---
title: "Agent Infrastructure Went Open Source. The Record Didn't."
slug: "open-source-agent-infrastructure-who-governs-the-agents"
author: "Miguel Amigot"
date: "2026-09-24 13:00:00"
category: "Premium"
topics: "open-source AI agents, agent governance, audit trails, LLM serving trace, agent infrastructure, self-hosted AI, MCP broker, agent memory"
summary: "Chutes and researchers at Harvard and Chicago released 6,122,413,756 production LLM requests across 9,174 models — in twelve metadata fields that hold no prompts, no responses and no tool calls."
banner: ""
thumbnail: ""
linkedin: |
  Chutes and Harvard researchers published a year of production LLM traffic in September 2026: 6.12 billion requests, zero prompts.

  The trace is real and it is large — 6,122,413,756 rows, 9,174 models, 314,970 anonymized users, 11 April 2025 to 12 April 2026, a 91 GB Parquet file on a Harvard S3 bucket.

  It has twelve fields: request id, endpoint, model id, user id, rotation round, serving instance, start and completion times, input tokens, output tokens, cached tokens, time to first token.

  No prompt. No response. No tool call. No retrieved document. The largest public record of production LLM serving ever released measures throughput, not conduct — and that is the honest shape of what open source has settled.

  Three corrections worth making, because the framing decides what you build next:

  → The paper does not find that organizations have zero visibility into their models. Its abstract says existing workload *studies* offer "limited visibility into how users interact with models in production" — a statement about the research literature, not about your deployment
  → The 34,000-star repository attributed to Jack Dorsey is Buzz, a self-hostable workspace released by Block on 21 July 2026 under Apache 2.0, not an agent framework. Block's agent framework is goose, now at the Agentic AI Foundation with 54,612 stars
  → Axis Robotics did not open-source all its training data. Axis Sim Dataset V1 shipped on 4 September 2026, and its Hugging Face card gates access behind approval for non-commercial academic use, with commercial use and redistribution not permitted

  Building is solved. Governing is not, because no framework ships the record of what your agents retrieved, called and changed inside your systems.

  With ibl.ai you own all the code and the data — self-hosted inside your own perimeter, model-agnostic across any LLM, usage-based with no per-seat pricing, deployable anywhere from your own cloud to a fully air-gapped network.

  #iblai #AgenticAI #EnterpriseAI #OpenSource #AgentGovernance #AuditTrail
---

## The Short Answer

**Chutes and researchers at Harvard and the University of Chicago published a year of production LLM traffic in September 2026 — 6,122,413,756 requests across 9,174 models, in twelve metadata fields that contain no prompts, no responses and no tool calls. Open frameworks ship capability, not a record of conduct. With ibl.ai you own all the code and the data, and that record stays inside your perimeter.**

Three artifacts landed in the same month. Each settles the build question and leaves the governance question where it was.

## What did Harvard and Chutes actually release in the production LLM traffic dataset?

A one-year serving trace from a commercial inference provider, published with a paper — not, strictly, a Harvard release.

The paper is [*A Year in LLM Serving: Workload Evolution, Caching and Load-Balancing*](https://arxiv.org/abs/2608.13573), by William Nixon, Jon Durbin, Florian Standhartinger, Haryadi S. Gunawi and Juncheng Yang. Its arXiv history records v1 on 3 July 2026 and v2 on 7 September 2026.

The traffic is Chutes', the decentralized inference platform running as Bittensor's Subnet 64, whose founder Jon Durbin is a co-author. Juncheng Yang is an assistant professor at Harvard; Haryadi Gunawi is at the University of Chicago.

So a provider opened its logs, academics analyzed them, and Harvard hosts the bucket. The paper itself anonymizes the provider as "CompanyX".

The scale is genuine. [The release repository](https://github.com/HarvardMadSys/chutes_workload) documents **6,122,413,756 rows** across **9,174 models**; [Crypto Briefing](https://cryptobriefing.com/chutes-harvard-6-billion-llm-requests-dataset/) adds **314,970 anonymized users**, **35.8 trillion input tokens** and **2.52 trillion output tokens** between 11 April 2025 and 12 April 2026.

It ships as a single **91 GB** Parquet file, in a repository created on 4 September 2026.

## Does the LLM serving paper find that organizations have no visibility into their models?

No, and the distinction matters more than the headline.

The claim circulating with this release is that most organizations running AI in production have zero visibility into what their models are doing. That is a gloss added in social coverage, not a result in the paper.

What [the abstract](https://arxiv.org/abs/2608.13573) says is that existing LLM serving workload *studies* "remain limited in scale and scope," observe short periods, and "provide limited visibility into how users interact with models in production."

That is a statement about the research literature — the reason to release a year-long trace at all. Nothing in the paper measures enterprise observability.

The narrower fact is in the dataset schema. The trace has twelve fields: `invocation_id`, `function_name`, `chute_id`, `user_id`, `rehash_round`, `instance_id`, `started_at`, `completed_at`, input tokens, output tokens, cached tokens and time to first token.

None of them is a prompt, a response, a tool call or a retrieved document.

The largest public record of production LLM serving ever assembled tells you what was served, how fast, and to which anonymized user — and nothing about what any model was asked or did.

That is the shape of the record open infrastructure produces by default.

## Is Jack Dorsey's 34,000-star repository an AI agent framework?

Not quite, and the repository it is confused with is larger.

The project behind that star count is **Buzz**, released by Block on 21 July 2026 under Apache 2.0.

