Telemetry Boundary Layer
Session truth layer showing what is directly observed, what is reducer-derived, and what remains outside current coverage.
Skill Proof Run
wf1 · proving the new visualization sketch grammar against the same brief set we will rerun later.
Live network/session topology with partial file/process coverage. Missing items are not proof of inactivity.
Session Canvas
Truth banner in-canvas: proxy + reducer are active. filesystem and child-process visibility are partial.
Observed Core
cursor-agent
root process · observed · LIVE
OpenAI API
external host
docs.qpoint.io
external host
Reducer Layer
Session Cluster
inferred grouping
Merged from 17 proxy events + 3 discover records
Filesystem Coverage
/workspace/app/config.ts
observed via bridge
~/.aws/credentials
possible touch inferred from downstream behavior
Several temp-file writes may be missing
Selected Item
api.openai.com
observed network host · primary semantic surface
first seen 14:02:11 · last seen 14:14:09 · 42 requests
Live Activity
LIVE pulse x12
topology frozen: off
new host in last 30s
Coverage Breakdown
proxy
durable primary
Strongest current network truth. Supplies host, request timing, and repeated-flow volume.
bridge
file attribution
Provides direct file touches when available, but coverage can drop for short-lived or indirect access.
discover
context fill
Helps classify endpoint and process context, but is not always the authoritative source for session semantics.
reducer
session abstraction
Merges repeated low-level records into clusters, flows, and session-level shape.
Selected Item Evidence
Authority
Primary semantic source: `proxy`
Reducer agrees with host identity. No conflicting labels from discover.
Correlation Keys
session_id · request_id cluster · host label normalization
Evidence Timeline
14:02:11 first HTTPS request · 14:10:46 reducer grouped repeated calls into one flow
Observed vs Inferred Counts
External Hosts
6
observed
1
inferred
Files
9
observed
4
inferred
Child Processes
1
observed
3
inferred
Flows
17
observed
5
inferred
Known Boundary Notes
Missing does not mean safe
A missing file or process may fall outside current telemetry rather than indicating inactivity.
Reducer-derived clusters are useful, but second-order truth
Keep them visible and useful while clearly signaling that they summarize evidence rather than replace it.
Boundary language belongs near the canvas
Users should not have to hunt through documentation to understand what is and is not represented in the current session view.