Tracekit Agent Audit and Policy Guard

The repository describes a separate signer, per-call policy checks, and human approvals bound to exact arguments and consumed once, alongside deployment permissions and capture boundaries. This supports strong least-privilege and confirmation design, but the README's quick start defaults to a same-user dev signer, which the docs say an agent can reach along with its key. Arguments are recorded as commitments; the docs disclose that timing, sizes, and counts still leak, and redaction is pattern-based, so sensitive-data handling is explained but incomplete. Dependencies have lower bounds and optional extras; CI pins action revisions, scans the container for high and critical issues, and release provenance is described. No dependency lock or audit result is in the supplied material, so dependency security is only partly established. Policy checks and approvals gate calls, but allowed calls can have external effects, text matching can be evaded, and protection depends on using the capture path. Witnesses can detect rollback, with explicit limitations when none is configured; general recovery evidence is thin. A private vulnerability channel and disclosure timeline are documented, but publisher identity is unverified, so source attribution rests only on repository claims.

The README, security model, and security policy agree on integrity, capture coverage, operator power, and limitations without witnesses. CI describes a broad test process, but this assessment did not execute it. Dependencies are broad; core dependencies have some fallback notes, but installing RE2 may require a source build when no wheel exists, so availability is not fully established. Refusal responses, verification failures, and viewer errors have concrete behavior described, but the supplied material does not establish consistent actionable diagnostics for every failure case.

The material addresses developers, auditors, server deployments, and multiple agent frameworks, and distinguishes stable from experimental integrations. It states which actions may escape capture and what the record cannot prove. Applicability is limited by text and tool-name matching and by varying integration maturity, so trigger precision and environment fit receive partial scores; for example, Codex hooks are experimental and system-mode platform support is limited.

The README has clear sections for quick start, capabilities, limits, evidence, deployment, and contribution, with install commands, examples, FAQ links, and explicit limitations. The MIT license file matches package metadata. Package and command names are clear, but the Python distribution name conflicts with an unrelated PyPI `tracekit`, and support tiers coexist with multiple version lines, reducing naming stability. SECURITY.md describes supported versions and a fix path, but the supplied material does not include the full changelog, leaving version history only partly evidenced. Vulnerability reporting is specified, while maintenance responsibility is represented by project and author fields whose publisher identity is unverified.

The signed chain, offline verification, policy decisions, and approval records produce a usable `.tkb` evidence file; the docs include CLI output and review boundaries. Combining record integrity with call control offers clear value. However, text rules can miss rewritten commands, actions outside the capture path are not blocked, and stronger assurance requires separately deploying a signer and witnesses, so the cost-benefit case is not complete for every use.

The README is supported by specific experiment IDs, test names, configuration examples, and limitations in the security model, checklist, integration docs, and CI configuration. These sources corroborate one another within the project but are not independent external validation, and the threat models have not been externally reviewed. The docs distinguish recorded facts, product claims, experiment results, and what cannot be inferred, and disclose synthetic test sets and sample-size limits.