What Tracelane is
Tracelane is a flight recorder for AI agents: full-fidelity capture of every model call, plus a tamper-evident ledger that a third party can verify offline, without access to our systems — and, for every batch anchored in the public Sigstore Rekor log, without trusting us either (anchoring is best-effort and not yet universal; see the ledger page for exactly what rests on what).What Tracelane ships
A tamper-evident audit ledger
Every audit event lands in a Merkle-batched hash chain. Each tenant gets its own Ed25519 signing key, and the chain is signed per tenant. The property that matters: you can verify it without us. Export the ledger and runtlane verify --tenant-pubkey <your key> on your own machine. The verification is
offline and independent — if a record had been altered or removed, the chain check fails.
Anchored batches additionally carry a resolved Sigstore Rekor v2 inclusion proof on a
best-effort basis; universal per-run anchoring is on the roadmap.
See Audit Ledger for the format and the verification procedure.
Full-fidelity capture, on a neutral wire format
Traces are emitted as OTel GenAI semantic conventions — an open standard, not a Tracelane-specific envelope. Capture defaults to full fidelity rather than sampled, so the recorder does not silently drop the trace you later need.Observe-first guardrails
Guardrails run inline at the gateway and are deliberately observe-first: they detect and record rather than block by default. This is a considered position, not a missing feature — for most teams a false-positive block is worse than the failure it would have prevented. Detection today is heuristic and deterministic; a multi-model ML ensemble is on the roadmap and is not shipped.BYOK at 0% markup
Bring your own provider keys across 205 providers. Keys are stored with envelope encryption, with the AAD bound to(tenant_id, provider_id). We add no markup to your
provider spend.
Rollback on objective metrics
Prompt promotions roll back on EWMA thresholds over objective signals — cost, latency and guardrail-fire rate — rather than a human noticing a regression days later. The drift is computed from metric observations you post to/v1/prompts/:name/observe;
gateway traffic updates the baseline but does not itself trigger a revert, and
autonomous background monitoring is not built. See
prompt promotion.
Apache 2.0, self-hostable
The entire stack is Apache 2.0 and runs self-hosted on single-node Docker Compose. Paid plans start at $29/mo (Builder); self-hosting the open-source stack is free.What Tracelane does not do
- Failure clustering. Not shipped.
- Automated PR drafting against your repo. Not shipped, and not on the near roadmap.
- Blocking enforcement by default. Deliberate — see observe-first above.
FAQ
Does Tracelane do failure clustering today?
Does Tracelane do failure clustering today?
No. Tracelane positions on full-fidelity capture and the tamper-evident record, not on
post-failure clustering. If
clustering is your primary need today, Tracelane is not yet the tool for that job.
Can I migrate from LangSmith to Tracelane?
Can I migrate from LangSmith to Tracelane?
Not with a one-command importer — that is on the roadmap.
tlane migrate helicone and
tlane import-litellm ship today; a LangSmith equivalent does not.Because the wire format is OTel GenAI semconv, the practical path is to instrument once
and dual-write during cutover, then cut the old destination when you are satisfied.Can I run Tracelane alongside what I already have?
Can I run Tracelane alongside what I already have?
Yes. Tracelane sits at the gateway and emits OTel GenAI semconv, so it can run in
parallel with an existing tracing destination during evaluation. Nothing requires you to
cut over before you have compared them on your own traffic.
What does 'tamper-evident promotion record' mean?
What does 'tamper-evident promotion record' mean?
Every promotion event (staging → production) is recorded in a tamper-evident
Merkle-batched hash chain with Ed25519 per-tenant signing. Anchored batches carry a
resolved Sigstore Rekor v2 inclusion proof on a best-effort basis; universal per-run
anchoring is on the roadmap.“Tamper-evident” means alteration is detectable, not that it is prevented. The check is
independently reproducible with
tlane verify --tenant-pubkey against the exported
ledger. See Audit Ledger.Verified as of 2026-08-26 against each vendor’s public documentation and public repositories. A
— means we found no such capability documented at that date —
not that the vendor lacks it. Vendors change their products; if anything here is
inaccurate or out of date, please open an issue
and we will correct it.