{
  "$schema": "runback.audit/v2",
  "manifest": {
    "run_id": "sbx-research-2e1884ffab41",
    "generated_at": "2026-11-07T07:43:52.554Z",
    "event_count": 5,
    "algorithm": "sha256-chain",
    "content_digest": "d09773c037dfa4baa6588a694b0a07baa66faca6a5eb662b44ad9799bac5e830",
    "replay": {
      "cassette_digest": "e38a3d923e319e03205988b7db02077be09da890d251efdfe9afc8ccaa20d025",
      "entry_count": 3,
      "algorithm": "oracle-chain/sha256",
      "note": "The run's oracle stream — every model response and tool output, hash-chained. Re-execute the agent against `events` with @runback/replay and the cassette digest must reproduce. This is proof the recording IS the deterministic input stream of the run — an audit you can re-run, not just read."
    },
    "signed": true,
    "signature": {
      "alg": "Ed25519",
      "value": "4fb8bc96927257e5e2850147e7a2176f7ad84ca5c7584c090d2ef369584234173706c41695c04505b1baa5414bcf130afa1216c861ddf21ebbbcf298e566ea07",
      "pubkey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEArDPmR+Gvu1HawnSvM6xjZao7BVPPQ80Qq3sa1hAYvDU=\n-----END PUBLIC KEY-----\n"
    },
    "verify": "Recompute the event chain h_i = SHA-256(h_{i-1} + canonical(event_i)) over `events` → must equal content_digest. Recompute the oracle-stream digest from `events` → must equal replay.cassette_digest. The signature covers `${content_digest}:${cassette_digest}`. Ed25519: verify with the public key embedded in manifest.signature.pubkey (no server key needed — fully offline-verifiable). HMAC-SHA256 (legacy): requires AUDIT_SIGNING_KEY. POST this record to /api/audit/verify.",
    "spec_url": "https://runback.dev/spec",
    "verifier_url": "https://runback.dev/verify"
  },
  "run": {
    "run_id": "sbx-research-2e1884ffab41",
    "name": "research-agent",
    "status": "success",
    "input": "Summarise this week's trend in login failures and whether it needs attention.",
    "output": {
      "summary": "This week's trend in login failures shows a fluctuating pattern with counts of 34, 56, 65, 61, 66, 44, and 53 failures over the last seven days. The peak occurred on the fifth day with 66 failures. Given the variability and the relatively high peak, this trend may warrant attention."
    },
    "error": null,
    "metadata": {
      "agent": {
        "description": "Summarises incident and market trends. Runback demo agent: real model calls and real policy decisions; its tools act on a sandbox of synthetic customers, orders and accounts.",
        "systemOfRecord": "Runback demo sandbox (synthetic data)"
      },
      "model": "gpt-4o-mini",
      "demo_agent": true,
      "est_cost_usd": 0.00012,
      "sandbox_tools": true,
      "scenario_seed": "research-agent:2026-11-07:37"
    },
    "step_count": 2,
    "total_tokens": 521,
    "started_at": "2026-11-07T06:11:13.078+00:00",
    "ended_at": "2026-11-07T06:11:17.119+00:00",
    "actor_type": null,
    "actor_id": null
  },
  "events": [
    {
      "seq": 0,
      "name": "research-agent",
      "type": "run",
      "error": null,
      "input": "Summarise this week's trend in login failures and whether it needs attention.",
      "phase": "start",
      "output": null,
      "run_id": "sbx-research-2e1884ffab41",
      "status": "running",
      "ts_end": "2026-11-07T06:11:17.119Z",
      "span_id": "r",
      "metadata": {
        "agent": {
          "description": "Summarises incident and market trends. Runback demo agent: real model calls and real policy decisions; its tools act on a sandbox of synthetic customers, orders and accounts.",
          "systemOfRecord": "Runback demo sandbox (synthetic data)"
        },
        "model": "gpt-4o-mini",
        "demo_agent": true,
        "est_cost_usd": 0.00012,
        "sandbox_tools": true,
        "scenario_seed": "research-agent:2026-11-07:37"
      },
      "ts_start": "2026-11-07T06:11:13.078Z",
      "parent_span_id": null,
      "schema_version": 1,
      "_hash": "e25d409b968d2eb9ce2338bc44ca5b784939c2ec7e2fba4d74405d86193108bd"
    },
    {
      "seq": 1,
      "type": "llm",
      "error": null,
      "model": {
        "model_id": "gpt-4o-mini",
        "provider": "openai"
      },
      "usage": {
        "input_tokens": 186,
        "total_tokens": 207,
        "output_tokens": 21
      },
      "run_id": "sbx-research-2e1884ffab41",
      "ts_end": "2026-11-07T06:11:14.535Z",
      "request": {
