Question 1

How is this different from observability or logging tools?

Accepted Answer

Observability and logging give you records you have to trust the vendor about: they live in a system you control, and anyone with access can change them. AER produces a signed record that a third party can verify without trusting you or us. The signature and the public transparency log make it evidence, not a dashboard. AER sits alongside your observability stack; it is the record you hand to someone who will not take your word for it.

Question 2

What exactly does a signed record prove?

Accepted Answer

Three things. Integrity: the record was not altered after signing, since any change breaks the canonical hash. Provenance: it was signed under AER's published key, and the transparency log fixes when. Observation: the events in it were captured by the collector during the run. It does not by itself prove the agent could not act outside what was instrumented; see "What won't a signed record tell you?" for what that gap means and where admission control closes it.

Question 3

What won't a signed record tell you?

Accepted Answer

A record proves the integrity of what was captured, not that everything the agent did was captured: a collector that never ran, or was removed before the agent acted, produces no record at all, so there is nothing to detect because nothing was emitted. Admission control and attestation close that gap only for resources wired to require a token, not universally.Metadata is not the full story, by design: knowing a tool was called does not say what arguments it passed or what it got back, which is the trade-off bodies-off makes so a record can be shared without exposing your prompts or your data.Trusting a record still means evaluating AER the way you would any vendor you depend on: how the signing key is managed, how long records are retained, how revocation works, how far collector coverage reaches and what happens if AER is unreachable.

Question 4

Is the record on the demo page a real agent run?

Accepted Answer

Yes. It is produced on a schedule by an agent that makes real model calls and real tool calls against a live registry, through the same session, ingest and completion path a customer’s agent uses. It is signed and anchored like any other record. The sentence describing the run is assembled from the record itself rather than written by hand, so it cannot drift away from what the record actually shows.

Question 5

What does AER deliberately not capture?

Accepted Answer

AER’s collectors record metadata only: model names, token counts, tool names, hosts and process names. They never capture prompts, completions, tool arguments, request or response bodies or headers, and a URL is recorded as its host; the Node collector also keeps the URL path, with any query string replaced by a marker. That boundary is enforced in the collector, on every provider, streaming or not. The API also discards fields it does not recognise at ingest and bounds the size of the fields it keeps. It reduces a url field to its scheme and host and replaces a query string in a redacted path with the same marker, so an event you build yourself with an SDK or the raw API cannot store a query string either. Every other field it keeps is stored as you send it.

Question 6

Does deviation detection send anything to a language model?

Accepted Answer

No. A baseline is the set of tools, hosts and tool orderings an agent used across the sessions you trained it on, and a finding is a later session stepping outside that set. Training and detection are deterministic rules over metadata we already hold, they run on our infrastructure, and no model provider is involved at any point. The engine depends on nothing but our own schemas, and a test in the build fails if a dependency is ever added that could reach outside it.

Question 7

Can I prove a specific prompt or output without revealing it?

Accepted Answer

Yes. Content commitments put a one-way tag over a prompt or response in the signed record using a key only you hold. Later you can prove a given text matches the tag byte for byte, offline, without AER ever seeing the text.

Question 8

Where does my data live and how is it handled?

Accepted Answer

On Cloudflare's platform, isolated per tenant. You control retention and whether records are public or private. We are a data processor for your telemetry and a controller for your account data. The Data Processing Agreement is published in full, EU and UK transfers rely on Standard Contractual Clauses, and every subprocessor is listed on the subprocessors page. The privacy and security pages have the detail.

Question 9

What if Sigstore Rekor goes down or rewrites history?

Accepted Answer

Rekor is run by the Linux Foundation's Sigstore project with independent witnesses and a publicly auditable Merkle tree. Anchoring is best-effort at session close: if Rekor is briefly unreachable, the record is signed and flagged unanchored, then anchored once the log is reachable again. Even without Rekor, the Ed25519 signature alone proves the record was emitted by AER's key.

Question 10

Does this slow down my agent?

Accepted Answer

Not in the request path. The SDK batches events in memory and posts them asynchronously. Calls to emit() return as soon as the event is queued; flushing runs every 500ms by default. Signing and anchoring happen at complete() time, server-side, not in your hot path.

Question 11

What can I instrument?

Accepted Answer

The Node collector covers the OpenAI, Anthropic and Vercel AI SDKs, raw HTTP, fetch and child processes, and the MCP recorder covers MCP servers. Both need Node 22 or newer. Two SDKs ship today, @adastracomputing/aer-sdk-ts for TypeScript and Node, and aer-sdk for Python. The Python one is installed from the public client repository rather than PyPI, pinned to a release tag rather than the default branch: pip install "git+https://github.com/Ad-Astra-Computing/aer.git@sdk-py-v0.1.0#subdirectory=packages/sdk-py". Any other language can speak the raw HTTP API.

Question 12

Does it work with Claude Code, Codex CLI or coding agents?

