The platform
One spine. Twenty-two surfaces. ~24 engines.
Agent runs land as OpenTelemetry spans on one immutable, replayable spine. Everything derived — trace trees, cost rollups, eval scores, effective permissions — is computed above it. Below: the architecture, what each band of surfaces actually does, one hard proof detail per band, and the REST and SDK surface that drives it all.
First-party beta — every surface runs end-to-end on the seeded spine; bring your own traffic via SDK / OTLP. The same interfaces swap in real ClickHouse, Vault, and friends.
Emitters feed ingest. Ingest writes the spine. Engines read it. You watch it.
One schema (spine-schema) generates both the ClickHouse DDL and the Zod types the whole platform reads — and a CI drift-check fails the build if they diverge. The store holds raw entities only; observe, eval, fix, and govern are one loop computed above them, not seven tools stitched together.
Twenty-two surfaces, five bands, one login — every one a reader of the same spine.
Traces · Observe · Gateway
Traces, Observe, Gateway
Proof: faithful replay reconstructs any run to any offset — same spans, same tool results, same verdicts.
- Span waterfalls with cost, tokens, and latency per node
- Debug copilot — ranked RCA taxonomy and fix suggestions from any trace
- Classic-ML XAI monitor, source→sink taint paths, and live trace streaming
- OpenAI-compatible gateway: routing, MCP reputation catalog, batch/passthrough — every call lands as a span
Evals · Loop · Verify · Copilot · Authoring
Evals, Loop, Verify, Copilot, Authoring
Proof: the CI gate runs a Welch's t-test (continuous) or two-proportion z-test (pass/fail) against a trailing baseline — regressions block the merge.
- Composable scorers — builtin, code, external, LLM-judge — plus review insights and GitHub prompt sync
- The Loop: real-LLM-grounded incident diagnosis, faithful replay, a minted regression eval, a CI gate, and packaged auto-improve (scorer + dataset + prompt)
- Verify — CycloneDX SBOM with Ed25519 DSSE / in-toto SLSA provenance signing, dependency risk, sandbox detonation, and a model-weight scan that reconstructs base → fine-tune → artifact genealogy with provenance
- Copilot debug/eval/loop tools; an Authoring reactflow graph canvas with NL→graph where blueprints save and persist (durable agent-graph registry) before running on the workflow engine
Govern · Compliance · Security · Firewall · Discovery · Platform
Govern, Compliance, Security, Firewall, Discovery, Platform
Proof: SBOM provenance is Ed25519-signed via a real DSSE pre-authentication encoding over an in-toto Statement — verifiable offline, not a no-op double.
- Approval inbox, policy simulation, durable OAuth authorization-server (dynamic client registration), visual auth-flow builder, secretless mint preview
- Red-team campaigns scored by a learned attack-success judge, signed Trust-Score export (`taksham trust verify`), recon deploy diff, hardening remediator
- Supply-chain signing: real Ed25519 DSSE envelopes + in-toto SLSA provenance over the SBOM — a genuine signature, verified, not a placeholder
- /v1/guard drop-in over the hot-path checkpoint — a learned injection student on by default, plus an inline sub-50 ms detector tier with a deterministic latency-budget degradation ladder
- Compliance: EU AI Act risk-tiering, ISO 42001 controls, a bias / fairness audit (NYC LL144-style four-fifths impact-ratio test), and a shadow-AI inventory
- Agentless discovery: identity-graph perm→data blast-radius, knowledge-DLP oversharing simulator, browser-ext shadow-AI, 101+ static posture rules
- Runtime data-plane taps that read Cilium Tetragon's and Falco's own JSON event streams onto the spine — real kernel-derived exec / egress / file-access rows, with the probe, its policies and the tap credential supplied by your cluster
Runtime · Optimize · Memory · Data
Runtime, Optimize, Memory, Data
Proof: workflow replay is deterministic — re-run a durable execution from history and it yields the same command sequence.
