{
  "$schema": "runback.audit/v2",
  "manifest": {
    "run_id": "sbx-fraud-screening-d62d4df92246",
    "generated_at": "2026-11-07T07:28:24.284Z",
    "event_count": 7,
    "algorithm": "sha256-chain",
    "content_digest": "93282cbfd8220cc459c9a835cb3f01de0367fcde6cb25c8959d0a464f33d1596",
    "replay": {
      "cassette_digest": "aefac20f4ea232d474e0b826231876fa3afb0f39554b1888344b44abb5d1e148",
      "entry_count": 5,
      "algorithm": "oracle-chain/sha256",
      "note": "The run's oracle stream — every model response and tool output, hash-chained. Re-execute the agent against `events` with @runback/replay and the cassette digest must reproduce. This is proof the recording IS the deterministic input stream of the run — an audit you can re-run, not just read."
    },
    "signed": true,
    "signature": {
      "alg": "Ed25519",
      "value": "cca6b0cabe047df03d2f6b78993bc90fc794a0c61f3d180ba11b3659d54378c8f253691035e994297ca63170129779b0f1540ee1a26590f28d209a290234ed04",
      "pubkey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEArDPmR+Gvu1HawnSvM6xjZao7BVPPQ80Qq3sa1hAYvDU=\n-----END PUBLIC KEY-----\n"
    },
    "verify": "Recompute the event chain h_i = SHA-256(h_{i-1} + canonical(event_i)) over `events` → must equal content_digest. Recompute the oracle-stream digest from `events` → must equal replay.cassette_digest. The signature covers `${content_digest}:${cassette_digest}`. Ed25519: verify with the public key embedded in manifest.signature.pubkey (no server key needed — fully offline-verifiable). HMAC-SHA256 (legacy): requires AUDIT_SIGNING_KEY. POST this record to /api/audit/verify.",
    "spec_url": "https://runback.dev/spec",
    "verifier_url": "https://runback.dev/verify"
  },
  "run": {
    "run_id": "sbx-fraud-screening-d62d4df92246",
    "name": "fraud-screening-agent",
    "status": "success",
    "input": "Screen payment PAY-55397: A$585.62 from customer #3725 to Wattle Sandbox Pty Ltd.",
    "output": {
      "summary": "I held payment PAY-55397 due to high risk signals including a risk score of 78, new device usage, and multiple payments within 24 hours."
    },
    "error": null,
    "metadata": {
      "agent": {
        "description": "Screens payments for fraud before they settle. Runback demo agent: real model calls and real policy decisions; its tools act on a sandbox of synthetic customers, orders and accounts.",
        "systemOfRecord": "Runback demo sandbox (synthetic data)"
      },
      "model": "claude-haiku-4-5",
      "demo_agent": true,
      "est_cost_usd": 0.004324,
      "sandbox_tools": true,
      "scenario_seed": "fraud-screening-agent:2026-11-07:23"
    },
    "step_count": 3,
    "total_tokens": 3280,
    "started_at": "2026-11-07T04:10:56.242+00:00",
    "ended_at": "2026-11-07T04:10:59.948+00:00",
    "actor_type": null,
    "actor_id": null
  },
  "events": [
    {
      "seq": 0,
      "name": "fraud-screening-agent",
      "type": "run",
      "error": null,
      "input": "Screen payment PAY-55397: A$585.62 from customer #3725 to Wattle Sandbox Pty Ltd.",
      "phase": "start",
      "output": null,
      "run_id": "sbx-fraud-screening-d62d4df92246",
      "status": "running",
      "ts_end": "2026-11-07T04:10:59.948Z",
      "span_id": "r",
      "metadata": {
        "agent": {
          "description": "Screens payments for fraud before they settle. Runback demo agent: real model calls and real policy decisions; its tools act on a sandbox of synthetic customers, orders and accounts.",
          "systemOfRecord": "Runback demo sandbox (synthetic data)"
        },
        "model": "claude-haiku-4-5",
        "demo_agent": true,
        "est_cost_usd": 0.004324,
        "sandbox_tools": true,
        "scenario_seed": "fraud-screening-agent:2026-11-07:23"
      },
      "ts_start": "2026-11-07T04:10:56.242Z",
      "parent_span_id": null,
      "schema_version": 1,
      "_hash": "712cad081bdc4efcff1747d82550d4d4694d99353a8cc0fd2604c0cbe4f08068"
    },
    {
      "seq": 1,
      "type": "llm",
      "error": null,
      "model": {
        "model_id": "claude-haiku-4-5",
        "provider": "anthropic"
      },
      "usage": {
        "input_tokens": 861,
        "total_tokens": 942,
        "output_tokens": 81
      },
      "run_id": "sbx-fraud-screening-d62d4df92246",
      "ts_end": "2026-11-07T04:10:57.433Z",
      "request": {
        "tools": [
          {
            "name": "get_risk_signals",
            "parameters": {
              "type": "object",
              "required": [
                "payment_id"
              ],
              "properties": {
                "payment_id": {
                  "type": "string",
                  "description": "Payment id"
                }
              },
              "additionalProperties": false
            },
            "description": "Risk signals for a payment."
