Execweave links software actions to system events for clearer traces
ExecWeave: Cross-Layer Execution Provenance for Observable Agentic Software
Cryptography and Security
Summary
When software runs, it does many things behind the scenes like opening files or talking to other computers. Computer systems record low-level activities but often don't show which part of the software caused them. The authors designed ExecWeave to connect what the software intends to do with what actually happens on the computer by creating a detailed graph of actions and their effects. This helps people understand exactly which software commands led to each system event, making it easier to trace and debug complex software behaviors.
What this means in practice
- •For software developers: Trace and debug complex software by connecting program actions to system activities with clear causal links.
- •For security operation teams: Investigate security incidents by accurately attributing system events to specific software commands and tools.
Authors
Guo-Wei Wong, Meng Chang Chen
Abstract
Agentic software invokes tools, launches processes, accesses files, and communicates with local or remote services. Application traces describe logical operations, whereas operating-system telemetry records machine activity without necessarily identifying the responsible agent action. Relating these evidence planes is a reconstruction problem: a plausible but unsupported association can assign an effect to the wrong principal. We present ExecWeave, a local-first system that materializes provider semantics and independently observed runtime events into a typed execution graph. The implementation retains separate source artifacts, distinguishes logical occurrences from repeated evidence, and records attribution, inference, and causal-status metadata. An optional command-to-process correlator emits a non-causal inferred bridge only when its bounded search yields one compatible observed process; uniqueness within this observed candidate set is not a guarantee of causal correctness. OS-observed file and network effects acquire a semantic tool or agent principal only through an observed process plus a justified command-to-process association; session-correlated file-system events do not by themselves provide that principal. Source code is available at https://github.com/Irish-kw/ExecWeave.