- Durable workflows: signals, flow-control primitives (throttle, debounce, priority, concurrency), Nexus preview, JSON workflow interpreter, virtual objects
- Sandbox depth — declarative image builder, warm pool, session recorder→spine, GPU connector catalog (BYO), and a microVM driver that boots a guest kernel + rootfs (records isolation metadata, never silently falls back to in-process; a real Firecracker/Kata boot is the operator-run proof)
- Optimize — live router leaderboard, custom quality predictors, MIPRO/feedback improvement loops
- Memory — episodic + semantic recall, criteria retrieval, temporal KG with every hit auditable
Browser · Train · Voice · Swarm
Browser, Train, Voice, Swarm
Proof: Swarm topology is computed from typed spine columns, so per-agent cost and blast radius reconcile to the same rows you query.
- Browser — computer-use act/extract/observe with self-healing actions and DOM record-and-replay
- Train — Gymnasium-style RL environments (reset / step / reward) with trajectory export off the spine
- Voice — realtime ASR→LLM→TTS agents with WER/CER, latency, and barge-in budgets
- Swarm — multi-agent call-graph topology on typed spine columns: per-agent cost and blast radius
We built the parts a rented stack can't replay.
The incident → replay → regression loop only works if you own the workflow engine, the identity layer, the gateway, and the spine — because you cannot faithfully replay a run you don't control. So we built them, first-party. We integrate model APIs, browser/OS drivers, and the database substrate; the rest is Taksham code reading Taksham data.
Durable workflow engine
Temporal-equivalent, event-sourced, replay-safe. Workflows issue commands through a durable context; state is a fold over an append-only history, so a recorded run re-issues an identical command sequence. A determinism checker catches any workflow that touches the wall clock.
Agent identity & authz
Every agent is a Principal delegated by a human, with a full delegation chain, scoped expiring credentials, one-click revoke, and deny-wins ReBAC. "Who let it do that, and on whose authority?" is a row, not a guess.
LLM gateway
OpenAI-compatible proxy: virtual keys (scope / rate / budget computed from the raw spend ledger), complexity-based routing with a fallback cascade, and an exact/semantic cache. Every proxied call emits one span to the spine.
The spine itself
spine-schema is the single source of truth — it generates the ClickHouse DDL and the Zod types, enforced by a CI drift-check. Spans, decisions, and embeddings land append-only; everything derived is computed above raw entities.
Already emitting traces? Point them at the spine.
You don't rip out your tracing to try Taksham. It's OpenTelemetry-native and speaks the tracing envelopes the popular SDKs already emit — point your existing instrumentation's host or endpoint at the spine and your traffic lands here unchanged, now on one replayable substrate alongside gateway, firewall, eval, and cost rows. Coexist first; adopt the loop when you're ready. The adapters are first-party — no third-party SDK dependency, and any read key authorizes the import only, never the spine.
OpenTelemetry / OTLP
Any OTLP / OpenInference emitter lands straight on the spine — each generation gets the same typed model / token / cost / kind columns as a native span. No code change, no vendor lock.
OTEL_EXPORTER_OTLP_ENDPOINT=<taksham-url>Tracing-SDK drop-in
Adapters accept the common tracing envelopes (trace / observation / score events, run create / batch / patch) and normalize run type → kind, parent → parent, usage → tokens onto the spine. Repoint the host and your traces flow in unchanged.
<your SDK host> → <taksham-url>Import + Connect UI
A one-time historical importer pages your current tool's public read API through the same adapters to backfill history, with a dry-run preview count first — driven from a Connect Stack panel in settings.
Settings → Connect StackImported and live-ingested spans run the full ingest pipeline — PII scrubbed, large payloads offloaded — so they're queryable next to everything else on the spine. Coexistence is the default; the import is additive; you keep your existing instrumentation the whole time.
The surface that closes the gap — and reaches past it.
We swept ~139 funded companies in observability, gateways, evals, agent security, runtime, memory, and supply chain, and feature-diffed 100+. These are capabilities shipped recently to match — and move past — their roadmaps, each first-party on the one spine. The gap-closure plan commits per competitor to parity today, their likely two-year surface, and a spine-native leapfrog.
Loop auto-improve + real-LLM diagnosis
One click from an incident: a real-LLM-grounded diagnosis of the trace, proposed scorer + dataset + prompt fixes, and a statistical regression gate on promotion — on the same stack whether you run managed Cloud or self-host.
