Catch the prompt injection.

Before it ships.

Your agent could be prompt-injected in production and you would only find out from the incident report. Etch is the substrate that catches divergent decisions in Shadow Mode before deploy, and walks you back to the root cause when one slips through. Every attack we defend against ships as a code-testable property with a passing test.

Read the adversarial analysis →   Run the notebook

13 attack scenarios, all with a code-testable defense

The adversarial suite maps every plausible tamper an insider with disk access could attempt to a specific code property Etch relies on, and a test that proves the defense holds. All 13 tests pass. Every release runs the suite in CI.

• Rewrite past event content (naive and sophisticated)
• Delete an entry from the middle of the chain
• Insert a forged entry
• Reorder or duplicate entries
• Forge a new genesis block
• Rollback attack (plus its honest limit and gossip defense)
• Strip the signature envelope
• JSON canonicalization attack (key reorder, whitespace)
• Concatenate two valid chains

git clone https://github.com/SaravananJaichandar/etch
cd etch
PYTHONPATH=src python3 -m pytest tests/test_adversarial.py -v
# expected: 13 passed

Shadow Mode: pre-deploy release gate

Run your candidate agent against a fixed corpus with mocked external APIs. Every tool call and every LLM call lands in Etch. Reasoning-path assertions decide pass or fail per case. At end of run, Etch emits a signed Evaluation Scorecard your CI can gate on: pass rate below threshold blocks the deploy; pass rate above threshold hands you a signed attestation of what you shipped and why.

Read the Shadow Mode runbook — six steps, from corpus freeze to signed scorecard, roughly 90 minutes to wire the first pass against your existing regression suite.

CX.1 pilot: Coach-Player + Etch beats baseline on the specific bug

The Trust assets page has the reproducible test corpus SHA, the reproduce commands, and the pre-registration hash for the 100-task follow-up (CX.2) that lands the statistical claim.

When it slips through anyway: Root Cause Analysis

Every session in Etch has a Provenance DAG and an RCA tab. RCA walks backwards from the flagged bad output through the tool_id causal chain and scores every ancestor for divergence likelihood on four signals:

• +4 the ancestor already failed (success = False)
• +3 its tool_output text names an error or failure
• +2 it used a rare tool (appears exactly once in the chain)
• +1 agent-stuck signal (time gap to the next event exceeds 10x the median)

The top-scored ancestor is highlighted as the candidate root cause with a red border and an explicit label. Tie-breaks go to the earliest ancestor — the causal-priority story is "the earliest thing that could have caused this."

Behaviour drift alerts

The Drift tab shows month-over-month deltas on events, sessions, unique tools, unique devs, and average events per session. Any metric that moves more than 3x fires a top-of-page alert. Threshold is env-configurable via ETCH_DRIFT_ALERT_THRESHOLD_PCT. This is the quiet early-warning surface: an agent that suddenly went 3x tool-heavy this month probably picked up a new prompt-injection pattern in the wild.

In flight

Ready to eval your agent?

Start a pilot →   See the eval-infra story