Evidence methodology

Start with a decision. Preserve the path from event to claim.

AgentSight is not a promise that every low-level event explains itself. The method is to scope one question, collect the relevant system boundary, retain provenance, and make uncertainty visible.

Verified with AgentSight v0.2.67Reviewed August 5, 2026Maintained by Yusheng Zheng
01

Choose a bounded question

Define the decision before collection: performance, generated-code review, compatibility, or extension audit.

02

Record the actual command

Observe the selected process family and retain enough context to attribute model and system activity.

03

Normalize the evidence

Connect turns, calls, commands, paths, destinations, resource phases, and exit status without erasing provenance.

04

Reduce, do not decorate

Aggregate the trace into a causal profile or review artifact that answers the original question.

05

State the limits

Separate observed effects, supported inferences, unavailable evidence, and questions that need another experiment.

Evidence levels

Do not collapse observation, inference, and absence into one confidence level.

A useful report tells the reviewer which statements came from a recorded event, which combine multiple events, and which remain hypotheses.

Observed

A command, process, file operation, network destination, model call, or resource phase exists in the selected record.

Attributed

Multiple events are connected to a run, process family, turn, or bounded task through recorded identifiers and timing.

Inferred

A likely explanation is supported by evidence but still needs a follow-up run, source inspection, or controlled comparison.

Unavailable

The collector, runtime packaging, encryption boundary, permissions, or retained data does not support a conclusion.

Privacy boundary

Raw runs are sensitive until reviewed and reduced.

Agent sessions can contain prompts, responses, repository paths, headers, commands, and network targets. Keep raw databases and exports local, redact artifacts before sharing, and publish only the minimum evidence required for the decision.

No raw analytics in GitNo credentials or identifiersExplicit redaction review
Bounded capture
$ sudo agentsight record -- claude
$ agentsight report audit --json
$ agentsight report export -o review.json

Reproducibility

A credible run page includes environment, command, evidence, limits, and a verification date.

Browse the run library to see how the methodology becomes a public-safe engineering artifact.

Open the run library