Debug copilot
Packaged debug-my-agent flow: ranked RCA taxonomy, fix suggestions, and deep-links from traces, loop, and MCP — wired to the same spine rows you query.
Durable agent-graph authoring
A reactflow canvas (draggable nodes, conditional edges, NL→graph) where blueprints save and persist to a durable agent-graph registry, then run on the workflow engine — a LangGraph/Vellum-class authoring surface, first-party.
OAuth AS + auth flows
Dynamic client registration, durable OAuth/MCP authorization-server mode, and a visual auth-flow builder with 50+ templates — Stytch/Descope-class surface, first-party.
DSSE / in-toto SLSA signing
SBOM provenance is Ed25519-signed through a real DSSE pre-authentication encoding over an in-toto Statement — verifiable offline, no proof-runtime dependency, not a no-op double.
A2A protobuf wire
The A2A gRPC binding crosses a first-party protobuf codec — base-128 varints and length-delimited frames over Node built-ins, no proto-runtime dependency — plus task push-notification config.
microVM guest-kernel isolation
A sandbox driver that boots a guest kernel + rootfs over a Firecracker/Kata/gVisor CLI, records isolation metadata, and never silently falls back to in-process — the live KVM boot + guest-escape test is the operator-run proof.
Inline firewall tier
A sub-50 ms detector tier on 100% of traffic with a deterministic latency-budget degradation ladder (FULL → REDUCED → FAST_PATH → BYPASS) that sheds cost in named, recorded steps and never reads the wall clock — published latency is GPU-proof-gated.
Router intelligence
Live benchmark leaderboard with endpoint probing plus custom-router onboarding — Unify/Not Diamond parity on your own gateway.
Discovery + identity graph
Cross-estate perm→data edges, blast-radius viz, asset crawl catalog, browser-ext shadow-AI intake, and 101+ static posture rules — live-tenant proof is operator-run, connectors are real code.
Eval depth (E51–E56)
Spreadsheet IDE, review insights, distribution-gate experiments, sketch ingest, live trace panel, and feedback→prompt improvement — all on the spine.
/v1/guard drop-in
A Lakera-compatible guard endpoint over the same checkpoint the hot path uses — point an existing integration at it unchanged.
Learned-model defaults
Injection firewall, eval inline-judge, the red-team attack-success judge, and memory recall all default to real learned students (the memory embedder is auto-fetched from Hugging Face on first use when network egress allows) — heuristics are the floor; an operator ONNX/transformer is a drop-in upgrade, never required.
Knowledge-layer DLP
Need-to-know access modeling plus an oversharing simulation over the spine — a Knostic-class knowledge-DLP surface, first-party.
Kernel-sensor taps (Tetragon / Falco)
First-party adapters over the JSON event streams Cilium Tetragon and Falco already produce — process exec, egress connect/sendmsg, file access — mapped field-for-field onto the runtime sensor contract, so kernel-derived rows land on the same spine every other surface reads. An operator already running either tool points an adapter at their stream and the telemetry is real with no code change. To be exact about the boundary: we consume a kernel sensor's output, we are not ourselves an eBPF probe — we ship no BPF object and load nothing into any kernel. The cluster supplies the probe, the Tetragon TracingPolicy CRDs / Falco rules that make egress events exist at all, the tap credential, and Falco's k8smeta plugin for namespace/pod enrichment. No HTTP-level call is ever reconstructed from a TCP connect. The older modelled sidecar sensor is still shipped, and still labelled a stub.
Every surface runs on the seeded stack. Certification proves it against real peers.
