The fleet evidence view

Fleet evidence shows what your people’s machines have delivered over the last 30 days: how many pages their agents read, from which sites, in which sessions. The headline counts, the chart and the top source hosts cover those 30 days; Last received is the latest delivery at any time. Every time on the page is in UTC.

The headline

• Retrieved counts pages an agent fetched.
• Grounded counts pages whose text went into the model’s context. A grounded page is usually also counted under retrieved, so the two are shown side by side and never added up.
• Sessions counts the agent sessions that delivered anything in the last 30 days.
• Source hosts counts the sites the pages came from.
• Refused crossings (count only) is how many fetches your policy refused, added up over the sessions that reported a count, and under it how many of the sessions did: “from 1 of 2 sessions”. A machine whose Common Measure does not report the count adds nothing. Each session’s count is its running total when it last delivered. A dash means no machine has reported one yet.
• Last received is when the latest delivery arrived.

Citations (an agent’s answer named a page it read) are received, kept and delivered to content owners, and no count on this page includes them.

Before the first delivery

With nothing received in the last 30 days, the page shows the enrol card instead: an owner’s Enrol an edge, for a member they choose, or a member’s Enrol this machine, for their own. It prints the same commands as on API keys.

While the page is open it asks the hub every 5 seconds for a session that arrived after the last delivery it knows of. When one arrives, it replaces the card without a reload and the page stops asking. If you switch organisation in another tab, the page stops asking; reload it. The session is shown open:

• its retrieved, grounded and refused counts;
• Host, the agent host its events name, as delivered: commonmeasure-first-run for the installer’s own fetch, claude-code, codex and so on for a registered host;
• its source hosts with their counts, and the licences its events declared;
• what stayed on the machine: prompts and answers, the pages and reasons behind refused fetches, internal-corpus traffic, policy detail and engagement names.

The next time the page loads it shows the usual view. Without JavaScript the page shows the card and does not ask; reload it to see a delivery.

The first delivery to the organisation also sends one email to each of its owners, and none to members: the session’s counts, host, source hosts and licences, a link to this page, and the list of what never leaves a machine. It is sent once for the organisation. A later session, a second machine, retention removing old evidence and a closed organisation’s purge send nothing more.

Recent sessions

One group per session, for the 50 sessions most recently seen, however long ago; an older session is not listed.

The header shows the delivery key names, or a shortened session ID when no key name is available. Counts and Last seen stay visible. Open Session details for the complete session and agent IDs, the host, relay version and start time.

• Session ID: the complete session identifier.
• Host: the agent host the session’s events name, as delivered, such as claude-code or commonmeasure-first-run (the installer’s own fetch). Not reported where the events name none, or where the session’s evidence is older than the retention period and its host is not kept.
• Agent ID: the key id of the machine’s enrolled edge, or commonmeasure where no enrolled key signed the fetches (an edge that has not enrolled, a session recorded before its machine enrolled, or a published run whose sources came from a supplier under your own credential).
• Retrieved and Grounded: the session’s counts.
• Refused: how many fetches the policy refused in the session. It is a count only: no page, site or reason for a refusal leaves the machine. Each delivery carries the session’s running total, and the hub keeps the largest it has received, so a repeated delivery counts once. Not reported means that machine’s Common Measure does not report the count.
• Key: the name given when the machine was enrolled. Name each machine so you can tell whose it is.
• Member (owners only): the member the machine belongs to (API keys), or “No member” for a machine enrolled before machines had members and for a session no enrolled machine delivered. A session is put on a member only when that member’s enrolled machine delivered it with its own ingest key: the hub refuses a machine’s delivery under another machine’s key id, and a session delivered with an ingest key you minted by hand shows “No member”. The field appears only when at least one listed session belongs to a member. Members do not see it.
• Relay: the version of Common Measure that delivered it (commonmeasure-relay/<version>).
• Last seen: when the session’s latest delivery arrived. The list is ordered by it, most recent first.

Long names and identifiers wrap within their groups; their complete values remain available to read and copy. Missing agent IDs and relay versions show Not reported.

Top source hosts

The 20 sites most pages came from in the last 30 days, ranked, with their counts and when a page was last read from each.

What is not here

Prompts, answers, the pages and reasons behind refused fetches, and engagement names never leave your people’s machines, so the view has no breakdown by engagement or client. It groups by what the Content Telemetry wire carries: organisation, session, agent, source host, ingest key and day. A reload shows a delivery that arrived while you read.