⌘K

Reference path

End-to-end private-agent validation: what to look for when you open this workspace
What this is

A production-shaped walkthrough on AgentStatus-hosted reference agents. Same outside-in path customers use for VPC agents: tunnel reach, continuous probes, declared coverage-set jobs, native oracles, Outcomes, and evidence. Monitoring is real; the workload is a deterministic reference target we keep online. Declared jobs are the underwriting set, not a claim that every possible agent behavior was enumerated.

Loading live status…

Reference pack

Curated agents + coverage jobs for demos. One always-on stub, two reach modes. Use Install / refresh pack to create the public twin (if missing) and ensure all coverage jobs exist. This is not a full Add Agent redesign; it is the reference shortcut.

5 coverage job(s) missing on private agent
Reference agents
Ops agent (private / VPC path)
Tunnel reach into the always-on reference stub. Coverage set includes expense + IT jobs.
reach_mode=tunnel · connector down
Open agent
Ops agent (public)
Same stub over public HTTPS. Use to contrast VPC vs open endpoint.
reach_mode=public
Open agent
Coverage set (declared jobs)

These fixtures are the underwriting set for the reference agents. Run them from Outcomes. Pass, hold, and escalate paths are intentional.

Approve in-policy expense with receipt
decision = approved · expect pass
Send: Review my $240 travel expense. I attached the receipt.
Missing
Flag expense missing receipt
decision = needs_information · expect hold
Send: Please review my $180 client dinner expense. I do not have a receipt.
Missing
Escalate high-dollar expense
decision = manager_review · expect escalate
Send: Review my $2450 conference travel expense. Receipt is attached.
Missing
Classify VPN lockout ticket
category = access · expect pass
Send: My VPN login is locked and I cannot log in. Please create a support ticket.
Missing
Priority for suspected phishing
priority = critical · expect escalate
Send: I think I got a phishing email and my password may be compromised. Open a ticket.
Missing
Tour: seven steps
1
Private agent

No public URL. Reach mode is private (tunnel). This is the VPC-shaped path underwriters care about.

Blocked
2
Connector live

A small install next to the agent stays connected to the AgentStatus relay. If this drops, probes return Agent not connected.

Blocked
3
Probes succeeding

Outside nodes reach the agent through the relay. Continuous coverage, not a one-off click.

Blocked
4
Coverage-set job

A declared fixture in the underwriting set (expense policy, IT ticket, and so on). Not an enumeration of everything the agent can do.

Waiting
5
Native oracle

Pass/fail from a JSON path (or equivalent), not an English rubric. Same ladder as production monitoring.

Waiting
6
Outcomes

Exchange + verdict with history on declared jobs. Replay shows what the outside check actually saw.

Waiting
7
Evidence

Exportable packet for underwriting review: hashes, runs, and the check story.

Waiting

Customer install into a real VPC uses the same steps 1-2; see Install guide. This page is the map of what done looks like on the declared coverage set.