The platform is architecture-complete and runs end-to-end on an embedded, seeded stack — the same interfaces swap in real ClickHouse, Vault, and the rest. We track two distinct axes, each with its own denominator. Feature-surface parity is 77% (58 of the 75 in-scope parity rows ship a first-party implementation; 17 partial, 0 missing — every weak row is proof-gated, not absent). Separately, a parity-matrix CI check holds an anti-mock acceptance bar (it verifies a committed, non-smoke proof fixture from an operator run exists): a capability counts as done only when it's proven against a live peer, not a mock — and that floor is 11 of 25: a trained detector-SLM, a real white-box GCG attack, an on-device RL loop, a standalone ONNX serving-latency cert for the detector-SLM artifact (measured under 100ms on an Apple M1 Max CPU; not wired into the gateway and not a default tier), and a polyglot Python/Go worker replay (an INTEGRATION proof) are now proven on real hardware — an Apple-silicon GPU (Metal / MPS), at a small, honest scale that proves the mechanism, not a frontier model. What still hasn't flipped is now external-only: it needs Linux/KVM (Firecracker, eBPF) or live credentials (cloud tenants, SSO, Stripe, telephony) — things a macOS/ARM build host can't provide. We never present a proof-gated capability as proven.
Proven today — 11 of 25
ClickHouse, Vault, and S3/MinIO substrates; a real learned memory embedder beating the heuristic (recall@1 0.00→0.71 on a 14-query hand-authored set; on public LoCoMo the embedder does not lift retrieval — recall@1 13.6→8.3); an operator-provisioned DeBERTa injection classifier (F1 0.286→0.947 on n=33 hand-authored prompts; the shipped default is a learned logistic student); live SMTP delivery; standalone ONNX serving latency of the detector-SLM artifact, p99 4.6 ms on an Apple M1 Max CPU (not wired into the gateway; not a default tier; latency is hardware-dependent); and a polyglot Python/Go worker executing inside a TS workflow, replayed from history (an INTEGRATION proof, proven when the Python/Go toolchain is present) — each backed by a committed proof fixture from an operator run; live certs skip in CI, and CI guards against regressions.
New: proven on a real GPU
Three certs just flipped on an Apple-silicon GPU (Metal / MPS): a trained transformer detector-SLM beats an early logistic baseline on a small held-out split (F1 0.92 vs 0.82 — vs the retired v1 73-row logistic student on n=16; out of sample the transformer scores 0.494/0.580 vs the shipped student's 0.843/0.904, so it is not the default) and round-trips through ONNX; a real white-box GCG attack drives an open model (distilgpt2) to a benign target (loss 4.32→0.07); on-device PPO learns CartPole (×7 over random). Small-scale mechanism proofs — not a frontier model or a prod-aligned jailbreak.
External: Linux / KVM
Micro-VM isolation (Firecracker/Kata boot + guest-escape negative test) and the eBPF probe itself need a Linux/KVM host — they can't run on macOS/ARM. Code + seams ship; the proof is host-gated. The tap half of the runtime sensor is no longer gated: first-party adapters read the JSON event streams Cilium Tetragon and Falco already emit, so an operator who runs either one gets kernel-derived rows on the spine with no code change. We consume a kernel sensor's output; we ship no BPF object and load nothing into any kernel, and the cluster still supplies the probe, the TracingPolicy CRDs / Falco rules that make egress events exist at all, and the tap credential.
External: live credentials
A real Okta/Entra SAML+OIDC round-trip, a live cloud-tenant NHI discovery, a SIP/PSTN or LiveKit call, and a Stripe test charge all need real credentials or carriers we don't hold in the build sandbox.
A public REST surface and SDKs in two languages.
Every router is exposed over versioned, rate-limited REST with an OpenAPI spec. The TypeScript and Python SDKs are at parity, both self-instrumenting — calls you make through them land on the same spine you query.
curl -X POST \
https://localhost:3000/v1/evals/run \
-H "authorization: Bearer $TAKSHAM_KEY" \
-H "content-type: application/json" \
-d '{"dataset":"checkout-v3","scorer":"judge"}'from taksham import Taksham
tk = Taksham(base_url="http://localhost:3000")
# replay a failed run, then mint a test
run = tk.traces.replay("7f3a92c1")
test = tk.loop.mint_from_incident(run.incident_id)
print(test.id, test.status)import { Taksham } from "@taksham/sdk";
const tk = new Taksham({
baseUrl: "http://localhost:3000",
});
const rows = await tk.spql('SELECT agent, sum(cost_usd) FROM spans GROUP BY agent');