Platform and SRE
- Written for
operator- The decision it ends in
- Decide what this puts on my on-call rotation, and what it does when it breaks.
Where this starts
Agent workloads arrive without an operational contract. They are started by developers on laptops and by CI on runners, they talk to third-party endpoints you did not approve, and when something goes wrong the first question — what did it actually do — has no owner and no answer.
You are asked to make them safe without being given a place to stand.
What makes it this quarter’s problem
An incident review asks which agent made a call, and the answer takes two days of log correlation across three systems and is still a guess.
What Agent Assembly does about it — and how far each answer reaches
A small number of processes you run and own: a control plane that answers policy questions and holds the record, a sidecar proxy on the wire, and a managed launch that puts a tool’s traffic in front of the proxy. Four entries decide what that costs you operationally.
Each card below is one entry of a sixteen-entry claim register shared by all four of these pages, quoted rather than paraphrased. The term is the register’s own, copied off the evidence rather than chosen to suit the sentence; the bound beside it is part of the claim, not context for it. Every entry — including the ones this page does not cite — is published with the manifest rows behind it: the shared claim register.
Where the control plane is configured and becomes unreachable, the decision path refuses rather than allowing.
Where this stops. Fail-closed on the paths that have a gateway: the runtime denies on an unreachable gateway, the proxy refuses to start, and the gateway aborts on a policy that fails to load. The inverse is not symmetric — a runtime with no gateway configured falls through to a local evaluation whose terminal default is allow. Configured-then-broken fails closed; never-configured fails open.
Where a control was planned and is unavailable, the product reports the planned level and the level actually achieved.
Where this stops. Degraded carries both levels or it is not this term. One row reaches it, for eBPF load or attach failure. The reporting half does not close: a degradation is emitted, typed, and rendered nowhere, and an unreadable eBPF policy file fails open silently, raising no degradation event at all.
Whether a given decision’s record durably reaches the audit chain is not established. The verification tool is real — aasm audit verify-chain ships in the open-source build — but what it proves is the integrity of the entries that are present, not that any particular decision produced one.
Where this stops. The manifest’s only row for this subject is the row for what happens when the write fails, and it carries coverage: unmeasured, failure_posture: fail_open and evidence: gap. So the honest term is the row’s own. Everything else about the chain is a bound, not a capability: it is tamper-evident, not immutable and not signed — an unkeyed digest, so anyone able to rewrite the sink can recompute it. The chain head advances before the send and a full channel drops the entry while the call still returns, which makes a dropped entry indistinguishable from a deleted one. An emptied log verifies clean. The proxy writes no local record at all unless its audit path is configured. See the two gaps.
Launching a tool through aasm run writes the proxy settings into the tool’s environment, which is what puts its outbound connections on the path.
Where this stops. Writing a tool’s own settings file is tool governance, not a data-path claim; any prevention these adapters deliver is the proxy’s, borrowed through the launch environment. Of the shipped adapters, Claude Code is the only one above Integrated and the only one with a launch evidence test. Copilot’s launch always fails by construction. Codex and Windsurf inject the proxy variable with no CA trust, which is the configuration measured as failing the handshake silently. aasm run --no-proxy is an announced bypass. An unmanaged launch is a bypass and is not detectable.
What is different after
Agent egress becomes a thing with a configuration, a failure posture and an owner, rather than ambient process behaviour.
When the control plane is configured and goes away, the paths that depend on it refuse rather than quietly widening. The inverse does not hold, and the Limitations below open with it.
What you can check, and where
Deployment shapes and the container story — what runs where, and what a limited-function self-hosted stack contains.
Docker and containers →What the running system exposes, and what it does not — read this before you design an alert on it.
Self-host observability →Per-row failure posture and default state — the two fields a summary drops first and an operator checks first — across all 80 rows.
The capability manifest →Version and platform position per component, and which channel each artifact actually reaches.
Source of truth and status →First-response material for the failures you will actually be paged for.
Troubleshooting →
What you would otherwise find out later
- Fail-closed is not symmetric.Configured-then-unreachable refuses; a runtime with no gateway configured falls through to a local evaluation whose terminal default is allow (RC11). The difference is a configuration mistake away.
- Three failure modes are silent.An unreadable eBPF policy file falls back to an empty rule set and raises no degradation event; a corrupt budget store resets the cap to zero spend; a full audit channel drops the entry and the call still reports success. None of the three pages you.
- Degradation is emitted and rendered nowhere.The event type exists and the producers exist, and there is no consumer — the health endpoint’s degraded-layers field is a boot-time snapshot that never updates, and its status is a hardcoded literal (RC10). Tracked as AAASM-5535. Plan to consume the event stream yourself, or plan not to know.
- The distribution position is not uniform, and it decides what you can install.The proxy is a Linux release artifact; on macOS the only route is a cargo install. The eBPF loader daemon reaches crates.io only and is absent from the GitHub Release assets, the Homebrew tap and the install script — so an operator who installed through any of those has no host-level component and, on macOS, no proxy for the managed launch to start (RC8, RC9). Tracked as AAASM-5653.
- Kernel probes report; they do not decide.Observed · DetectedRC8
On Linux, kernel probes report TLS plaintext, process execution and file activity.
Where this stops. No eBPF signal participates in any allow or deny decision. The one enforcing program is an opt-in syscall guard that terminates a confined process after the offending syscall has already run, which is Detected, not Denied before execution. File-I/O probes are x86_64 only. The privileged loader daemon that owns every kernel operation reaches crates.io only — it is absent from the GitHub Release assets, the Homebrew tap and the install script.
- The managed launch hands the child the entire parent environment.A shell or file tool inside the agent can read any credential you exported into the shell that started it.
- The proxy refuses a non-loopback listener.It does so even with the remote-clients flag, because it has no listener TLS and no client authentication. Do not work around it.
- Payload inspection is limited to model-provider hosts by default.Broader inspection is a configuration you make, and it carries a latency and compatibility cost (RC3).
- Windows has no local mediation.UnsupportedRC14
Named transports and platforms are not available, and the matrix says which.
Where this stops. Windows has no local mediation of any kind. UDP, QUIC and HTTP/3 are outside the transport set; so are HTTP/2, gRPC and WebSocket over an intercepted host, and MCP over WebSocket. Unsupported for one element is not Unsupported for the product.
One page to read, one thing to do
Read self-host observability — what the running system exposes is the input to every alert and dashboard you would build on it.
Self-host observability →Then confirm your platform and channel before you plan a rollout — the distribution limitation above means the answer decides which components you can install at all.
The compatibility matrix →