We learned to preserve facts. That discipline is called a database.
We learned to preserve intent. That discipline is called version control.
We learned to preserve computation. That discipline is called logs, traces, and spans.
We have never had a structure that preserves why an autonomous system believed something, and what to do when that belief turns out to be wrong. Sevenbox is that structure.
A library you install and run inside your own environment. Not a hosted service, and nothing you send us.
Request accessRuns with your stack_
Works underneath what you're already running.
No new framework, no rewrite. Validated against 14 real agent frameworks, plus the case of running none at all.
Logos are trademarks of their respective owners.
_
Gap_
Every format you already use answers a different question.
An agent decides something (issue a refund, approve a loan, escalate a case) based on claims that might be wrong, produced by a model that isn't infallible. None of the formats built to record what agents do were built to record whether the record is still believed.
Log lines
Record that something happened, and when. No required relationship to any other line beyond adjacency in a stream.
Traces & spans
Record call structure: which operation invoked which. Not justification structure: which prior claim a decision actually depended on.
Audit logs
Record the action taken. Not the chain of claims that made the action warranted, or how to tell if that chain is still valid.
Chain-of-thought
Not schema-validated, not individually addressable. A production process, not a claim: nothing downstream can hold it as a dependency.
None of them can represent a single, structural fact: this claim was believed, is now retracted, and here is exactly what still needs to be undone because of it.
This is also not what observability dashboards capture. Tools like LangSmith, Arize Phoenix, and W&B Weave record call structure (which span called which), not justification structure: which prior claim a decision actually depended on. And it's not what governance or monitoring platforms like Fiddler AI or Arthur AI capture either: those watch a model fleet from the outside. This is the causal-justification calculus underneath a single decision.
Measurement_
The Warrant: an atomic, revisable, causally grounded claim.
A Warrant isn't a workflow step or a graph node. It's a record of one claim, the specific prior claims it was justified by, and whether acting on it can be undone. Every decision an agent makes becomes one.
A fraud check arrives after the refund already went out. It doesn't touch the refund Warrant directly. It supersedes the eligibility claim the refund was built on. Sevenbox finds the obligation this creates by walking the causal chain, not by anyone remembering to check.
- id
- A hash of the claim's content, its causal parents, and where it came from, computed once and never assigned. Two agents reaching the identical conclusion from identical evidence produce the identical Warrant.
- parent_ids
- The specific prior claims this one was justified by, never empty unless this is a starting fact. "Why did the system believe this" is answered by walking this chain, not by grepping logs.
- reversibility
- Pure, compensable, or irreversible, fixed at construction. The structural difference between printing a number and moving money.
- supersedes_id
- How a belief gets formally retracted, without ever mutating the record it replaces. Old and new both stay in the history.
Why this isn't just better logging_
Formal specification.
Sevenbox is a small set of axioms, a handful of theorems proved from them, and a reference implementation checked against both, adversarially, in the style of a systems-conference program committee, not just tested for the happy path. The full specification is shared with every team once they're evaluating Sevenbox directly; what follows is its substance, not a marketing summary of it.
An earlier draft of this specification proposed a fourth axiom: epistemic typing. An adversarial review, checking every theorem against every axiom it claimed to need, found that none of them actually used it. It's recorded below as a negative result and demoted, not quietly dropped. That's the actual bar every axiom that follows had to clear.
The axioms
Content addressing
A Warrant's id is a pure function of its content, its parents, and its source, computed once and never reassigned. Identity is never a matter of what an agent happened to name something.
Causal grounding
Every non-starting Warrant has at least one explicit parent. Nothing enters the record ungrounded.
Supersession coherence
A Warrant can only formally retract something it has actual causal contact with, never an unbounded claim over the whole history.
Reversibility typing
Fixed at construction, load-bearing in every proof about compensation. What makes "we owe someone something" mechanically discoverable instead of a matter of memory.
