The system of record for AI agents.
Every model call and tool call your agent makes through Pragmatic is written to a tamper-evident journal before the agent sees the result. A crashed run resumes without repeating finished work, and any run replays exactly, without calling the model.
0.5 is open source and installs from source today. Evidence for auditors and Pragmatic Server are in design-partner preview for 0.6.
By the numbers
Someone will ask what your agent did. Pragmatic keeps the record, written down as it happened.
What it records
Everything that could change what the agent does next.
The full request and response.
What your agent sent to Anthropic or OpenAI, and exactly what came back. The response is written to the journal before your agent can read it. The model, stop reason and token counts sit alongside it, so the journal is also a record of what each run cost.
Written down before they run.
Each tool call is recorded before the tool runs, and its result after. If the process dies in between, the record shows exactly which call was in flight, and nothing pretends it finished.
Messages in, clock reads.
Messages your agent receives while it runs, and every time it reads the clock. On replay it gets the same values back, so a run that depended on the time of day replays as it happened.
Which code, which attempt.
Mark the agent with @pragmatic.durable and the journal records which version of its code ran. In 0.6, in preview, the journal also notes each attempt to run it and how each attempt ended. On Pragmatic Server, also in preview, a separate access log records who read each run, and every erasure is recorded with who made it and why.
Four things, in one record
Complete by construction.
Calls go through Pragmatic on their way out, and each result is written down before your agent sees it. If it cannot be written, the run stops instead of carrying on unrecorded. In 0.5, that covers the supported model calls on a wrapped client and every step made through ctx; other methods on the client pass through unrecorded. In 0.6, in preview, capture moves to the HTTP layer, and anything it cannot record is refused. What your code does outside Pragmatic is not recorded, and we say so plainly.
Exact replay, model never called.
Replay runs your agent again and serves every response, tool result, input and clock read from the journal. The model is swapped for a stand-in that refuses to answer, so nothing is called and nothing is billed. Mark the agent with @pragmatic.durable and replay refuses a changed agent before it starts. Without it, replay stops at the first step that differs from the record, instead of drifting.
Erasure that keeps the proof.
Each piece of content is stored separately, with its own fingerprint. Erasing a person’s data removes the content and keeps the fingerprint, so the rest of the journal still verifies, and the erasure itself goes on the record. Being built for 0.6, in design-partner preview.
Evidence anyone can check.
Export a run as one evidence file. An auditor checks it on their own machine with the open-source verifier, against timestamp authorities and witness keys they chose. Nothing in the file is taken on trust, and nothing has to reach us. Being built for 0.6, in design-partner preview.
The second pillar: crash recovery
Resume where it stopped.
A crashed run picks up from its journal, on the same machine or another one that can read it. Model calls that finished are read back instead of paid for again, and tool calls that finished are not repeated. A call cut off mid-flight runs again: a model call still waiting for its reply is sent again, and a tool call runs again by default. Pass a recover policy to mark a tool call done instead.
Long runs, no lost work.
An agent nine hundred steps into a thousand-step job does not start over. It continues at step nine hundred and one, with the same answers it had before the crash.
Who it is for
Agents that someone outside engineering will question.
Selling into regulated companies.
A bank, insurer or hospital runs a security review and asks how you record what your agent does, who can see it and how long you keep it. Answer with a record they can verify themselves, not a screenshot of a dashboard.
Fintech, insurance, health, legal.
Agents that move money, decide claims, touch clinical workflows or draft filings. Internal audit wants a run reconstructed, a customer disputes a decision, or a regulator asks; the EU AI Act, for one, asks high-risk systems to keep automatic logs. Pragmatic provides evidence for requests like these. Meeting a regulation still takes your own controls and processes.
The people who sign off.
Compliance officers, AI governance leads and security teams who need to show that a control worked, keep runs under a legal hold, or answer a request to erase someone’s data.
Where it fits
Next to your tracing and orchestration tools.
Langfuse, LangSmith, Datadog.
Keep them for watching and debugging. They store traces in databases that can be edited, and usually keep them for days or months. Pragmatic keeps the record you may have to stand behind later.
Temporal, DBOS.
They recover workflows well. Their history is internal state for the engine, not an audit artifact: it was not built to be checked by someone who does not trust the operator.
The record itself.
Records every call made through it before the agent sees the result, replays without calling the model, and, with 0.6 (in design-partner preview), produces evidence anyone can verify without trusting whoever ran the agent.
Open source, plus Pragmatic Server
Open where trust depends on it.
The runtime and the verifier.
From 0.5, the runtime, the Python SDK, the Rust crates, the CLI, the journal format and the offline verifier are open source under the Apache License 2.0. Use them in production at any scale. Anyone, including an auditor, can check a journal with them.
Pragmatic Server.
A shared journal store that runs in your own environment, with independent anchoring, retention rules, erasure, roles, an access log, evidence bundles and a console. It is being built for 0.6 and is in preview with design partners. It is not yet generally available.
A hosted independent witness.
A witness run by Pragmatic Research that countersigns your server’s checkpoints, alongside public timestamp authorities. It sees fingerprints only, never content or run names.
On the record.
Before anyone asks.
We are working with a small group of design partners on Pragmatic Server and 0.6. Tell us what your agents do, and who asks about them.