Asked, answered.

One authoritative record of what an agent did: every model call, tool call, input and clock read made through Pragmatic, written down before the agent sees each result. It is the record you hand to someone who has to rely on it, such as a customer’s security team, an auditor, a regulator or a court, and with 0.6, in design-partner preview, they can check it without trusting you. A crashed run can also resume from it without repeating finished work.

Tracing and observability tools such as Langfuse, LangSmith and Datadog are built for watching and debugging. They store traces in databases that can be edited, and usually keep them for days or months. Pragmatic is built for the record you may have to defend: complete for every call made through it, tamper-evident, replayable without the model, and kept as long as your own policy says. Many teams will use both.

Durable-execution engines such as Temporal and DBOS recover workflows after a crash, and do it well. Their history exists to drive the engine. It is not an audit artifact, and it was not built to be verified by someone who does not trust the operator. Pragmatic also recovers crashed runs, and its journal is the evidence: hash-chained, replayable without calling the model, and, with Pragmatic Server (in design-partner preview), independently anchored. If you already run one of these engines for general workflows, keep it.

Pragmatic never asks the model again. The first run records each response, and replay reads those responses back. During replay the model is replaced by a stand-in that refuses to answer, so “the model is never called” is enforced, not promised. In the 0.5 test suite, 1000 of 1000 seeded runs replay identically.

On a regular schedule, Pragmatic Server combines the latest fingerprint of every run into one log and sends that log’s fingerprint to outside parties: public timestamp authorities, which sign the time they received it, and optionally a witness, which countersigns it. Only the fingerprint leaves your server, never content. Once part of a run is anchored, rewriting it would be caught, even if the person rewriting it controls the server. “Independent” means separate operators (by default at least two), checked against certificates and keys the auditor chooses, not ones we hand them. Anchoring is part of Pragmatic Server, in design-partner preview.

A verified anchor proves that the first entries of a run, with an exact fingerprint, existed no later than the stamped time. So anchored history cannot be changed without detection, even by an administrator of the server, as long as the auditor checks against a witness they trust. It does not prove that what was recorded was true, that the agent did nothing outside Pragmatic’s interfaces (code that bypasses them is not recorded), or anything about a run before its first anchor. Until part of a run is anchored, an administrator with full access to the server could still rewrite it; the anchoring schedule limits that window, and the server reports how long it is. On its own, an unkeyed local journal shows only that it is internally consistent, since someone who can rewrite the whole file could rebuild the chain. Keying the journal stops anyone without the key from rebuilding the chain, but not whoever holds the key. Only independent anchoring, part of Pragmatic Server in preview, lets an outsider check it without trusting you.

Each piece of content (a prompt, a response, a tool’s input or result) is stored separately, with its own fingerprint, while the fields around it hold no personal data. Each fingerprint is mixed with a random value, so the content cannot be guessed from it. Erasing a piece of content deletes it and that random value but keeps the fingerprint, so the chain and all other content still verify. The erasure is recorded in the run itself: what was erased, by whom, and why. You can erase specific pieces of content, or every piece that contains a given text, such as a person’s email address. An erased run can still be verified, but the steps whose content was erased can no longer be replayed. This is part of 0.6, in design-partner preview. It helps you meet erasure requests; deciding when data must be erased, or kept for a legal obligation, stays with you.

Pragmatic provides evidence for record-keeping duties. It does not satisfy any regulation by itself. For context: the EU AI Act asks high-risk systems to keep automatic logs, and DORA asks EU financial firms to protect their logs from tampering and unauthorized access. No law we know of requires independently anchored logs. Anchoring makes your evidence stronger; it is not a legal checkbox. Clock synchronization, encryption, backups, access policies and retention settings remain your responsibility.

No. In Python, wrap the client you already use with ctx.wrap and hand tool calls to ctx.run_tools; the rest of your agent stays as it is. In 0.5, streaming and .parse() are refused inside a run. 0.6, in preview, moves capture down to the HTTP layer so that streaming and frameworks such as the OpenAI Agents SDK, Pydantic AI and LangChain can be recorded too. The quickstart walks through it.

Where you put it. The runtime is a library, and 0.5 journals are files on your own disk. Pragmatic Server runs in your own environment, so the data region is wherever you deploy it, and volume encryption is yours to configure. Pragmatic sends no telemetry. With Pragmatic Server, the only things that leave your environment are fingerprints sent to the timestamp authorities and witnesses you configure, and the alerts you send to your own webhooks.

From 0.5, the runtime, the Python SDK, the Rust crates, the language bindings, the CLI, the journal format and the verifier are open source under the Apache License 2.0, free to use in production at any scale. The verifier is open on purpose: an auditor should not have to trust us either. Pragmatic Server (the shared journal store, independent anchoring, retention, erasure, roles, the access log, evidence bundles and the console) is a commercial product from Pragmatic Research, Inc. A hosted independent witness is planned.

0.5, drop-in Python under Apache 2.0, is on the repository’s release/0.5.0 branch. It is not on PyPI or crates.io; install it from source as the quickstart shows. The system-of-record features (a new journal format in which content can be erased, branches, capture at the HTTP layer, erasure, evidence bundles) and Pragmatic Server are being built for 0.6. They are in design-partner preview and are not generally available. Journals written by 0.5 can still be verified and exported in 0.6, but not resumed or replayed; 0.6 uses a new journal format. Pragmatic is pre-1.0, so expect changes between minor versions.

The open-source runtime, SDKs, CLI and verifier are free. Pragmatic Server is licensed to design partners during the preview. Email us and tell us what your agents do.