See exactly what an agent did

tovio log --entity agenttovio log --task-id <task-id>

Provenance is recorded on every agent commit: the token, the delegation chain, the model and its hash, the task, the authorizing human, and a hash of the initiating prompt.

Two different questions, two different flags

These are easy to conflate and they answer different things.

A commit message written by a model tells you what it claims it did. The rationale tells you how it reasoned, the run record tells you what actually passed through it, and neither can be edited afterwards to match the message.

--session renders whichever tier of run record the change carries, and labels it — so check the label before you treat one as proof. The tiers are below.

Sealed rationales and sealed run records are shown to a policy recipient and appear as a typed locked marker to everyone else — never partially, never silently omitted.

One change in full

tovio change show <chg-id> --diff

Everything under one token

tovio audit show --token <token-id>

Includes refused attempts.

The whole derivation, as a graph

tovio audit graph <chg-id>tovio audit graph task:<task-id> --format mermaid

Human, token and delegation, agent, model and tools, change, rationale and session, audit signature, parent changes, checks — assembled as one graph. See Read the whole chain with audit graph.

Down to the line

tovio blame <file> --whytovio blame <file> --session

The same two questions, at line granularity.

Three tiers, and they are not equal

Which tier a record belongs to is answerable without decoding it, because the discriminant is structural — where the address sits — rather than a flag inside the record. Every read surface labels it.

• Attested. Produced under a capability token. Proven.
• Observed. Captured from a runtime transcript. The link to the commit is proven by the field it hangs from, but the content is self-reported and explicitly unattested.
• Backfilled. The link itself is only asserted, by a named party, in a signed audit entry. It establishes who claimed the association; it does not establish that the transcript produced the change.

Do not read an observed capture as proof, and do not read a backfilled one as evidence of anything but the claim.