Harness Telemetry Check
Your agent isn't a prompt. It's a harness. Grade the harness.
A prompt scan can't see whether your policy gate actually ran before the agent moved money, whether a privileged action skipped approval, or whether a raw secret landed in your logs. Send a run's spans and AgentSmack grades the harness itself — deterministically, with the exact span lineage as evidence.
New here? Check your telemetry conforms first
Every dimension above is gated on you emitting the right spans with the right attribute keys. Before you grade, the Harness Telemetry Contract & Conformance Pre-Flight publishes the exact spec — which spans, which attribute keys, which dimension each unlocks — and grades a candidate trace 0-100 with the precise missing keys per span, so you wire it once and grade with confidence.
What we grade
Policy-before-action, approval before privileged/destructive actions, secrets-in-telemetry, identity/tenant context on actions, egress + canary control, and action idempotency (the same side-effecting action never runs twice — no double-spend). Any hard blocker caps the score.
Wire it once
Emit the closed span vocabulary (OTel/OpenInference-shaped) and POST to /api/v1/harness-check from CI. Deterministic — same spans → same grade.
Grade the wall-clock physics too
The harness grade above reads array / causal order. It does NOT grade whether the span startedAtIso timestamps are physically coherent — a policy/approval gate timestamped AFTER the action it authorizes is a back-dated audit trail every content grader trusts. Run the same spans through the Span-Timeline Temporal-Integrity lab to catch a forged timeline.
Is the clean grade earned, or laundered by omission?
The harness grade above EXCLUDES any dimension whose telemetry is absent — so a thin or cherry-picked trace that simply OMITS the risky spans (no policy.check.completed under a privileged action, no egress sink under a sensitive origin) certifies a clean 100. Run the same spans through the Instrumentation-Coverage / Telemetry-Sufficiency auditor to catch a clean grade laundered by omission.
Is the lineage the binding detectors trust even real?
Every check above binds a gate / approval / llm-call to a privileged action via the parentId causal DAG — and then trusts it. A cycle in parentId, a duplicate span id, or a privileged action with no causal ancestor at all forges that lineage. Run the same spans through the Span-Lineage Graph-Integrity meta-lens to catch a structurally-forged graph.
Do the attribute values even agree across spans?
Every check above binds a gate to an action then trusts its decision verbatim — but if the argsHash the gate evaluated differs from the one the action executed, the clean grade is laundered (the gate approved a DIFFERENT action). A redaction-claimed value re-emitted raw, a planned tool substituted at execution, an approval scope that drifted — all are value-level forgeries this grade trusts. Run the same spans through the Cross-Span Attribute Value-Consistency meta-lens to catch a forged attribute trail.