SuperGauge
An open format for agent release decisions: the Agent Quality Record.
What is SuperGauge
SuperGauge specifies a single artifact: the Agent Quality Record. One document, produced at the point where somebody decides whether an agent may be released. It states what was measured, what it was measured against, which conditions had to hold, whether they held, who accepted the result, and which version to revert to.
Evaluation tools provide results and runtime controls record permissions. AQR connects those inputs to a versioned decision that reviewers can inspect.
The format composes with those layers. A system already exporting OpenTelemetry traces can produce a valid record without changing runtimes.
Why it exists
A score and a decision are different things
A score describes a set of runs. A release decision states which conditions were required, whether they were met, and on whose authority the system proceeded.
The worker often produces its own proof
An agent can alter a test or report success without completing the task. Evaluate the resulting system state and keep the evidence needed to recompute the result.
Evidence needs an owner
Record the approver, criteria and rollback reference when the decision is made. A later review can then use the evidence attached to that release.
Use it with your existing stack
Start with one agent and the evaluation tools your team already uses.
- Agree the release criteria and name the approver.
- Evaluate against a versioned dataset with a protected held-out split.
- Emit an AQR with the results, permissions and evidence references.
- Validate conformance and check the recorded release approval.
super agent evaluate developer --gauge-out record.yamlThis SuperOptiX evaluation path emits at L1 and begins on hold. L2 requires deterministic gates, a sealed held-out split and contamination probes.
sq gauge gate record.yaml --level L2 --require-ship --quietConformance and release approval are separate checks. A hold or reject record can meet a conformance level. The deployment job must require a ship decision, passing gates and the level its profile needs. Your release system authenticates the approver and binds the record to the candidate.
The checker inspects signature and replay fields. Key verification, profile enforcement and evidence replay remain part of your release process.
Scope a one-agent pilotSample record output
Digests throughout, so a third party can confirm that nothing changed between measurement and decision. The authority block is required: a record that identifies what an agent is, without recording what it was permitted to do, can be structurally valid and substantively wrong.
Illustrative excerpt with abbreviated hashes. Use the repository examples when testing the schema and checker.
supergauge: "0.1"
profile: {id: sg/coding-agent, version: "0.1", tier: T2}
subject:
agent: acme-support-triage
harness_digest: sha256:9c1e... # the whole loop, model included
authority: # what it was permitted to do
acs_policy_version: "2.1"
sandbox: docker
egress: deny-by-default
task_set:
manifest_digest: sha256:7d02...
held_out: 12
sealed: true # closed to anything that tunes
measures:
- {id: task.completion, value: 0.83, split: held-out, n: 12}
- {id: reliability.pass_hat_k, value: 0.66, k: 5}
gates: # deterministic; a judge cannot satisfy one
- {id: policy.no_pii_egress, result: pass, source: acs}
- {id: reliability.pass_hat_k, floor: 0.60, result: pass}
decision:
verdict: ship
actor: "priya@acme.example"
rolls_back_to: sha256:2f7a...
signature: ed25519:...How a record is produced
Five stages. Each one contributes a field that a later reader can verify independently.
Define
A profile sets the tier, the mandatory checks and the thresholds they must clear.
Seal
The held-out portion of the task set is fingerprinted and closed to anything that tunes.
Measure
The agent runs k times under a recorded authority grant, producing an event ledger.
Evaluate
Deterministic checks and model-graded scores are computed from that ledger.
Record
A record states what held, who accepted it, and the version to revert to. Signing is required by higher assurance levels.
- 1
Define
A profile sets the tier, the mandatory checks and the thresholds they must clear.
- 2
Seal
The held-out portion of the task set is fingerprinted and closed to anything that tunes.
- 3
Measure
The agent runs k times under a recorded authority grant, producing an event ledger.
- 4
Evaluate
Deterministic checks and model-graded scores are computed from that ledger.
- 5
Record
A record states what held, who accepted it, and the version to revert to. Signing is required by higher assurance levels.
The measure registry
The specification is small and changes rarely. The set of things worth measuring is neither, so the two are versioned separately. Each measure declares whether it is computed deterministically or graded by a model, because only a deterministic measure may block a release.
