Incident replay

Given a bad output at time T, reconstruct exactly what the agent knew and did leading up to it. Download a signed forensic bundle. Answers "walk me through what happened."

Use cases

• Regulator asks: "prove the AI's discrimination check wasn't influenced by demographic data", open the replay for the flagged decision and show every input it read.
• Bug ticket: "AI approved fraudulent transaction at 10:23:47", click the event, see every tool call it made and every value it saw.
• Model hallucination: "the assistant cited a customer name we've never had", walk the causal chain backwards to find the upstream event that seeded it.

How to use it

1. Log into the dashboard.
2. Open Decision traces (search by session_id, entity, or reasoning). Each row has a Replay button.
3. Click Replay. You'll land on /dashboard/replay/<event_id>.
4. See the reconstruction:
   • Timeline swimlane: every prior event in the session, chronologically arranged
   • Provenance graph: solid edges connect tool_call → tool_result via matching tool_id
   • Full event table: expandable rows showing every hash, every payload
5. Click Download signed bundle to get a JSON file for offline forensics.

Signed incident bundle

The downloaded JSON contains:

• target_event, the event you replayed
• events_up_to_target, every event in the same session at or before the target's timestamp
• causal_chain, the subset linked to the target via tool_id
• transparency_log_head, the signed log head at bundle generation time, with hybrid Ed25519 + SLH-DSA envelope

Any auditor can independently verify the bundle by:

1. Fetching your public keys from https://etch.systems/projects/<id>/audit-log/public-keys, no auth required.
2. Verifying the signature envelope on transparency_log_head.
3. Checking that every event in events_up_to_target appears in the log at or before the signed log_index.

That is the signed authenticated proof: an incident replay bundle downloaded today can be verified in five years by anyone with the pinned public key fingerprints, regardless of what happens to Etch's operator infrastructure.

Cost

Free. Replay is a query over already-recorded events; no LLM calls.

Full post-mortem runbook

This page walks the single-event forensic-bundle flow. The full 8-step post-mortem workflow, dual-epoch signed certificate, root-cause reproduction against mocked APIs, and regression capture back into Shadow Mode, is documented in the repo: docs/incident_replay.md.