Execution Traces

Every interaction with Nous produces an execution trace. Traces capture what happened at each step of the cycle.

What's in a Trace

• Cortex decisions — Memory write approvals/denials, tool authorizations
• Model calls — Which model was invoked, token usage
• Memory actions — Approved entries, denied candidates with reasons. Policy denials include decisionRecord with reasonCode (e.g. POL-GLOBAL-DENIED, POL-CONTROL-STATE-BLOCKED) for traceability.
• Evidence references — Authorization/completion/invariant witness event IDs and linked verification report IDs
• Timing — Step durations

Viewing Traces

Web UI: Open the Traces page. Traces are listed for the current project. Expand a trace to see turn-by-turn details.

Each turn now includes evidence references for critical action categories (model-invoke, tool-execute, memory-write, trace-persist).

Phase 9.5 adds workflow-linked navigation from the Projects workflow surface. When you open Traces from a workflow node or run projection, the Traces page receives a traceId deep link, shows the linked trace reference at the top of the page, and expands the matching trace by default.

Use that linked view when you need to move from workflow runtime state to canonical execution evidence without losing project scope.

Phase 11.4 extends that continuity to the advanced Projects visual-debug surface. Opening Traces from the staged workflow canvas or node-inspect panel preserves project, run, node, and evidence context, so trace review lines up with the same visual-debug state you were inspecting in Projects.

If the Projects surface reports degraded parity, trust the canonical trace and workflow evidence first. The Traces page remains a direct view of execution evidence, not a replay of any client-side visual overlay.

Trace -> Verification Workflow

Use witness verification to generate integrity artifacts, then inspect linkage from trace evidence references:

pnpm dev:cli -- witness verify
pnpm dev:cli -- witness list
pnpm dev:cli -- witness get --id <report-id>

API consumers can use:

• witness.verify to generate a VerificationReport
• traces.verificationReports to retrieve reports linked to a specific trace

Trace Sensitivity

By default, sensitive fields (user input, model output, memory candidate content) are redacted before persistence. Structure is preserved. To store full content, set security.traceSensitiveData: true in config. See Security Baseline.