Evidence an auditor can check

An agent with write access to production drops a table on a Thursday night. By Monday your insurer wants the record of what the agent did between Thursday and Saturday. Your auditor wants to know which controls that record answers. Your manager wants to know whose runs cost the most for the least.

Today most teams answer with a vendor's export. The file's format is documented only by the vendor, and the vendor's own tool checks it. The insurer has to trust that the file is complete and unchanged, and trust is the thing a claim puts in doubt.

Oxagen 5.5.0 changes three parts of that week. An auditor can check an evidence file on a clean machine with no network. A buyer can read, control by control, which parts of an agent standard Oxagen's record answers. A manager can read each operator's runs as measured figures, with a rank beside them.

#How an auditor checks a run export offline

oxagen verify reads a run export, a ZIP or the folder it was extracted to, and checks it offline. It makes no network call, sends no usage data, and writes nothing to the home folder.¹ An auditor installs the CLI, runs one command, and reads a verdict of HELD or BROKEN.

The check rests on two ideas. A hash is a short code made from content, and any change gives a different code. Locked means any change after this point shows. Each frame in a run, one recorded action, carries its own hash and the hash of the frame before it, so an edit, an insert, or a deletion breaks the chain from that point on. The verifier also rebuilds the Merkle root, a single hash over every frame hash, in the tree form the Certificate Transparency standard uses.² Each frame is hashed over JSON written in one standard form, so two programs that read the same event produce the same bytes.³ Oxagen locks the export with its private key, and the verifier checks that lock with the matching public key.

The verifier prints the limits beside the verdict. Each run's enforcement tier, its declared gaps, and its replay grade come from the lock itself. The documentation says plainly that an empty gaps list means no gaps were declared, and that it does not prove complete recording.¹ The coverage statement lists which recording path saw each kind of action and which actions no path sees, such as the network calls a shell command makes.⁴

#How an outside timestamp proves timing

A run export has one gap a careful auditor will find. Oxagen makes the lock when it builds the export, so the export carries no time from an outside authority.¹ It shows that nothing changed after the lock. It does not show when the agent acted.

The second format closes that gap. Oxagen wrote it as an Internet-Draft, draft-oxagen-scitt-agent-evidence-00, addressed to the IETF working group on Supply Chain Integrity, Transparency, and Trust (SCITT).⁵ The bundle covers one agent across a stated time window, because that is the unit a claim asks about: what did this agent do between the 3rd and the 9th?

Each chain head, the last frame of a chain, gets an RFC 3161 timestamp token. A Time-Stamping Authority, a third party, locks a hash of the head together with the time it saw it.⁶ oxagen verify reads that token offline. It walks from the token's time to the hash of the chain head, checks the authority's lock with the certificate the token carries, and follows that certificate to a root the auditor trusts. The bundle also carries a record of every break in a chain, a statement of which recording path saw each action, a receipt for each value removed from the record, a log of every read made under the bundle's access token, and a record keeper's declaration written for the United States Federal Rules of Evidence 902(13) and 902(14).⁷

Trust starts outside the file. A key shipped inside a file does not establish who made the file, so the auditor gets the record keeper's key ID, the transparency service's key ID, and the time authority's root fingerprint through a separate channel and passes them as flags. Without all of them, the verdict is UNPINNED and the command exits 3, even when every other check holds.¹

#What the record does not cover

This part needs its limits stated plainly, because an underwriter will read every word as a promise.

The run export is what the product writes today. The time-window bundle is a draft. oxagen verify checks it, and oxagen verify --sample writes a sample bundle so an auditor can try the checks, but the product does not yet export one for a real agent. No working group has adopted the draft. A passing check shows that nothing changed after a lock. It does not show that every action was recorded or that the work was right. Actions an agent takes outside Oxagen are not in the record.

#How the record maps to AIUC-1 controls

A buyer's auditor will ask a narrower question than "is the record good?" The question is which controls of AIUC-1, the agent standard that insurers write cover against, the record answers.⁸ Oxagen now keeps a mapping from the code, one row per control, with the evidence named in each row.

Covered means the code ships an answer for every agent action routed through Oxagen. It does not mean the control is operating in your deployment, which needs its own dated samples. Partial rows name the part that ships and the gap. A row for a control nothing answers yet links its work item. The 76 customer rows ask for the customer's own policies, third-party tests every quarter, or properties of the agent's replies to its own users, and Oxagen's record does not answer them. The mapping was corrected after its first draft, when three rows claimed more than the code did.

#How operators are ranked from the record

The last question in that Monday meeting is about people. An agent's bill has a person behind every run. That person picks the task, writes the prompt, and restarts the run when it stalls.

Oxagen scores and ranks each operator from the record. The Operator ranking dashboard orders a workspace's operators by unproductive spend: spend on steps that bought no progress, such as a repeated status poll or a model larger than the job. Each figure cites the runs behind it, and no setting hides a name. get_operator_scorecard gives each operator's runs over a day range: how many ended with a merged pull request, the cost per merged change, the share of spend that findings claim as unproductive, and the median share of a run's wall time it sat idle. Week by week, operators with a merged run rank by cost per merged change, cheapest first.

The scorecard returns measured figures only, with no hidden weights. Because it names every operator, only an organization Owner, a Compliance and Billing member, or the workspace's Admin can read it. A run that names no operator is left out. So the ranking is as good as the attribution in the record.

The Oxagen 5.5.0 release post lists everything else in this release.