Observe · Selko

See what
actually ran

Your agent says the task is done. See the commands, file activity and connections behind that claim. Selko records from outside the agent and gives you a readable history you can inspect as the work happens.

What it does
  1. Run your usual agent through the local CLI. Keep its tools, working directory and credentials.
  2. Follow a live account of recorded activity instead of reconstructing it from a chat transcript.
  3. Fold repeated observations into readable summaries while retaining their provenance.
  4. Keep a local journal and signed behaviour commit for later inspection.
  5. See coverage limits alongside the evidence. Attempts stay distinct from successful effects.
Where it sitsFull architecture →

Work

Taso

What is the task, and what counts as accepted?

Control

Ote

What stays live, and what must stop?

Continuity

Solu

What survives when a worker changes?

Observation

Selko

What actually ran?

Team memory

Vartio

How will the team retain signed history?

Component roles: Taso declares and judges work; Ote supervises live resources; Solu preserves the work; Selko records activity; Vartio’s team memory is planned. This is a responsibility map, not a completed integration.
How it works

Native sensors. One readable record.

Selko is built in Rust. Linux capture uses eBPF; macOS uses Endpoint Security and PKTAP; Windows uses ETW and Job Objects. These feed a shared interpreter, local append-only journal and signing pipeline.

The live view and the signed behaviour commit come from the same record. Perusta supplies canonical hashing and signatures; Ruuma supplies folding and behavioural comparison. The recorder is separate from the unprivileged agent process.

Current scope: native paths exist on all three platforms, but coverage and validation differ. Privileged macOS launch acceptance and further capture work remain. Native recording requires explicit recorder setup.

Built with
Rust, native OS sensors and a local recording daemon.
Produces
Live watch, a local journal and signed records for finalized runs.
On failure
Capture gaps and unfinished runs remain explicit.
Boundary
Records activity; does not sandbox the agent or gate a merge.
# After setting up the native recorder on Linux/macOS:
selko watch -- claude -p "make the test pass"

# List recorded runs.
selko runs

# Inspect one run again.
# Replace RUN_ID with an identifier from the list.
selko watch RUN_ID

# Read the contract-level view.
selko --atoms watch RUN_ID

# Capture scope and permissions vary by platform.