Effectiveness
Whether the work reached a finished statetask.completionThe resulting state of your systems, measured directlydeterministictrajectory.validRequired steps present and execution within the step budgetdeterministictool.correctnessTool selection, argument validity and call countsdeterministicanswer.groundedClaims supported by retrieved or tool-returned contextmodel-graded
Efficiency
What completion costefficiency.cost_per_successSpend per completed taskdeterministicefficiency.tokens_per_successToken consumption per completed taskdeterministicefficiency.latency_per_successElapsed time per completed taskdeterministic
Robustness
Whether performance holds under repetition and failurereliability.pass_hat_kEvery one of k independent attempts succeedsdeterministicreliability.pass_at_kAt least one of k attempts succeedsdeterministicrobustness.recoveryBehaviour when a tool fails part-way through a rundeterministicrobustness.multi_turnQuality across an extended, many-turn sessionmodel-graded
Safety
The boundaries an agent has to stay insidepolicy.hard_rulesProhibited and required actions at the runtime checkpointsdeterministicsafety.injection_resistanceDirect and indirect injection, confused-deputy conditionsdeterministicsafety.tool_abusePrivilege escalation and unintended destructive callsdeterministicsafety.isolationSide effects confined to the sandboxdeterministic
Assurance
Whether the measurements themselves can be relied onassurance.judge_agreementAgreement between the model judge and a sampled human reviewdeterministicassurance.holdout_sealedHeld-out manifest unchanged and contamination probes silentdeterministicassurance.evaluator_independenceThe grader saw only the artifact and the resulting statedeterministicassurance.evidence_completeLedger present and the run reproduces the same verdictdeterministic
Measure identifiers are permanent. Where the meaning of a measure changes it receives a new identifier, so records already issued remain interpretable.
The release rule
A record may carry a ship verdict only where every gate has passed.
Gates are computed deterministically, and a model-graded measure cannot satisfy one. Where the held-out portion is unsealed, or a contamination probe has fired, the record cannot carry a ship verdict at any measured value.
Results are reported as a profile
Gates resolve to pass or fail, and every other measure is reported with its own tolerance. Collapsing them into a single figure discards the detail the record exists to preserve, and invites teams to optimise the headline while the behaviour drifts.
Thresholds belong to profiles
The specification defines how each measure is computed and leaves the acceptable value to a profile, which must be able to show the evidence behind it. A figure with reasoning attached survives scrutiny; a round number chosen for its appearance does not.
Conformance is self-asserted
An implementer states the level they meet, and the published suite lets anyone reproduce the claim for themselves. Verification stays open to third parties, which keeps the burden of proof on the implementation itself.
Tiers
Applying identical controls to a documentation fix and a payments change produces process that teams quietly route around. A profile declares a tier, and the tier determines which checks are mandatory. A profile may always demand more than its tier requires.
| Tier | Applies to | Mandatory before release |
|---|---|---|
| T0 | Local, reversible changes with existing test coverage | Deterministic checks |
| T1 | Cross-service changes, shared environments, external callers | Adds a sealed held-out portion and a reliability threshold |
| T2 | Irreversible data, customer impact, identity, payments, regulated decisions | Adds recorded human acceptance of the specific artifact, and a signature |
Conformance levels
Emitting
Produces a schema-valid record carrying SHA-256 digests for the profile, subject and task set.
Gated
Deterministic checks enforced, held-out portion sealed and fingerprinted, contamination probes present.
Calibrated
Reliability reported across repeated runs, judge version pinned, evaluator independence asserted.
Verifiable
Signed, and reproducible from the referenced ledger by an independent third party.
Level 4 addresses a specific failure mode. An immutable record guarantees only that whatever was submitted remains unchanged. Independent redeployment from the underlying ledger is what establishes that the submitted result was accurate in the first place.
The full specification
Record schema, the release rule, the measure registry and the conformance suite, on GitHub under CC BY 4.0 and Apache 2.0.
Interop and emitters
Evaluation tools run tests and store traces. An emitter writes those results into an Agent Quality Record.
A system already exporting OpenTelemetry can point assurance.evidence at that ledger. Higher levels require the corresponding checks and evidence. The draft mapping lives in RFC 0001. Emitter guides cover LangSmith, Google ADK, Inspect AI, Jev / System One and SuperQode: map peer fields onto SPEC blocks, cite only published measure ids, and never let a judged score back a gate.
TypeSafe AI Jev (System One) is called by an evaluation tool. Emitters pin the versioned model id and question-pack digest under assurance.judge, record Score / Noul grades as judged measures, and may soft-hold on low confidence. Raw confidence must never alone hard-gate ship. SuperQode emits its SystemOne ledger into the same record. See RFC 0004. Live calls must identify the judge used. Heuristic fallbacks carry their own source and confidence proxy. Judge acceptance preserves existing approval; it cannot authorize a release.
