Product
Three layers: an SDK that captures production executions, an engine that replays and evaluates them deterministically, and a control plane being productized with design partners.
Architecture
The SDK records at supported boundaries. The capsule preserves the captured observations. The engine replays them — exactly, counterfactually, or continuously. Everything downstream is built on that loop.
capture → replay → diagnose → test → gate → monitor
Capabilities
core technology — the engine described by the product source · early access — scoped with early teams · design partner — built together · roadmap — planned, not available
ontral.record() is the only required integration. Interceptors capture supported boundaries: model I/O, streams, tool calls, HTTP and MCP activity, retrieval results, time, randomness, UUIDs, state, exceptions, and async ordering. Outcome labeling is optional.
A durable record of one execution: captured observations, their ordering across threads and tasks, attempted effects, exceptions, and optional business outcomes — stored as content-addressed blobs and sealed under a Merkle root.
Replay eligibility depends on complete coverage of the execution's relevant nondeterministic boundaries. Coverage is reported per capsule — never assumed.
Replay serves recorded observations back to your agent code. Zero provider calls, zero external tool calls, zero world mutations — and the result is compared cryptographically to the original.
Attempted side effects are recorded during capture and intercepted during replay. A replayed execution must not email users, charge cards, or mutate production systems — attempts are reported, never performed.
Node-by-node timeline of a capsule: model and tool calls, retrieved document versions, state, exceptions, lanes, and source-versus-replay comparison.
Replay a capsule against current code and stop at the first operation that no longer matches — separating model, code, and external-data causes.
Replace one captured observation and replay the downstream execution from any node. The live tail stays dry-run.
Run a matrix of alternate histories — document version × model × temperature × feature value — to separate causal observations from sampling noise.
Promote important capsules into suites replayed before changes to code, prompts, models, tool schemas, retrieval, policies, or MCP servers. Results are classified; forbidden classes fail the build.
Rolling replay of a pinned corpus against model updates, aliases over time, prompt changes, code changes, retrieval changes, and tool changes — with alerts on outcome flips.
Content-derived roots make every capsule tamper-evident and every replay provable. Export a capsule, import it elsewhere, and verify both systems reconstructed the same execution.
import ontral ontral.record(app="customer-support-agent")
$ ontral replay cap_demo_8f3a91 --attestWork with Ontral to make production failures replayable, explainable, testable, and preventable.