Blog
How to connect model activity to local processes, files, network calls, and resource use.
Native session internals · September 2026
Follow v1.0.31 provider-native transcript data into the shared AgentSession and SessionEvents IR, including prompts, tool effects, paths, responses, usage, plans, and missing-field boundaries.
Read the pageTelemetry export internals · September 2026
Follow a completed v1.0.31 model call from the materialized view to an OTLP/HTTP GenAI CLIENT span, including trace grouping, attributes, privacy defaults, and evidence that stays local.
Read the pageToken accounting internals · September 2026
Trace the v1.0.31 report path from raw token observations through keyed source precedence, Gemini network/stdout reconciliation, native-session fallback, and grouping semantics.
Read the pageSampling internals · September 2026
Trace the v1.0.31 monitor from two-second aggregate windows through 30-second bounded detail samples, weekly SQLite naming, process/file/network semantics, and sampled-evidence limits.
Read the pageFleet UI internals · September 2026
Trace the v1.0.31 frontend from concurrent per-Node probes through incremental fleet rendering, stale-refresh guards, transport fallbacks, and lazy session views.
Read the pageSkill evolution · September 2026
Follow the v1.0.30 evidence-gated loop from trajectory source validation and failure ownership through bounded skill patches, held-out evaluation, promotion, and rollback.
Read the pageSkill distribution · September 2026
Follow the v1.0.30 bridge from a pinned agent-skills submodule through generated .agents/skills links, overwrite guards, and the Windows junction fallback.
Read the pageNative session internals · August 2026
Follow the v1.0.30 discovery path from provider-native files and Codex state_5.sqlite through bounded session indexing, provider-specific IDs, Cursor subagents, caching, and lazy detail hydration.
Read the pageEvidence modes · August 2026
Choose between agent-native session evidence and independent system observation: see which top, bind, vis, and report workflows work without sudo or eBPF, and when record is still the right sensor.
Read the pageRemote-access architecture · August 2026
Follow the exact v1.0.30 credential path from agentsight bind through URL-fragment pairing, Direct browser capabilities, Controller relay capabilities, and optional encrypted cross-browser Direct sync.
Read the pageEvidence interpretation · August 2026
Understand direct capture, SQLite reconstruction, native agent sessions, correlation confidence, legacy fallbacks, and how to preserve evidence lineage in exported snapshots.
Read the pageContainer session architecture · August 2026
See how the Docker-backed native-session bridge keeps provider state in the container, routes exact sessions, bounds JSONL operations, and separates AgentSight scope from Docker daemon authority.
Read the pageAgent replay methods · August 2026
See how Agent Nebula reconstructs ordered repository evolution from local agent sessions, and where replay stops short of explaining intent or low-level system effects.
Read the pagePerformance methods · August 2026
Read the published 2.9% average runtime-overhead result with the raw run variability, benchmark limits, and a method for measuring your own workload.
Read the pageEngineering note
Application logs explain declared agent steps; system activity shows the commands, files, processes, and network effects that actually ran.
Read the pageWorkflow note
Turn a large agent event stream into a bounded artifact that explains decisions, validation, side effects, and open questions.
Read the pageSystems deep dive · refreshed September 2026 · AgentSight v1.0.31
A source-level guide to finding plaintext boundaries across OpenSSL, Node, Bun/BoringSSL, rustls, containers, Electron, browsers, and MCP.
Read the page