Reconstruction method
- 01
Collect
Normalize and redact events from product-owned surfaces.
- 02
Bound
Group reliable traces, sessions, invocations, and connections.
- 03
Link
Score possible connections using tenant, principal, resource, protocol, intent, and stage.
- 04
Constrain
Reject conflicting tenants or authenticated principals.
- 05
Reconstruct
Build a revisable journey graph with evidence behind each edge.
- 06
Classify
Assign outcome and confidence without forcing ambiguity.
Confidence classification
Exact, strong, probable, ambiguous, and unresolved describe the support behind a connection. They are not product-performance labels.
Outcome classification
Started, completed, blocked, and unresolved are assigned against a task-specific completion criterion. Unobservable outcomes stay unresolved.
Eval design
A controlled Eval fixes the task definition, environment, success criterion, and observation window before runs begin. Agent, model, and treatment comparisons use the same criterion. Eval pass rate remains separate from production ATCR.
Limitations
- Reconstruction quality depends on the evidence available from product-owned surfaces.
- Supporting network or timing clues never prove identity on their own.
- Controlled Evals do not reproduce every production condition.
- Ambiguous and unresolved activity remains visible rather than being forced into a journey.
- Public findings require task, sample, provenance, time window, method, and limitations.