Open specification · Version 0.1, draft

SuperGauge

An open format for agent release decisions: the Agent Quality Record.

What is SuperGauge

SuperGauge specifies a single artifact: the Agent Quality Record. One document, produced at the point where somebody decides whether an agent may be released. It states what was measured, what it was measured against, which conditions had to hold, whether they held, who accepted the result, and which version to revert to.

Evaluation tools provide results and runtime controls record permissions. AQR connects those inputs to a versioned decision that reviewers can inspect.

The format composes with those layers. A system already exporting OpenTelemetry traces can produce a valid record without changing runtimes.

Why it exists

01

A score and a decision are different things

A score describes a set of runs. A release decision states which conditions were required, whether they were met, and on whose authority the system proceeded.

02

The worker often produces its own proof

An agent can alter a test or report success without completing the task. Evaluate the resulting system state and keep the evidence needed to recompute the result.

03

Evidence needs an owner

Record the approver, criteria and rollback reference when the decision is made. A later review can then use the evidence attached to that release.

Use it with your existing stack

Start with one agent and the evaluation tools your team already uses.

  1. Agree the release criteria and name the approver.
  2. Evaluate against a versioned dataset with a protected held-out split.
  3. Emit an AQR with the results, permissions and evidence references.
  4. Validate conformance and check the recorded release approval.
super agent evaluate developer --gauge-out record.yaml

This SuperOptiX evaluation path emits at L1 and begins on hold. L2 requires deterministic gates, a sealed held-out split and contamination probes.

sq gauge gate record.yaml --level L2 --require-ship --quiet

Conformance and release approval are separate checks. A hold or reject record can meet a conformance level. The deployment job must require a ship decision, passing gates and the level its profile needs. Your release system authenticates the approver and binds the record to the candidate.

The checker inspects signature and replay fields. Key verification, profile enforcement and evidence replay remain part of your release process.

Scope a one-agent pilot

Sample record output

Digests throughout, so a third party can confirm that nothing changed between measurement and decision. The authority block is required: a record that identifies what an agent is, without recording what it was permitted to do, can be structurally valid and substantively wrong.

Illustrative excerpt with abbreviated hashes. Use the repository examples when testing the schema and checker.

agent-quality-record.yaml
supergauge: "0.1"
profile: {id: sg/coding-agent, version: "0.1", tier: T2}

subject:
  agent: acme-support-triage
  harness_digest: sha256:9c1e...        # the whole loop, model included
  authority:                            # what it was permitted to do
    acs_policy_version: "2.1"
    sandbox: docker
    egress: deny-by-default

task_set:
  manifest_digest: sha256:7d02...
  held_out: 12
  sealed: true                          # closed to anything that tunes

measures:
  - {id: task.completion,        value: 0.83, split: held-out, n: 12}
  - {id: reliability.pass_hat_k, value: 0.66, k: 5}

gates:                                  # deterministic; a judge cannot satisfy one
  - {id: policy.no_pii_egress,   result: pass, source: acs}
  - {id: reliability.pass_hat_k, floor: 0.60, result: pass}

decision:
  verdict: ship
  actor: "priya@acme.example"
  rolls_back_to: sha256:2f7a...
  signature: ed25519:...

How a record is produced

Five stages. Each one contributes a field that a later reader can verify independently.

  1. 1

    Define

    A profile sets the tier, the mandatory checks and the thresholds they must clear.

  2. 2

    Seal

    The held-out portion of the task set is fingerprinted and closed to anything that tunes.

  3. 3

    Measure

    The agent runs k times under a recorded authority grant, producing an event ledger.

  4. 4

    Evaluate

    Deterministic checks and model-graded scores are computed from that ledger.

  5. 5

    Record

    A record states what held, who accepted it, and the version to revert to. Signing is required by higher assurance levels.

The measure registry

The specification is small and changes rarely. The set of things worth measuring is neither, so the two are versioned separately. Each measure declares whether it is computed deterministically or graded by a model, because only a deterministic measure may block a release.

