Anonymous installs send a coarse product signal. Once an organization activates Agent Sessions, the action trail is copied into that organization’s tenant so it can be investigated without asking an operator to reconstruct it later. What may travel is the tool, moment, target and selected message evidence. File contents, document bodies and credentials do not travel.
The session ledger starts at ~/.fidacy/sessions/, together with the digest that covers it. Read it with npx -y @fidacy/mcp log.
The chain head and action trail: tool, time, redacted target and runtime context. Message actions can include message text. Without an account, only coarse anonymous telemetry goes.
File contents, document bodies and credentials. Commands and paths are recorded with secrets stripped before they are written. Message text is limited to message actions and is stored only for an authenticated organization’s evidence trail.
It ships inside every session file you write, so the instructions to audit us travel with the thing being audited. A vendor log says trust my file. This says recompute it yourself.
Same shape as our conversation receipts, with its own genesis. A verifier written for one already reads the other.
Those are different controls. Coverage shows the trail visible to the connected host and whether a complete session can be independently recomputed. Blocking is the firewall’s job, on actions that are hard to undo: money leaving, records being deleted, credentials being read or data going somewhere undeclared.
Coverage is not an endpoint agent and does not claim visibility beyond the host where it is installed. A complete session proves the integrity of the observed trail. A missing or truncated session is a coverage limit to investigate, not evidence that nothing happened.