, usually — absolute paths under
/Users/,/home/,/tmp/,/private/,/opt/,/var/and~/are kept readable, so that the record still says which files an agent touched. A path that looks random, or that carries characters such as: ? = & # @ ;, is not spared: it is treated like any other text; - provider message, tool-use and request identifiers, which look random but are not secrets.
⚠ Redaction is pattern-based. A short secret in an unusual shape — for example a short value under a
JSON key such as "api_key" — can survive it. Treat recordings as sensitive.
Not redacted
| the raw transcript | by design: it is the reference the journal is checked against |
| what a plugin receives | when the plugin is given content, it is the unredacted text; an exchange over the manifest's byte ceiling is not handed to the plugin. In projection mode a plugin receives digests and sizes only |
| attached sessions | the turns are read from the vendor's own file as they are |