Curious how you handle trust boundaries for tool outputs here. Do you keep a signed or replayable trace so a developer can audit what the agent saw before it acted?