Live pilot onboarding

Send structure, not secrets.

Use this pilot flow to stream structural events into CAUM Live. The endpoint returns hash-chain evidence, structural health, hard-alert classification, and observe-only coordination. Do not send prompts, code, files, customer messages, or business payloads.

observe_only allowed_to_block=false evidence_grade included raw content ignored

1. Start a live session

Create a CAUM session for one agent workflow. The response returns a session token; CAUM stores only its hash.

curl -X POST https://caum-observation-production.up.railway.app/v2/live/start \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "pilot_customer",
    "agent_id": "agent_42",
    "workflow": "support_ticket_agent",
    "baseline_cost_usd": 0.05
  }'

2. Push structural events

Send tool/action shape, status, timestamps, counters, and opaque state IDs. Keep private content out.

curl -X POST https://caum-observation-production.up.railway.app/v2/live/event \
  -H "Content-Type: application/json" \
  -d '{
    "session_id": "caum-live-...",
    "session_token": "SESSION_TOKEN_FROM_START",
    "event": {
      "event": "tool_call",
      "tool": "browser.get",
      "phase": "retry",
      "status": "not_found",
      "state_id": "opaque_state_a",
      "input_tokens": 120,
      "output_tokens": 12,
      "cost_usd": 0.0012
    }
  }'

3. Verify the response

Look for `evidence_grade.public_class`. Public hard alerts are separated from review-only buckets.

{
  "event_type": "structural_loop_continues",
  "live_alert": true,
  "tier": {"tier": "T5", "rank": 5},
  "evidence_grade": {
    "public_class": "hard_alert",
    "raw_content_used": false,
    "allowed_to_block": false
  },
  "coordination": {"decision": "observe_only"}
}

4. Run a smoke test now

This creates a temporary session and sends a controlled retry loop with no private content.

See Validation Agents
Ready.
{}

Production note

Live now uses a session token and durable zero-semantic chain state. For enterprise-grade monitoring, the remaining boundary is customer API-key ownership and tenant isolation around those persisted sessions. This pilot flow is ready for validation, integration design, and evidence demos.