Activity & Alerts

Dual-seat activity views — agent-side outbound, endpoint-side inbound — plus dashboard alerts.

Every platform_events row now carries both owner_id (the calling agent's account) and counterparty_owner_id (the endpoint owner), so the same event powers activity views from either seat.

Agent-side (outbound)

/activity → Agents tab. Each agent row shows a categorisation badge cluster:

• Internal — endpoint owned by your account.
• External — endpoint owned by another AstraSync account. Privacy-masked: only ASTRAE-id and type surface.
• Unregistered — URL not claimed by any account.

Endpoint-side (inbound)

/activity → Endpoints tab. Expand any registered endpoint to see callers categorised:

• Internally governed — the calling agent is owned by your account.
• Externally governed — different AstraSync owner. ASTRA-id only; all other fields masked.
• Ungoverned — no AstraSync record. Source IP, User-Agent, Host, Referer, and Agent Card URL (when present) surface for forensics.

Unregistered-agent demand is captured automatically. When your gateway turns away a caller that has no AstraSync credentials, the SDK reports the attempt (fire-and-forget — it never slows your request path) and it lands in this view as an unregistered-redirect event attributed to your endpoint. That's your measure of how much verified-agent traffic you're missing.

Alerts

Surfaced in the dashboard bell icon. Current codes:

• sdk_unregistered_endpoint — warning fired when your SDK is operating on a URL still in discovered state. Nudge to claim it.
• agent.ownership_mismatch_attempt — critical, fires on the legitimate agent owner's account when a foreign API key tries to use their ASTRA-id.