Trace object and sources

The host runtime reads native session ledgers written locally by each agent CLI and reconstructs one canonical object per session in your worker. This page describes the sources it reads and the object it produces.

Ingest sources

There are exactly three ingest sources, each discovered with a capture glob:

Source	Host value	Capture glob
Claude Code	claude	~/.claude/projects/**/*.jsonl
Codex	codex	${CODEX_HOME:-~/.codex}/**/*.jsonl
Claude Desktop	claude-desktop	**/audit.jsonl

A local source ledger records the byte offset already read from each file. On each collection pass, the runtime reads only the new byte ranges past that watermark, chunks them, gzip-compresses and base64-encodes each chunk, and uploads them with POST /v0/traces/batches?target=<host>. Byte ranges are contiguous and non-overlapping per source.

The canonical trace object

The worker stores one self-contained JSON document per session, at schema version 1. Its top-level fields are:

Field	Description
session	Session identity: source, session id, harness, models, and more.
lifecycle	Status and timestamps, keeping native event time separate from ingestion time.
sources	Per native file: offsets, byte and record counts, and skip counts.
rollups	Session-level rollups such as token usage.
context_artifacts	Analysis-context artifacts captured for the session.
preamble	Events before the first turn.
pending	Events not yet attached to a turn.
turns	The session’s turns, the only containment grouping.

Each event is a discriminated union with a global, monotonic seq that is never renumbered. The event kinds are:

• user_message — a user prompt, which opens a turn.
• assistant_message — assistant output.
• reasoning — a reasoning summary.
• tool_call — a tool invocation with its input.
• tool_result — a tool’s output or error.
• compaction — a compaction summary.
• session_event — session machinery.
• other — an unmodeled record, which never rejects a batch.

For which sources map to which agents, see Supported agents. For what leaves the host, see Trust and data model.