Effectiveness

Whether the work reached a finished state
  • task.completionThe resulting state of your systems, measured directlydeterministic
  • trajectory.validRequired steps present and execution within the step budgetdeterministic
  • tool.correctnessTool selection, argument validity and call countsdeterministic
  • answer.groundedClaims supported by retrieved or tool-returned contextmodel-graded

Efficiency

What completion cost
  • efficiency.cost_per_successSpend per completed taskdeterministic
  • efficiency.tokens_per_successToken consumption per completed taskdeterministic
  • efficiency.latency_per_successElapsed time per completed taskdeterministic

Robustness

Whether performance holds under repetition and failure
  • reliability.pass_hat_kEvery one of k independent attempts succeedsdeterministic
  • reliability.pass_at_kAt least one of k attempts succeedsdeterministic
  • robustness.recoveryBehaviour when a tool fails part-way through a rundeterministic
  • robustness.multi_turnQuality across an extended, many-turn sessionmodel-graded

Safety

The boundaries an agent has to stay inside
  • policy.hard_rulesProhibited and required actions at the runtime checkpointsdeterministic
  • safety.injection_resistanceDirect and indirect injection, confused-deputy conditionsdeterministic
  • safety.tool_abusePrivilege escalation and unintended destructive callsdeterministic
  • safety.isolationSide effects confined to the sandboxdeterministic

Assurance

Whether the measurements themselves can be relied on
  • assurance.judge_agreementAgreement between the model judge and a sampled human reviewdeterministic
  • assurance.holdout_sealedHeld-out manifest unchanged and contamination probes silentdeterministic
  • assurance.evaluator_independenceThe grader saw only the artifact and the resulting statedeterministic
  • assurance.evidence_completeLedger present and the run reproduces the same verdictdeterministic

Measure identifiers are permanent. Where the meaning of a measure changes it receives a new identifier, so records already issued remain interpretable.

The release rule

A record may carry a ship verdict only where every gate has passed.

Gates are computed deterministically, and a model-graded measure cannot satisfy one. Where the held-out portion is unsealed, or a contamination probe has fired, the record cannot carry a ship verdict at any measured value.

Results are reported as a profile

Gates resolve to pass or fail, and every other measure is reported with its own tolerance. Collapsing them into a single figure discards the detail the record exists to preserve, and invites teams to optimise the headline while the behaviour drifts.

Thresholds belong to profiles

The specification defines how each measure is computed and leaves the acceptable value to a profile, which must be able to show the evidence behind it. A figure with reasoning attached survives scrutiny; a round number chosen for its appearance does not.

Conformance is self-asserted

An implementer states the level they meet, and the published suite lets anyone reproduce the claim for themselves. Verification stays open to third parties, which keeps the burden of proof on the implementation itself.

Tiers

Applying identical controls to a documentation fix and a payments change produces process that teams quietly route around. A profile declares a tier, and the tier determines which checks are mandatory. A profile may always demand more than its tier requires.

TierApplies toMandatory before release
T0Local, reversible changes with existing test coverageDeterministic checks
T1Cross-service changes, shared environments, external callersAdds a sealed held-out portion and a reliability threshold
T2Irreversible data, customer impact, identity, payments, regulated decisionsAdds recorded human acceptance of the specific artifact, and a signature

Conformance levels

L1

Emitting

Produces a schema-valid record carrying SHA-256 digests for the profile, subject and task set.

L2

Gated

Deterministic checks enforced, held-out portion sealed and fingerprinted, contamination probes present.

L3

Calibrated

Reliability reported across repeated runs, judge version pinned, evaluator independence asserted.

L4

Verifiable

Signed, and reproducible from the referenced ledger by an independent third party.

Level 4 addresses a specific failure mode. An immutable record guarantees only that whatever was submitted remains unchanged. Independent redeployment from the underlying ledger is what establishes that the submitted result was accurate in the first place.

The full specification

Record schema, the release rule, the measure registry and the conformance suite, on GitHub under CC BY 4.0 and Apache 2.0.

Open SPEC.md

Interop and emitters

Evaluation tools run tests and store traces. An emitter writes those results into an Agent Quality Record.

A system already exporting OpenTelemetry can point assurance.evidence at that ledger. Higher levels require the corresponding checks and evidence. The draft mapping lives in RFC 0001. Emitter guides cover LangSmith, Google ADK, Inspect AI, Jev / System One and SuperQode: map peer fields onto SPEC blocks, cite only published measure ids, and never let a judged score back a gate.

TypeSafe AI Jev (System One) is called by an evaluation tool. Emitters pin the versioned model id and question-pack digest under assurance.judge, record Score / Noul grades as judged measures, and may soft-hold on low confidence. Raw confidence must never alone hard-gate ship. SuperQode emits its SystemOne ledger into the same record. See RFC 0004. Live calls must identify the judge used. Heuristic fallbacks carry their own source and confidence proxy. Judge acceptance preserves existing approval; it cannot authorize a release.