Test integrity and reward-hack evidence live under optional assurance.integrity (RFC 0005): metric custody, independent recompute, canaries, hermetic workspaces, and mechanical override when a judged PASS fails deterministic integrity. Soft-hold and escalate remain available for judged signals; those signals alone must never justify ship.
Assurance export packs map existing AQR evidence onto external programmes without new scores or gates: AIUC-1 (A008 / B010 / B006) and EU Art. 50 disclosure. Optional export.profiles[] records which packs you claim coverage against. See packs/assurance-export.
When the peer already holds an A2A Agent Card or an AIBOM / provenance artifact, emit digests only (RFC 0002, RFC 0003). SuperQode emits at L2. SuperOptiX emits at L1. Other tools may emit or only consume records.
Jev / System One
Pin model id and pack_digest, map Score/Noul to judged measures, soft-hold on confidence. Never hard-gate ship on confidence alone.
emitters/jev-systemoneSuperQode emitter
Promotion state plus SystemOne ledger (tool_gate, rubrics, confidence) serialised into an AQR. SuperQode stays the harness.
emitters/superqodeRFC 0004
Draft contract for Jev / SystemOne assurance pinning, soft hold, and optional agreement gates over stored labels.
RFC 0004RFC 0005 · Test integrity
assurance.integrity for metric custody, canaries, hermetic claims, and mechanical override. Judged evidence never alone ships.
RFC 0005Assurance export packs
Metadata-only AIUC-1 (A008/B010/B006) and EU Art. 50 disclosure mappings via export.profiles[]. Not scores or gates.
packs/assurance-exportEmitter guides
LangSmith, Google ADK, Inspect AI, Jev / System One and SuperQode: peer fields to AQR blocks.
docs/emittersOTel evidence mapping
Draft RFC for tool calls, policy decisions, attempt resets and measure derivation from OpenTelemetry.
RFC 0001A2A and AIBOM
Serialize-only Agent Card and AIBOM / SLSA digests when the peer already holds them (RFC 0002 and 0003).
RFC 0002Contributing
The specification is governed narrowly and the registry is open. The range of behaviour worth measuring exceeds any single team's experience, and practitioners can contribute test definitions from their own domains.
How changes are reviewed
Measures, profiles and adversarial packs require one reviewer from the measure group. The specification and schemas require two, one of whom is independent of the change. Two accepted proposals earn a place on the review rotation.
Contributions are made under a Developer Certificate of Origin sign-off in place of a contributor licence agreement. Authors retain copyright, which means a measure definition can be submitted without involving an employer's legal team. Specification text is licensed CC BY 4.0; schemas, packs and the conformance suite are Apache 2.0.
Commercial boundary
The commercial terms are stated in advance. The record format, the registry, published profiles, the starter packs and the conformance suite are open and accept contributions.
Superagentic AI separately provides implementation engagements, extended adversarial coverage and managed operation. Calibration data gathered across those engagements remains commercial; where it supports a threshold well enough to publish, the threshold is contributed back to the public profiles. Nothing in this arrangement prevents others offering equivalent services.
Adoption
The format is open to any implementer, and the intention is to steward it with practitioners from across the agent quality field. SuperQode and SuperOptiX are first-party emitters (SuperQode at L2, SuperOptiX at L1). These levels describe the supported record paths; each record must be checked.
ADOPTERS.md lists who is using the format, and takes a pull request from anyone who wants to be on it.
An open invitation
A record format earns its value from how many tools speak it. Evaluation platforms, agent frameworks, observability vendors, platform teams and audit tooling are all welcome to take it up.
Three ways in. Emit records after an evaluation, which for most tools is a serialiser over values they already hold. Consume records other tools produce. Shape the registry by proposing a measure, a profile or an adversarial pack.
Anyone may implement the format and check a claimed level from a record you publish.
Status and scope
Version 0.1, draft. The specification may change incompatibly before 1.0.0. Measure identifiers, once published, are permanent regardless of version.
The subject of a record is your own agent and the harness around it. Assessment of third-party products answers a different question and lives in SuperRadar.
Scope a one-agent quality pilot
Bring your agent and current evaluation stack. The pilot covers a dataset, release checks, an Agent Quality Record and handover to your engineering owner.

