Work / Live demos
Provenance
A flight recorder for agent fleets. Provenance is the studio's own product, running on the studio's own work; the demo is a real ledger from a real run, not a mockup. Open the live demo and click the red row; no account needed.
The problem domain
Agents make hundreds of discretionary choices per task: which framing to lead with, which claim is safe to publish, when to escalate to a human. Today those choices evaporate the moment they are made. Tracing tools record what an agent did, but not what it almost did. Checkpointing systems resume the work, but a checkpoint cannot testify. And every human review of an agent decision is a labeled preference about how the organization decides, discarded at the exact moment it becomes valuable.
What we built
One append-only record whose unit is the decision: the options the agent actually weighed, with full contents and arguments, the choice, the rationale, the autonomy level of the gate it passed through, and the eventual human verdict, hash-chained with write-ahead durability so a single command verifies the whole file offline. Zero runtime dependencies, one JSONL file, 33 tests including a kill matrix that murders the process at every event boundary and inside every decision window, then proves the resumed output byte-identical under two hash seeds.
The kill and the resume
The demo's red row is the scar where we killed the process between a decision's open and its commit. Resume folded the ledger, pinned the three committed decisions, replayed the cached model calls, re-entered exactly the interrupted decision, and produced a launch post byte-identical to an uninterrupted run. The scar stays in the file on purpose: an audit record that hides its crashes is marketing, and the chain would catch the edit anyway. There is a button on the demo that flips one byte so you can watch verification fail.
From verdict to training row
Review verdicts turn the log into labels. A human rewrite of the agent's headline becomes a preference pair; an overruled risk call becomes a correction pair; a 900 millisecond rubber-stamp approval gets filtered out, with the receipt printed. Every exported row carries the decision id and event hash it came from, so a training example traces back to the audited chain. The demo's alignment panel runs on a synthetic corpus and is stamped SYNTHETIC on its face; the mechanism, the durability, and the leakage guards are the product. Take the pen yourself in the demo: overrule the headline and watch your verdict become a pair and move a policy.
The production path
Provenance instruments the studio's own agent fleet through an MCP capture server, and the empirical question it exists to answer, whether an organization's accumulated verdicts measurably align a model to its judgment, is written into a registered study protocol with the test frozen before the data arrives. The design and reference implementation are described in a preprint prepared for arXiv. This is the studio's standing claim applied to itself: audit trails and human deferral mechanisms, used in anger, on our own work first.