          },
          {
            "name": "hold_payment",
            "parameters": {
              "type": "object",
              "required": [
                "payment_id",
                "reason"
              ],
              "properties": {
                "reason": {
                  "type": "string",
                  "description": "Why"
                },
                "payment_id": {
                  "type": "string",
                  "description": "Payment id"
                }
              },
              "additionalProperties": false
            },
            "description": "Hold a payment for review."
          },
          {
            "name": "release_payment",
            "parameters": {
              "type": "object",
              "required": [
                "payment_id"
              ],
              "properties": {
                "payment_id": {
                  "type": "string",
                  "description": "Payment id"
                }
              },
              "additionalProperties": false
            },
            "description": "Release a payment to settle."
          }
        ],
        "params": {
          "temperature": 0,
          "max_output_tokens": 500
        },
        "system": "You are Acme's payment fraud screening agent. You are running in Runback's public demo sandbox: every customer, order, invoice and account is synthetic, and your tools act on test data only. Check the risk signals for each payment before it settles. Hold anything that looks like fraud with a reason; release the rest. Use the tools to act; when you are done, reply with a one-sentence summary of what you did.",
        "messages": [
          {
            "role": "user",
            "content": "Screen payment PAY-55397: A$585.62 from customer #3725 to Wattle Sandbox Pty Ltd."
          }
        ]
      },
      "span_id": "l1",
      "response": {
        "text": "I'll check the risk signals for this payment to determine if it should be held or released.",
        "reasoning": null,
        "tool_calls": [
          {
            "input": {
              "payment_id": "PAY-55397"
            },
            "tool_name": "get_risk_signals",
            "tool_call_id": "toolu_01UB32VPFt4Un7J4LuEJk5BQ"
          }
        ],
        "finish_reason": "tool-calls"
      },
      "ts_start": "2026-11-07T04:10:56.242Z",
      "latency_ms": 1191,
      "parent_span_id": "r",
      "schema_version": 1,
      "_hash": "cd6408085b8abe98e019d0eb15107f5dd2373dc5b85d146540ed9a4e9bb7c9ac"
    },
    {
      "seq": 2,
      "type": "tool",
      "error": null,
      "input": {
        "payment_id": "PAY-55397"
      },
      "output": {
        "new_device": true,
        "payment_id": "PAY-55397",
        "risk_score": 78,
        "geo_mismatch": false,
        "payments_last_24h": 8
      },
      "run_id": "sbx-fraud-screening-d62d4df92246",
      "ts_end": "2026-11-07T04:10:57.518Z",
      "span_id": "t1",
      "ts_start": "2026-11-07T04:10:57.434Z",
      "tool_name": "get_risk_signals",
      "latency_ms": 84,
      "tool_call_id": "toolu_01UB32VPFt4Un7J4LuEJk5BQ",
      "parent_span_id": "l1",
      "schema_version": 1,
      "_hash": "e287745f0c5f46c2e94c95f551861932b9be3ae0dcbeb4f849a6f5974d6bb6c1"
    },
    {
      "seq": 3,
      "type": "llm",
      "error": null,
      "model": {
        "model_id": "claude-haiku-4-5",
        "provider": "anthropic"
      },
      "usage": {
        "input_tokens": 993,
        "total_tokens": 1135,
        "output_tokens": 142
      },
      "run_id": "sbx-fraud-screening-d62d4df92246",
      "ts_end": "2026-11-07T04:10:59.092Z",
      "request": {
        "tools": [
          {
            "name": "get_risk_signals",
            "parameters": {
              "type": "object",
              "required": [
                "payment_id"
              ],
              "properties": {
                "payment_id": {
                  "type": "string",
                  "description": "Payment id"
                }
              },
              "additionalProperties": false
            },
            "description": "Risk signals for a payment."
          },
          {
            "name": "hold_payment",
            "parameters": {
              "type": "object",
              "required": [
                "payment_id",
                "reason"
              ],
              "properties": {
                "reason": {
                  "type": "string",
                  "description": "Why"
                },
                "payment_id": {
                  "type": "string",
                  "description": "Payment id"
                }
              },
              "additionalProperties": false
            },
            "description": "Hold a payment for review."
