Reading a recorded agent run

A recording is evidence. Your memory of a session is not, and neither is a transcript you were handed, both are missing the tool results, the exit codes, and the files that changed without anyone mentioning it.

The rule: when a question is about something that already happened, read the trace before you answer. Do not reconstruct it. If a recording exists, guessing is the wrong move even when the guess would have been right.

When to Use This Skill

• "Why did you delete/overwrite/move X?"
• "What changed this file?" / "Which step broke the build?"
• "Can you reproduce yesterday's failure?"
• "Does this still reproduce?" (see the limit on that in step 4, replay cannot tell you whether a fresh run would fail again)
• "Would a different model have got this right?"

Workflow

1. Find the run

orca_list_runs, newest first, and it names the run each fork came from. Skip this only when the user clearly means the most recent one; every other tool defaults to run: "last".

2. Narrow to the chain that produced the thing being asked about

orca_show_run gives the whole timeline: model turns with token counts and stop reasons, tool calls with arguments and results, shell commands with exit codes, and every file the run changed. Good for orientation, long for a specific question.

orca_graph is usually the better tool. It returns causal edges, which event produced which. Pass to: <event seq> to get only the chain that produced one event. That is the shape of an answer to "why did this happen", where the full timeline is the shape of an answer to "what happened".

3. Report recorded and inferred differently

Every edge from orca_graph is labelled:

• recorded, the recorder watched it happen and wrote it into the trace.
• inferred, derived just now from a rule the edge names. The trace does not vouch for it.