        "tools": [
          {
            "name": "search_incidents",
            "parameters": {
              "type": "object",
              "required": [
                "query",
                "days"
              ],
              "properties": {
                "days": {
                  "type": "number",
                  "description": "Look-back window in days"
                },
                "query": {
                  "type": "string",
                  "description": "Search terms"
                }
              },
              "additionalProperties": false
            },
            "description": "Search the incident log."
          },
          {
            "name": "get_metric",
            "parameters": {
              "type": "object",
              "required": [
                "name",
                "days"
              ],
              "properties": {
                "days": {
                  "type": "number",
                  "description": "Days"
                },
                "name": {
                  "type": "string",
                  "description": "Metric name"
                }
              },
              "additionalProperties": false
            },
            "description": "Get a daily metric series."
          }
        ],
        "params": {
          "temperature": 0,
          "max_output_tokens": 500
        },
        "system": "You are Acme's operations research agent. You are running in Runback's public demo sandbox: every customer, order, invoice and account is synthetic, and your tools act on test data only. Answer with a short, factual summary grounded only in what the tools return. Say plainly when the data is thin. Use the tools to act; when you are done, reply with a one-sentence summary of what you did.",
        "messages": [
          {
            "role": "user",
            "content": "Summarise this week's trend in login failures and whether it needs attention."
          }
        ]
      },
      "span_id": "l1",
      "response": {
        "text": null,
        "reasoning": null,
        "tool_calls": [
          {
            "input": {
              "days": 7,
              "name": "login_failures"
            },
            "tool_name": "get_metric",
            "tool_call_id": "call_VccMuocXiU3J4wcRZpJT0iz5"
          }
        ],
        "finish_reason": "tool-calls"
      },
      "ts_start": "2026-11-07T06:11:13.078Z",
      "latency_ms": 1457,
      "parent_span_id": "r",
      "schema_version": 1,
      "_hash": "e0135a9fee5c03e077eae9369601f870038541adbb294db060769a380f4f6121"
    },
    {
      "seq": 2,
      "type": "tool",
      "error": null,
      "input": {
        "days": 7,
        "name": "login_failures"
      },
      "output": {
        "name": "login_failures",
        "unit": "count/day",
        "last_7_days": [
          34,
          56,
          65,
          61,
          66,
          44,
          53
        ]
      },
      "run_id": "sbx-research-2e1884ffab41",
      "ts_end": "2026-11-07T06:11:14.558Z",
      "span_id": "t1",
      "ts_start": "2026-11-07T06:11:14.535Z",
      "tool_name": "get_metric",
      "latency_ms": 23,
      "tool_call_id": "call_VccMuocXiU3J4wcRZpJT0iz5",
      "parent_span_id": "l1",
      "schema_version": 1,
      "_hash": "d4722a694b923724489fad66139ddbea01b21fe9ae4e9782f0c531a5e4561087"
    },
    {
      "seq": 3,
      "type": "llm",
      "error": null,
      "model": {
        "model_id": "gpt-4o-mini",
        "provider": "openai"
      },
      "usage": {
        "input_tokens": 243,
        "total_tokens": 314,
        "output_tokens": 71
      },
      "run_id": "sbx-research-2e1884ffab41",
      "ts_end": "2026-11-07T06:11:17.119Z",
      "request": {
        "tools": [
          {
            "name": "search_incidents",
            "parameters": {
              "type": "object",
              "required": [
                "query",
                "days"
              ],
              "properties": {
                "days": {
                  "type": "number",
                  "description": "Look-back window in days"
                },
                "query": {
                  "type": "string",
                  "description": "Search terms"
                }
              },
              "additionalProperties": false
            },
            "description": "Search the incident log."
