Anonymous installs send one hash and nothing else. Once you activate an account, the trail itself is copied into your tenant, because an auditor who has to ask the audited party for the file, and believe them, is not an audit. What travels is what your agent did: the tool, the moment, and the target it touched. What never travels is content: the inside of a file, the body of a document, and any credential, which is stripped on your machine before anything is written.
The full log at ~/.fidacy/sessions/, readable only by you, plus the digest that covers it. Read it with npx -y @fidacy/mcp log.
The head of the chain, plus the action trail: tool, time and target, with credentials already redacted. Without an account, only the hash goes.
File contents, prompts, credentials. A command or path is recorded with secrets stripped before it is written; what the file HAD INSIDE never is. Message text is recorded so disputes have the exact words, and one switch (FIDACY_DISABLE_CONTENT) keeps it out where the words themselves are sensitive.
It ships inside every session file you write, so the instructions to audit us travel with the thing being audited. A vendor log says trust my file. This says recompute it yourself.
Same shape as our conversation receipts, with its own genesis. A verifier written for one already reads the other.
That is a decision, not a gap. A recorder that starts refusing tool calls on day one gets uninstalled on day one, and an uninstalled recorder proves nothing. Blocking is the firewall's job, and the firewall runs on the actions that are hard to undo: money leaving, records being deleted, credentials being read, data going somewhere it was not meant to go.
Coverage also sees what passes through the agent host it is installed in. It is not an endpoint agent and it does not run your machines. That is the point: a record written by someone who does not operate the environment is the only kind that settles an argument.