← Back to blog

·AuditTrail team

Launching AuditTrail 3.0

We've been heads-down for a year on a question most observability tools dodge:

When an agent does something surprising, can the operator find out why — and intervene — before it ships a bad action to production?

AuditTrail 3.0 is the answer we're shipping.

What changed

This release is the first time the platform crosses the boundary from "post-mortem viewer" into "live participant" in your agent's loop. Two of the V3 milestones make that explicit:

Edit + Resume on paused agents. Your agent can hit audittrail.pause_checkpoint("approve-purchase", state) and stop until an operator opens the trace, reviews the state JSON, edits a field, and resumes. The dashboard surfaces the pause in real time over WebSocket and renders an inline JSON editor with a schema-hash guard so an operator's edit doesn't silently desync the agent's expectations. The feature ships behind a flag (AUDITTRAIL_EXPERIMENTAL_EDIT_RESUME) because giving humans a Resume button changes the agent's safety surface, and we want operators to opt in deliberately. A reaper worker handles expired (TTL past) and abandoned (heartbeat-silent) checkpoints so paused state can't accumulate forever.

Local runner daemon. AuditTrail can now dispatch agent runs to a daemon process running on your laptop, with traces flowing back to the dashboard correlated to the chat message that started them. The daemon authenticates with a sk-atd-… token over WebSocket, accepts only two server-allowlisted templates (quickstart, web-search), and spawns each agent with asyncio.create_subprocess_exec — never shell=True. The prompt is always passed as argv. Even if your account is compromised, the worst-case attack surface is the two starter templates.

Both features are user-scoped per Hard Rule 8 and pass the same BOLA-resistant 404-not-403 invariant the rest of the platform holds.

Why we drew the line where we did

The shorter version of the safety story:

  • We don't auto-run anything Tier 1 or higher. The chat → DeploymentAction bridge that shipped in 2.7 creates proposed rows, not applied rows, even when the deployment action is trivially safe.
  • The runner daemon refuses any template that isn't on the server allowlist, and refuses it again client-side. The two-gate check exists so neither side can be the last word.
  • The Edit + Resume path stays behind a feature flag until the operator opts into the human-in-the-loop posture. Cloud's demo user runs flag-off; you can opt in per deployment.
  • Pause checkpoints have a TTL and a heartbeat. Agents that lose connection clean themselves up.

These aren't artifacts of paranoia — they're the difference between an observability tool and a control plane. We're shipping a control plane, and we want operators to feel that.

Open source, all the way down

The Apache 2.0 build on github.com/Partha-dev01/AuditTrail is the same code that runs the hosted cloud. Every feature in 3.0 — the gateway proxy, the constitutional engine, the SHAP causal attribution, the SAE mechanistic XAI panel, the canary state machine, the runner daemon — ships in the self-host image. We never gate features behind tiers.

What Cloud buys you is operations: managed Postgres, 180-day retention, the BYOK provider key pool, and a 1-business-day support SLO. That's it. If you want any of the features, you don't need us.

What's next

  • Phase 9 (now → June 2026) — pricing page live, blog scaffolded, NOTICE / TRADEMARKS updated, pre-publish CI in place for all seven SDKs.
  • Phase 10 (gated on user credentials) — npm / crates.io / Maven Central / NuGet / Go proxy / VS Code Marketplace publishes; Stripe live mode; public GitHub repo flip; Algolia DocSearch.
  • After that, an end-to-end subagent audit and a codebase-wide 24-hour soak before we cut prod-v3.0.0 stable.

If you want to try the runner daemon today against a self-host install:

bash
pip install "audittrail[daemon]"
audittrail daemon login
audittrail daemon start

Mint a token in /settings → Runner, point the daemon at your API, and ask the operations assistant to run the quickstart template. The trace will land in /traces with the correlation ID stitched in.

Thanks for being patient with us — this one took longer than we wanted, and it's better for it.