Trusting long-running agents

The longer an agent runs, the less useful “it finished” becomes as the only success criterion.

Editor's note - July 30, 2026: This article preserves the v0.2 workflow it originally documented. In v0.3.0, cryptography is a core dependency, so the crypto extra is only a compatibility alias. Also, tine tag removes an existing artifact signature and warns; re-sign after changing tags. Provider-neutral billing and Budget(strict_cost=True) are now available when incomplete pricing must stop a run.

You also need to know what it spent, what policy constrained it, whether the artifact survived a crash, whether its content changed in transit, and exactly how a repaired branch differs from the failed one.

opentine 0.2 treats those questions as one operational workflow.

Checkpoint while work is happening

An end-of-run save is too late when the process has already disappeared. Autosave streams atomic draft checkpoints during native-agent and harness execution.

from opentine import Agent
from opentine.models.anthropic import Anthropic

model = Anthropic()
agent = Agent(
    model=model,
    autosave_path="research.tine",
    autosave_every_n_steps=1,
)
run = agent.run_sync("Complete the research task")

The file is usable during the run, and its protected draft flag tells a reader that the artifact is incomplete. On clean completion, opentine flushes the final non-draft artifact.

Atomic replacement matters here. A checkpoint is either the previous complete write or the next complete write—not a half-serialized file left behind by interruption.

Put the budget beside the work

A dashboard can tell you what a run cost after the fact. A budget inside the run policy can change what happens before the next expensive step.

from opentine import Agent, Budget
from opentine.models.anthropic import Anthropic

model = Anthropic()
agent = Agent(
    model=model,
    budget=Budget(max_cost=0.50, on_breach="stop"),
)

Use stop when a partial, inspectable artifact is a valid outcome. Use raise when the caller must treat budget exhaustion as a hard failure.

tine cost research.tine

The resulting report combines per-step usage, total tokens, provider cost, and current budget state. Local adapters can truthfully report zero cost instead of inheriting an unrelated cloud price.

Sign the content boundary

An integrity digest answers “does this artifact still match itself?” A signature answers “does it match content authorized by this key?”

HMAC is available without an extra dependency:

export TINE_KEY="a-long-secret-value"
tine sign research.tine --key-env TINE_KEY --key-id nightly
tine verify research.tine --key-env TINE_KEY

For public-key verification, install the crypto extra and generate an Ed25519 keypair:

pip install "opentine[crypto]"
tine keygen --out opentine-signing.key --pub opentine-signing.pub
tine sign research.tine --algorithm ed25519 --ed25519-key-file opentine-signing.key
tine verify research.tine --pubkey opentine-signing.pub

Key identifiers and signer labels are descriptive metadata, not identity systems. Trust comes from how you distribute and protect the keys.

Tags should not invalidate trust

Operational metadata changes. A run may be tagged candidate, then verified, then prod. Those labels live outside the content digest and signed payload so indexing work does not pretend the execution itself changed.

tine tag research.tine --add verified
tine search "tag:verified status:completed"

Budgets and draft state are different: they describe the governed execution and are protected.

Compare the repaired branch

After a failed run is checkpointed, verified, and found, the next move is usually a fork.

tine fork failed.tine --from-step 3 --save retry.tine
tine diff failed.tine retry.tine

Field-level diff shows more than added and removed steps. It reports aligned changes in inputs, outputs, errors, model and tool metadata, usage, and cost. The question becomes precise: which fields changed at the divergence point, and what did that change buy?

A practical gate

For a consequential long run, use a small gate before sharing or promoting it:

1. Confirm the artifact is not a draft.
2. Verify its digest and required signature.
3. Inspect cost and budget state.
4. Tag the reviewed artifact.
5. Diff it against its parent or prior baseline.

None of these steps requires uploading the run to a service. The artifact, index, and keys can remain inside your own environment.

Trust is not one feature. It is the result of preserving state, recording policy, checking integrity, and making change legible. Version 0.2 makes those operations part of the same local-first system.