Tracekit's maintainers published version 1.0.0 on October 11. The open-source project records AI-agent calls and policy decisions in signed, hash-chained records and exports a bundle for offline verification. This is a software release announcement, not an independent finding that an agent deployment is safe.
The project describes a signer between an agent and its tools. Before a captured call runs, policy can allow it, deny it or hold it for a person's approval. The stable release carries forward the version 2 signer and evidence format from the release candidate, along with witnesses, a monitor, team approvals and server deployment options.
The release notes say version 1.x verifiers can verify 1.0 bundles. When a bundle needs a newer verifier, the stated result is UNVERIFIABLE rather than FAILED. That distinction concerns whether the verifier can process the format; it is not a verdict on the agent's intentions or the truth of every result.
The version-pinned limits are important: a verified bundle does not prove intent, complete capture of every action, or the truth of a result reported from inside the agent process. Actions that bypass a capture layer can leave no record. The project calls the evidence tamper-evident, not tamper-proof.
The same limits say a signer running as the agent's own operating-system user offers no protection against that agent reading its key or rewriting its store. Stronger deployments use separate execution boundaries and independent witnesses, but system mode still does not protect against the machine's root user. These are the maintainers' stated security limits, not independently tested guarantees.
Availability also differs by package: the 1.0.0 release notes say its npm packages are not yet published and direct TypeScript users to the repository SDK. This brief does not recommend installing the software in production or claim it captures every possible agent action. It reports the release and its documented trade-offs.