Test integrity and reward-hack evidence live under optional assurance.integrity (RFC 0005): metric custody, independent recompute, canaries, hermetic workspaces, and mechanical override when a judged PASS fails deterministic integrity. Soft-hold and escalate remain available for judged signals; those signals alone must never justify ship.

Assurance export packs map existing AQR evidence onto external programmes without new scores or gates: AIUC-1 (A008 / B010 / B006) and EU Art. 50 disclosure. Optional export.profiles[] records which packs you claim coverage against. See packs/assurance-export.

When the peer already holds an A2A Agent Card or an AIBOM / provenance artifact, emit digests only (RFC 0002, RFC 0003). SuperQode emits at L2. SuperOptiX emits at L1. Other tools may emit or only consume records.

Jev / System One

Pin model id and pack_digest, map Score/Noul to judged measures, soft-hold on confidence. Never hard-gate ship on confidence alone.

emitters/jev-systemone

SuperQode emitter

Promotion state plus SystemOne ledger (tool_gate, rubrics, confidence) serialised into an AQR. SuperQode stays the harness.

emitters/superqode

RFC 0004

Draft contract for Jev / SystemOne assurance pinning, soft hold, and optional agreement gates over stored labels.

RFC 0004

RFC 0005 · Test integrity

assurance.integrity for metric custody, canaries, hermetic claims, and mechanical override. Judged evidence never alone ships.

RFC 0005

Assurance export packs

Metadata-only AIUC-1 (A008/B010/B006) and EU Art. 50 disclosure mappings via export.profiles[]. Not scores or gates.

packs/assurance-export

Emitter guides

LangSmith, Google ADK, Inspect AI, Jev / System One and SuperQode: peer fields to AQR blocks.

docs/emitters

OTel evidence mapping

Draft RFC for tool calls, policy decisions, attempt resets and measure derivation from OpenTelemetry.

RFC 0001

A2A and AIBOM

Serialize-only Agent Card and AIBOM / SLSA digests when the peer already holds them (RFC 0002 and 0003).

RFC 0002

Contributing

The specification is governed narrowly and the registry is open. The range of behaviour worth measuring exceeds any single team's experience, and practitioners can contribute test definitions from their own domains.

How changes are reviewed

Measures, profiles and adversarial packs require one reviewer from the measure group. The specification and schemas require two, one of whom is independent of the change. Two accepted proposals earn a place on the review rotation.

Contributions are made under a Developer Certificate of Origin sign-off in place of a contributor licence agreement. Authors retain copyright, which means a measure definition can be submitted without involving an employer's legal team. Specification text is licensed CC BY 4.0; schemas, packs and the conformance suite are Apache 2.0.

Commercial boundary

The commercial terms are stated in advance. The record format, the registry, published profiles, the starter packs and the conformance suite are open and accept contributions.

Superagentic AI separately provides implementation engagements, extended adversarial coverage and managed operation. Calibration data gathered across those engagements remains commercial; where it supports a threshold well enough to publish, the threshold is contributed back to the public profiles. Nothing in this arrangement prevents others offering equivalent services.

Adoption

The format is open to any implementer, and the intention is to steward it with practitioners from across the agent quality field. SuperQode and SuperOptiX are first-party emitters (SuperQode at L2, SuperOptiX at L1). These levels describe the supported record paths; each record must be checked.

ADOPTERS.md lists who is using the format, and takes a pull request from anyone who wants to be on it.

An open invitation

A record format earns its value from how many tools speak it. Evaluation platforms, agent frameworks, observability vendors, platform teams and audit tooling are all welcome to take it up.

Three ways in. Emit records after an evaluation, which for most tools is a serialiser over values they already hold. Consume records other tools produce. Shape the registry by proposing a measure, a profile or an adversarial pack.

Anyone may implement the format and check a claimed level from a record you publish.

Status and scope

Version 0.1, draft. The specification may change incompatibly before 1.0.0. Measure identifiers, once published, are permanent regardless of version.

The subject of a record is your own agent and the harness around it. Assessment of third-party products answers a different question and lives in SuperRadar.

Scope a one-agent quality pilot

Bring your agent and current evaluation stack. The pilot covers a dataset, release checks, an Agent Quality Record and handover to your engineering owner.

Scope a one-agent pilot