A transcript is not an audit trail

Suppose an agent returns a twelve-line authentication fix and this summary: “Implemented token refresh, added regression coverage, all tests pass.” The prose is specific. The patch is small. The test file exists. This is exactly the kind of result that feels easy to approve.

Now add three observations the summary omitted: the full test suite was never run; one command exited 137 after hitting the memory ceiling; and the process tried seven times to reach a telemetry host outside policy. None proves the patch is malicious. All three change the review. The difference between the two versions of the story is not better summarization. It is independent collection.

A diff records state, not execution

A Git diff is excellent at its job. It describes how one tree differs from another, composes through merges, and gives reviewers a stable object to discuss.

It cannot show a failed network connection, a read that left no edit, an install hook that ran, a test that was skipped, or a browser exception that did not change a file. Those are events. Tree comparison has no place to store them.

Human review papered over that gap with conversation. The author remembered the work and answered questions. An autonomous agent removes that memory while making the replacement self-report unusually fluent.

The source of a record sets its value

Suppose a transcript says “ran cargo test, exit 0.” The line may be true. If the agent or its in-process tool shim produced it, the line is the subject's account of itself.

Now suppose the supervisor that launched the child waits for it and records the exit status. The words can be identical. The evidence is different because the child did not author the observation.

This distinction must travel with every event. Flatten host-observed and box-claimed records into one log and no downstream dashboard can reconstruct the trust boundary.

Evidence must live outside the subject's write path

External observation is not enough if the result is written somewhere the agent can edit. The storage layout matters.

In h5i, the box can stage capture data in its spool. The host ingests it into receipt storage outside every grant the box holds. Host-observed process exits and proxy decisions are already produced there. The box cannot rewrite an earlier receipt without first escaping the boundary.

This is local protection, not notarization. A user with control of the host can edit local files. The claim is narrower: the code under review cannot silently rewrite the record of its own run.

Keep evidence grades visible

These records belong together. They do not deserve the same color, ordering, or confidence.

Absence must not impersonate success

A missing browser section can mean no errors, no browser, or a failed capture. An empty egress summary can mean no attempts or a tier whose packet filter does not report them. Good evidence formats name the difference.

This is the hardest discipline in audit UI: make uncertainty visible even when it makes the product look less complete. Grey is information. “Unavailable” is a result. Silence is ambiguity.

A better review order

1. Start with boundary refusals and failed execution.
2. Confirm the meaningful build and test commands actually ran.
3. Read browser and resource observations, including unavailable sections.
4. Review the patch against the pinned base.
5. Read the agent's explanation last.

This order does not replace code review. It stops eloquent testimony from framing the evidence before you see it.

What a useful receipt has to bind together

An event record becomes reviewable when it answers more than “what text was printed?” At minimum it needs the command or event kind, time, exit result, observer, payload reference, and the digest of the policy in force. Without the digest, a clean-looking run can be separated from the rules that supposedly constrained it. Without the observer, testimony and observation collapse into the same JSON shape.

The pinned base matters for the same reason. A patch is meaningful only relative to the tree it changed. A receipt is meaningful only relative to the boundary that produced it. h5i freezes both at box creation so a later branch update or profile edit cannot rewrite the premise of an old run.

review/
├── patch.diff      # tree state against the frozen base
├── report.md       # evidence ordered for a human review
└── receipt.json    # events, observer lanes, policy digest

Observation needs two paths, because each catches the other's lie

The host supervisor can reliably observe the child it launched: start, exit status, elapsed time, and resource use. It cannot reconstruct every command typed inside a long-lived interactive shell. An in-box hook can report that detail, including nested shell commands. The box can also suppress or fabricate that hook.

The right response is not to choose one and pretend it is complete. Keep both. A host-observed shell exit with no matching in-box command is a gap worth showing. An in-box command claiming success beside a host-observed nonzero exit is a disagreement worth showing. Redundancy becomes evidence only when sources remain distinguishable.

Denied actions are often the most valuable rows

Successful work dominates normal logs. Security review is disproportionately interested in failed attempts: a path outside the grant, a refused address family, an off-list destination, a resource ceiling, a browser verb denied at the control socket.

A diff cannot represent any of these because the attempt left no accepted state change. A transcript may omit them because they were noisy or because the agent moved on. The boundary that made the decision is the natural observer, and its denial should appear before the agent's proposal in the report.

Do not overread a denial. A build tool reaching a telemetry endpoint can be normal. Seven retries can reflect an ordinary client. The record does not assign intent. It tells the reviewer where intent is worth investigating.

“Sealed” is a local, scoped claim

The box's writable spool is a staging area. Receipt storage is a sibling outside its grants. The host ingests staged records and assigns ordering. A process inside the box cannot reopen yesterday's host record and change an exit code.

A user who owns the host can still edit the file. There is no external timestamp authority, signature service, or transparency log. Calling the receipt tamper-proof would be false. The actual claim is narrower and useful: the subject of the review has no filesystem path to its ingested history.

A worked review order

For an unattended change, begin with the highest-consequence, lowest-interpretation evidence:

1. Policy and tier. Was the session actually confined, and at which layer was egress enforced?
2. Denials and limits. What did the boundary stop? What died under a ceiling?
3. Observed execution. Which meaningful build and test commands have externally observed exits?
4. Page evidence. Were there console exceptions or failed requests? Was a browser even available?
5. Patch. Does the state change match the execution story?
6. Proposal. What does the agent believe it achieved, and where does that account diverge?

The order is intentionally unfriendly to polished prose. By the time you read the summary, you already know which claims need proof.

Four ways evidence turns back into decoration

One risk score

Combining a denied destination, a failed test, a large diff, and a box-claimed command into “risk: 72” destroys the semantics a reviewer needs. The score cannot explain whether the boundary stopped something or whether the agent merely said it did. Keep the lanes. Let the human weigh them for the task.

Only successful final runs

Retries contain the debugging story. A failure followed by a pass can be ordinary progress, or the agent can have weakened an assertion until it turned green. Retaining only the final exit removes the comparison that makes the patch intelligible.

Unlimited payloads

Raw command output can be enormous and attacker-controlled. Evidence collection needs byte caps, truncation markers, redaction, and payload references. Otherwise one verbose build can make the review artifact unusable—or push secrets into every downstream index built from it.

Silence as green

An empty array is not a universal success state. It may mean the observer saw no errors, the subsystem was never started, the tier cannot report that class, or collection failed. Good schemas make these states distinct before a UI assigns color.

Compare claims across artifacts, not only within one log

The strongest review questions cross boundaries. The proposal says tests pass; do host-observed exits contain the meaningful suite? The patch adds a network client; does the report show new destinations or repeated refusals? The browser screenshot looks correct; were there console exceptions? The profile says no network; does status show that the resolved tier could enforce the claim?

This is where a bundle beats a transcript. Patch, report, receipt, and policy digest are deliberately different views. Agreement increases confidence. Disagreement tells you exactly where to look.

Sources and further reading

• The receipt reference, including observer lanes and explicit limits.
• The export bundle, for report ordering and path validation.
• Review a pull request in a detached box, for the evidence-first workflow.
• h5i-core, where box state, policy digests, and receipt storage are implemented.

Questions that come up