Four steps, one workflow.
Cluster
Detectors mine ClickHouse traces every 6h: silent failure (promised action without tool call, tool error swallowed, no-progress loop, claimed completion without tool), behavioral drift (output length z-score, refusal-rate spike, tool-call drop), and red-team failures.
Explain
Each finding ships with a suspected cause derived from the cluster's shared evidence. Not 'something looks wrong' — 'tool schema allows money movement before identity confidence is verified, seen in 7.3% of refund conversations.'
Repro + remediate
Auto-generated repro test ships to your repo at vouch-tests/<finding-id>.spec.ts. Vouch-bot opens a remediation PR with the policy gate snippet. Tests stay in CI.
Triage
Findings inbox with severity, source (REDTEAM / FIREWALL / INTENT / CERT / SBOM / NETWORK / vouch-ai), supporting traces, and triage actions. RBAC-gated for security review.
Findings ship in your inbox, not a slide deck.
Severity, source, supporting evidence, and a PR draft — all in one place.