          },
          {
            "name": "release_payment",
            "parameters": {
              "type": "object",
              "required": [
                "payment_id"
              ],
              "properties": {
                "payment_id": {
                  "type": "string",
                  "description": "Payment id"
                }
              },
              "additionalProperties": false
            },
            "description": "Release a payment to settle."
          }
        ],
        "params": {
          "temperature": 0,
          "max_output_tokens": 500
        },
        "system": "You are Acme's payment fraud screening agent. You are running in Runback's public demo sandbox: every customer, order, invoice and account is synthetic, and your tools act on test data only. Check the risk signals for each payment before it settles. Hold anything that looks like fraud with a reason; release the rest. Use the tools to act; when you are done, reply with a one-sentence summary of what you did.",
        "messages": [
          {
            "role": "user",
            "content": "Screen payment PAY-55397: A$585.62 from customer #3725 to Wattle Sandbox Pty Ltd."
          },
          {
            "role": "assistant",
            "content": [
              {
                "text": "I'll check the risk signals for this payment to determine if it should be held or released.",
                "type": "text"
              },
              {
                "type": "tool-call",
                "input": {
                  "payment_id": "PAY-55397"
                },
                "toolName": "get_risk_signals",
                "toolCallId": "toolu_01UB32VPFt4Un7J4LuEJk5BQ"
              }
            ]
          },
          {
            "role": "tool",
            "content": [
              {
                "type": "tool-result",
                "output": {
                  "type": "json",
                  "value": {
                    "new_device": true,
                    "payment_id": "PAY-55397",
                    "risk_score": 78,
                    "geo_mismatch": false,
                    "payments_last_24h": 8
                  }
                },
                "toolName": "get_risk_signals",
                "toolCallId": "toolu_01UB32VPFt4Un7J4LuEJk5BQ"
              }
            ]
          }
        ]
      },
      "span_id": "l2",
      "response": {
        "text": "The payment shows concerning risk signals: a high risk score of 78, a new device being used, and 8 payments in the last 24 hours. I'll hold this payment for review.",
        "reasoning": null,
        "tool_calls": [
          {
            "input": {
              "reason": "High risk score (78), new device detected, and 8 payments in last 24 hours suggest potential fraud",
              "payment_id": "PAY-55397"
            },
            "tool_name": "hold_payment",
            "tool_call_id": "toolu_018stn8fdYXPZCD9VJ7XRCRm"
          }
        ],
        "finish_reason": "tool-calls"
      },
      "ts_start": "2026-11-07T04:10:57.519Z",
      "latency_ms": 1573,
      "parent_span_id": "r",
      "schema_version": 1,
      "_hash": "402d863e8d5acf6ad9bf7c94dc69b5ada87044696f53e5ba40f127ce28be0460"
    },
    {
      "seq": 4,
      "type": "tool",
      "error": null,
      "input": {
        "reason": "High risk score (78), new device detected, and 8 payments in last 24 hours suggest potential fraud",
        "payment_id": "PAY-55397"
      },
      "output": {
        "held": true,
        "sandbox": true,
        "payment_id": "PAY-55397"
      },
      "run_id": "sbx-fraud-screening-d62d4df92246",
      "ts_end": "2026-11-07T04:10:59.128Z",
      "span_id": "t2",
      "ts_start": "2026-11-07T04:10:59.092Z",
      "tool_name": "hold_payment",
      "latency_ms": 36,
      "tool_call_id": "toolu_018stn8fdYXPZCD9VJ7XRCRm",
      "parent_span_id": "l2",
      "schema_version": 1,
      "_hash": "07d0d89e7bfb32b166064aa2b382c8b56b87548c8694d0363bdf435639bfaf07"
    },
    {
      "seq": 5,
      "type": "llm",
      "error": null,
      "model": {
        "model_id": "claude-haiku-4-5",
        "provider": "anthropic"
      },
      "usage": {
        "input_tokens": 1165,
        "total_tokens": 1203,
        "output_tokens": 38
      },
      "run_id": "sbx-fraud-screening-d62d4df92246",
      "ts_end": "2026-11-07T04:10:59.948Z",
      "request": {
        "tools": [
          {
            "name": "get_risk_signals",
            "parameters": {
              "type": "object",
              "required": [
                "payment_id"
              ],
              "properties": {
                "payment_id": {
                  "type": "string",
                  "description": "Payment id"
                }
              },
              "additionalProperties": false
            },
            "description": "Risk signals for a payment."