Accepted Answer

Yes, through hooks rather than the collector, since a coding harness is not a Node process you control. npx @adastracomputing/aer-hooks install claude-code registers with the harness with no change to the harness itself, and codex and antigravity install the same way. Codex will not run a hook until you trust it, so run /hooks there and approve the entry. Antigravity does not fire its tool hooks in print mode, so a headless run there records the shape of the conversation rather than each tool call. opencode runs plugins in process rather than firing shell hooks, so it takes a small plugin file instead of an install command. The hooks record tool names and argument key names, every program a shell command runs, the hosts that curl, wget, git, ssh, scp and rsync are pointed at, the host and method of a web fetch, the paths of files read or written and, for Claude Code, the model and token counts from its transcript. They never record argument values, file contents or the path and query of a URL, and a hook that cannot reach AER never blocks a tool call.

Question 13

Can I install AER with Nix instead of npm?

Accepted Answer

Yes. The client packages ship as a Nix flake alongside npm. nix run github:Ad-Astra-Computing/aer#aer -- init instruments a project without installing anything permanently, and nix profile add github:Ad-Astra-Computing/aer#tools puts the CLI, the hook binaries and the MCP recorder on your PATH. Recording a coding harness needs the profile form, because the harness calls the hook binary itself long after the setup command has finished. Every command box on this site offers both forms.

Question 14

Is AER open source?

Accepted Answer

Partly, and the split is deliberate. Every client package you install into your own agents and services is Apache-2.0: the collector, the SDKs, the CLI, the verifier and the admission guards. The Node packages are published on npm and the source is at github.com/Ad-Astra-Computing/aer. The hosted service that signs and stores records is not. The part that proves a record is genuine is the open part, so you never have to trust whoever produced the record. The verifier library makes no network calls and needs no account, so a record already issued still verifies even if AER goes away.

Question 15

How long are records retained?

Accepted Answer

Until the retention window you set in settings expires, anywhere from 1 to 3650 days, or indefinitely if you set none. The transparency log entry is permanent by design, since Rekor is append-only, but it contains only a hash and a signature, never your data.

Time (UTC)	Event	Recorded	Not recorded
16:30:07.188	llm.requested	LLM → claude-haiku-4-5-20251001	the prompt
16:30:08.649	llm.completed	LLM ← 66 tok	the completion
16:30:08.649	tool.selected	Select: npm_package_info	argument values
16:30:08.649	http.requested	HTTP GET registry.npmjs.org	path, query, headers, body
16:30:09.712	http.completed	HTTP 200 registry.npmjs.org	response headers and body
16:30:09.712	tool.completed	Done: npm_package_info	the result
16:30:09.712	llm.requested	LLM → claude-haiku-4-5-20251001	the prompt
16:30:10.630	llm.completed	LLM ← claude-haiku-4-5-20251001 39 tok	the completion

Recorded by the collectors and hooks	Not recorded
Tool names and the names of their argument keys	Argument values and return values
Hosts contactedThe Node collector keeps the host, method and path, with any query string replaced by a marker. The hooks keep only the host and method.	Query strings, headers and bodies
Paths of files read or written	File contents
Every program a shell command runs, and the hosts it points curl, wget, git, ssh, scp and rsync at	The command line, its flags and arguments
Model names and token counts	Prompts and completions

Property	Plain logs	Observability platform	AER
Tamper-evident	—	—	Ed25519 signed
Your prompts and data	in your logs	typically uploaded	never leave your process
What it is for	debugging	debugging your agent	proving it to a third party
Independently verifiable	—	—	SubtleCrypto, CLI, anywhere
Anchored to public log	—	—	Sigstore Rekor
Standalone bundle artifact	—	typically platform-specific export	single canonical.json
Baseline-driven detection	grep	eval rules, schema not published	rules.v1: deterministic and replayable, schema published
Schema is open	—	varies by platform	documented + zod-validated

Goal	Reach for
Debug a wrong or low-quality answer	Langfuse, LangSmith or Phoenix. Tracing and prompt comparison are their job, not AER's.
Track cost and latency across many runs	An observability platform tracks it over time. AER estimates cost once per record, against a versioned price table.
Self-host so nothing leaves your network	Langfuse or Phoenix, which are open source and self-host on their free tiers. LangSmith self-hosts on its enterprise plan.
Prove a record was not modified after the fact	AER. That is what the signature and the public log are for.
Gate access to a resource on a live attestation	AER's admission control.

canonical.json	The exact bytes that were signed
public-key.json	The signing key
anchor-evidence.json	Log inclusion proof for offline checking (when the run is anchored)
prov.json	W3C PROV export
README.md	The offline verification steps
manifest.json	SHA-256 of every file

Do you know what your agents are doing?

A real agent session, as AER recorded it

Install the hooks or the collector

Import a past Claude Code session

The record holds metadata only

Verifier output for a signed record and an edited copy

Record

Sign

Check

Independent evidence, not better logs

Findings, usage policy and cost

Baseline findings

Usage policy per agent

Estimated cost

More agents than you can account for

The incident review

The audit request

Admission control

Pause an agent

Evidence pack

Storage and retention

Pilot access, reviewed by hand

What evaluators ask