          },
          {
            "name": "get_metric",
            "parameters": {
              "type": "object",
              "required": [
                "name",
                "days"
              ],
              "properties": {
                "days": {
                  "type": "number",
                  "description": "Days"
                },
                "name": {
                  "type": "string",
                  "description": "Metric name"
                }
              },
              "additionalProperties": false
            },
            "description": "Get a daily metric series."
          }
        ],
        "params": {
          "temperature": 0,
          "max_output_tokens": 500
        },
        "system": "You are Acme's operations research agent. You are running in Runback's public demo sandbox: every customer, order, invoice and account is synthetic, and your tools act on test data only. Answer with a short, factual summary grounded only in what the tools return. Say plainly when the data is thin. Use the tools to act; when you are done, reply with a one-sentence summary of what you did.",
        "messages": [
          {
            "role": "user",
            "content": "Summarise this week's trend in login failures and whether it needs attention."
          },
          {
            "role": "assistant",
            "content": [
              {
                "type": "tool-call",
                "input": {
                  "days": 7,
                  "name": "login_failures"
                },
                "toolName": "get_metric",
                "toolCallId": "call_VccMuocXiU3J4wcRZpJT0iz5"
              }
            ]
          },
          {
            "role": "tool",
            "content": [
              {
                "type": "tool-result",
                "output": {
                  "type": "json",
                  "value": {
                    "name": "login_failures",
                    "unit": "count/day",
                    "last_7_days": [
                      34,
                      56,
                      65,
                      61,
                      66,
                      44,
                      53
                    ]
                  }
                },
                "toolName": "get_metric",
                "toolCallId": "call_VccMuocXiU3J4wcRZpJT0iz5"
              }
            ]
          }
        ]
      },
      "span_id": "l2",
      "response": {
        "text": "This week's trend in login failures shows a fluctuating pattern with counts of 34, 56, 65, 61, 66, 44, and 53 failures over the last seven days. The peak occurred on the fifth day with 66 failures. Given the variability and the relatively high peak, this trend may warrant attention.",
        "reasoning": null,
        "tool_calls": [],
        "finish_reason": "stop"
      },
      "ts_start": "2026-11-07T06:11:14.558Z",
      "latency_ms": 2561,
      "parent_span_id": "r",
      "schema_version": 1,
      "_hash": "10b19ef2bd8ddbbee64a4aa2332eee4639a517cff1a0305db5055da66cdd436c"
    },
    {
      "seq": 4,
      "name": "research-agent",
      "type": "run",
      "error": null,
      "input": null,
      "phase": "end",
      "output": {
        "summary": "This week's trend in login failures shows a fluctuating pattern with counts of 34, 56, 65, 61, 66, 44, and 53 failures over the last seven days. The peak occurred on the fifth day with 66 failures. Given the variability and the relatively high peak, this trend may warrant attention."
      },
      "run_id": "sbx-research-2e1884ffab41",
      "status": "success",
      "ts_end": "2026-11-07T06:11:17.119Z",
      "span_id": "re",
      "metadata": {
        "demo_agent": true,
        "sandbox_tools": true
      },
      "ts_start": "2026-11-07T06:11:17.119Z",
      "parent_span_id": null,
      "schema_version": 1,
      "_hash": "d09773c037dfa4baa6588a694b0a07baa66faca6a5eb662b44ad9799bac5e830"
    }
  ]
}