          },
          {
            "name": "hold_payment",
            "parameters": {
              "type": "object",
              "required": [
                "payment_id",
                "reason"
              ],
              "properties": {
                "reason": {
                  "type": "string",
                  "description": "Why"
                },
                "payment_id": {
                  "type": "string",
                  "description": "Payment id"
                }
              },
              "additionalProperties": false
            },
            "description": "Hold a payment for review."
          },
          {
            "name": "release_payment",
            "parameters": {
              "type": "object",
              "required": [
                "payment_id"
              ],
              "properties": {
                "payment_id": {
                  "type": "string",
                  "description": "Payment id"
                }
              },
              "additionalProperties": false
            },
            "description": "Release a payment to settle."
          }
        ],
        "params": {
          "temperature": 0,
          "max_output_tokens": 500
        },
        "system": "You are Acme's payment fraud screening agent. You are running in Runback's public demo sandbox: every customer, order, invoice and account is synthetic, and your tools act on test data only. Check the risk signals for each payment before it settles. Hold anything that looks like fraud with a reason; release the rest. Use the tools to act; when you are done, reply with a one-sentence summary of what you did.",
        "messages": [
          {
            "role": "user",
            "content": "Screen payment PAY-55397: A$585.62 from customer #3725 to Wattle Sandbox Pty Ltd."
          },
          {
            "role": "assistant",
            "content": [
              {
                "text": "I'll check the risk signals for this payment to determine if it should be held or released.",
                "type": "text"
              },
              {
                "type": "tool-call",
                "input": {
                  "payment_id": "PAY-55397"
                },
                "toolName": "get_risk_signals",
                "toolCallId": "toolu_01UB32VPFt4Un7J4LuEJk5BQ"
              }
            ]
          },
          {
            "role": "tool",
            "content": [
              {
                "type": "tool-result",
                "output": {
                  "type": "json",
                  "value": {
                    "new_device": true,
                    "payment_id": "PAY-55397",
                    "risk_score": 78,
                    "geo_mismatch": false,
                    "payments_last_24h": 8
                  }
                },
                "toolName": "get_risk_signals",
                "toolCallId": "toolu_01UB32VPFt4Un7J4LuEJk5BQ"
              }
            ]
          },
          {
            "role": "assistant",
            "content": [
              {
                "text": "The payment shows concerning risk signals: a high risk score of 78, a new device being used, and 8 payments in the last 24 hours. I'll hold this payment for review.",
                "type": "text"
              },
              {
                "type": "tool-call",
                "input": {
                  "reason": "High risk score (78), new device detected, and 8 payments in last 24 hours suggest potential fraud",
                  "payment_id": "PAY-55397"
                },
                "toolName": "hold_payment",
                "toolCallId": "toolu_018stn8fdYXPZCD9VJ7XRCRm"
              }
            ]
          },
          {
            "role": "tool",
            "content": [
              {
                "type": "tool-result",
                "output": {
                  "type": "json",
                  "value": {
                    "held": true,
                    "sandbox": true,
                    "payment_id": "PAY-55397"
                  }
                },
                "toolName": "hold_payment",
                "toolCallId": "toolu_018stn8fdYXPZCD9VJ7XRCRm"
              }
            ]
          }
        ]
      },
      "span_id": "l3",
      "response": {
        "text": "I held payment PAY-55397 due to high risk signals including a risk score of 78, new device usage, and multiple payments within 24 hours.",
        "reasoning": null,
        "tool_calls": [],
        "finish_reason": "stop"
      },
      "ts_start": "2026-11-07T04:10:59.128Z",
      "latency_ms": 820,
      "parent_span_id": "r",
      "schema_version": 1,
      "_hash": "5f135199b23efd994c190ea5e46b458b332da7cae579cfe24fbd59164697d210"
    },
    {
      "seq": 6,
      "name": "fraud-screening-agent",
      "type": "run",
      "error": null,
      "input": null,
      "phase": "end",
      "output": {
        "summary": "I held payment PAY-55397 due to high risk signals including a risk score of 78, new device usage, and multiple payments within 24 hours."
      },
      "run_id": "sbx-fraud-screening-d62d4df92246",
      "status": "success",
      "ts_end": "2026-11-07T04:10:59.948Z",
      "span_id": "re",
      "metadata": {
        "demo_agent": true,
        "sandbox_tools": true
      },
      "ts_start": "2026-11-07T04:10:59.948Z",
      "parent_span_id": null,
      "schema_version": 1,
      "_hash": "93282cbfd8220cc459c9a835cb3f01de0367fcde6cb25c8959d0a464f33d1596"
    }
  ]
}