The oracle/effect boundary
Every source of non-determinism (a model, a tool, a human, a clock, a random draw) crosses into the record through exactly one captured boundary. Nothing downstream introduces more. This single property is what makes deterministic replay possible at all.
Epistemic typing
proposed, not adoptedThe one axiom this project floated and then retracted, on its own evidence (see above).
What follows from them
The causal order can't loop back on itself.
A Warrant's id depends on its parents already existing. Construction order is itself a witness to a topological order. A cycle would require something to be constructed before itself.
The result doesn't depend on evaluation order.
Any two valid orderings of the same derivations, over the same captured evidence, produce the exact same set of Warrants: the same guarantee that gives confluence to Merkle-DAG content stores generally.
Two agents converging on the same claim produce one record, not two.
Identical content, parents, and source collapse to the identical id: a one-line consequence of content addressing, made structural rather than a deduplication pass bolted on after.
What can be undone and what can't are never confused.
Pure and compensable Warrants can be corrected in place; irreversible ones can only ever accrue an obligation. This asymmetry is what keeps "we changed our mind" and "we owe someone an apology" from collapsing into the same case.
No axiom above is claimed as a new computational primitive. Every individual piece has real precedent: non-monotonic revision from truth-maintenance systems, compensable transactions from Sagas, content addressing from Git and Datomic. Sevenbox's contribution is the specific combination of all three, unified around one explicit, captured boundary for non-determinism, verified against a reference implementation, not asserted in a document.
Adversarial validation.
A test suite that has to stay green after every integration above, checked against the calculus's own axioms.
A real bug this process found_
Because a Warrant's identity never depends on whether its evidence was redacted, a redacted and an unredacted capture of the same call could collide to the same id, and depending on which one landed first, a later writer's explicit redaction could be silently discarded, leaving sensitive data exposed as a function of insertion order, not anyone's intent.
Fixed: redaction is now sticky. A redacted version always wins, regardless of order, with a permanent regression test that proves it stays that way.
Positioning_
Frequently asked questions.
Is this the same as LangSmith, Arize Phoenix, or W&B Weave?
No. See "Gap" above for the full distinction. Nothing in any of them lets one recorded step formally supersede an earlier one, derives an entry's identity from its content, or carries a reversibility/compensation algebra. They're real, deployed prior art for capturing a model call's prompt/response boundary, and good at it, just not this.
Compare to: LangSmith · Arize Phoenix · W&B Weave
Is this like Fiddler AI or Arthur AI?
No. See "Gap" above. Sevenbox isn't a platform you point at a model fleet; it's the causal-justification calculus underneath one decision, closer to a data structure and a runtime for that structure than to a monitoring product.
Compare to: Fiddler AI · Arthur AI
Is this a policy or guardrails layer, like Microsoft's Agent Governance Toolkit or Vendo?
No. Those act before an action happens: intercept, evaluate against a policy, allow or block. Sevenbox acts during and after: it records the justification an action was actually taken on, classifies whether that action can be undone, and, if the justification is later found wrong, surfaces exactly what still needs compensating. A guardrail stops what it was told to anticipate. Sevenbox is what's left when something wasn't.
Compare to: Microsoft Agent Governance Toolkit · Vendo
Do I need to change my agent framework to use this?
No. The calculus never assumes a particular agent runtime, and that's validated, not just claimed: against 14 real frameworks plus the case of no framework at all, where a plain Python agent loop uses Sevenbox's own decorators directly. That last case needed zero lines of adapter code, which is itself evidence the core abstraction doesn't lean on any one framework's shape to work.
Can I read the formal specification?
Not publicly yet. Sevenbox is in private evaluation. The full specification (axioms, proofs, the complete cross-framework validation record) exists and is finished; it's shared directly with teams once they're evaluating Sevenbox, not published in advance of that.
Is this a hosted service?
No. Sevenbox is a library: you install it and it runs inside your own environment, next to your own agents, writing to storage you control. No decision your agents make is sent anywhere, because there's no Sevenbox-hosted backend in the loop to send it to.