[TechCrunch's launch coverage](https://techcrunch.com/2026/07/21/jack-dorsey-is-taking-on-slack-with-buzz-a-group-chat-platform-for-teams-and-their-ai-agents/) quotes Dorsey describing it as "model-agnostic, decentralized, self-sovereign, and open source," built to reduce Block's dependency on Slack and GitHub.

[The repository](https://github.com/block/buzz) shows **34,236 stars and 4,531 forks** as of 24 September 2026, on a repo created 6 March 2026. Its README calls it "a self-hostable workspace where humans and AI agents share the same rooms," built as a Nostr relay.

That is a workspace, not an agent framework. Block's agent framework is goose, now at the Agentic AI Foundation and [showing 54,612 stars](https://github.com/aaif-goose/goose) under Apache 2.0.

Buzz deserves credit on this exact axis, because it is the partial counterexample.

Its README says "every message, reaction, workflow step, review approval, and git event is a signed event in one log," with agents holding their own keys, channel memberships and audit trail.

That is real governance, and it is scoped to the workspace.

A signed record of what an agent posted, reviewed and merged in Buzz is not a record of which documents its model retrieved, which tools it called against your systems of record, or with whose credentials.

## Did Axis Robotics open-source all of its training data?

No. It released one dataset, on terms that are not open in the sense the claim implies.

[Axis Robotics announced Axis Sim Dataset V1 on 4 September 2026](https://www.globenewswire.com/news-release/2026/09/04/3356410/0/en/axis-robotics-open-sources-one-of-the-largest-franka-arm-simulation-datasets-for-physical-ai.html): more than **50,000** human-teleoperated simulation trajectories across **207** manipulation tasks and **60,000+** scene variants on a simulated Franka Research 3 arm.

The release also says V2 is in development, which alone rules out "all training data."

The licence is the sharper correction. [The Hugging Face dataset card](https://huggingface.co/datasets/axisrobotics/Franka-Dataset) lists the licence as "other," gates access behind approval for non-commercial academic use, and says commercial use, redistribution and resale are not permitted.

A gated, non-commercial, approval-required dataset is a publication, not an open-source release; the Chutes trace above ships under CC BY 4.0, which is what the open version looks like. Repeating the looser claim is how a team plans a deployment around terms it does not have.

## What does an open-source agent stack still not record about your agents?

The four things an auditor asks for, none of which arrives with a licence.

- **What the agent retrieved.** Which documents entered the context window for a given turn, from which source, at what time.
- **What the agent called.** Each tool invocation with its inputs and outputs, not a summary that the run succeeded.
- **Which model answered.** The provider and model behind a specific response, because in a model-agnostic stack that changes between turns.
- **What the agent was allowed to reach.** A deny-by-default decision per call, made by something the agent cannot talk past.

Y Combinator's QM harness makes the point from the other direction: [open-sourcing the harness turned it into infrastructure](/blog/yc-open-sources-qm-multi-agent-harness-company-infrastructure) anyone can run, which is why the differentiation moved below it.

It is the same conclusion as [DeerFlow 2.0's own README, which states it does not inspect tool arguments](/blog/deerflow-open-source-agents-governance-layer). A harness is a runtime, and the good ones say so.

This is why the capability layer keeps commoditizing while [most vendors still ship only layer one](/blog/five-layer-agent-architecture-what-ships-is-layer-one). Frameworks depreciate on an 18-month cycle; the record of what your agents did has to outlive all of them.

## How does ibl.ai record what your agents actually did?

By making the record a property of the platform you run, not of whichever framework is trending.

With ibl.ai you own all the code and the data.

It runs on your own infrastructure with full source code access, is model-agnostic across any LLM, is usage-based with no per-seat pricing, and deploys anywhere — your own cloud, on-premise, GovCloud, or a fully air-gapped network.

Every AI turn is inspectable. [The September 2026 platform release](/updates/platform-update-2026-09-11) surfaces the retrieved documents, the tool calls with their inputs and outputs, the model and provider that produced the answer, and the request context with credentials stripped.

The conversation list carries per-conversation rollups, so an operator can see which conversations used documents or called tools without opening each one.

Agent memory is scoped rather than ambient: memories default to the agent's own scope, temporary state carries an expiry and is purged nightly, and duplicate detection runs semantically across an agent's categories.

Underneath, the MCP broker is one control plane over many MCP servers, with deny-by-default RBAC, credential injection and audit logging. The harness is a sandboxed runtime with isolated execution and allowlisting, running on your infrastructure.

You can read the code that writes the audit trail rather than accept an assurance about it. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.

ibl.ai is family-owned and operated from New York, NY.

*Related reading: [DeerFlow 2.0 is free, your governance layer is not](/blog/deerflow-open-source-agents-governance-layer) — the same boundary in an open harness's own README; and [YC open-sourced QM and the harness became infrastructure](/blog/yc-open-sources-qm-multi-agent-harness-company-infrastructure) — why giving the runtime away moves the value below it.*

*Sources: the paper, authors and submission history from [arXiv](https://arxiv.org/abs/2608.13573); the row count, schema, file size and repository creation date from [the release repository](https://github.com/HarvardMadSys/chutes_workload); the user count, token totals and traffic window from [Crypto Briefing](https://cryptobriefing.com/chutes-harvard-6-billion-llm-requests-dataset/); the Buzz launch date and Dorsey quote from [TechCrunch](https://techcrunch.com/2026/07/21/jack-dorsey-is-taking-on-slack-with-buzz-a-group-chat-platform-for-teams-and-their-ai-agents/); the star counts, licence and README language from [the Buzz repository](https://github.com/block/buzz) and [the goose repository](https://github.com/aaif-goose/goose); the Axis figures from [GlobeNewswire](https://www.globenewswire.com/news-release/2026/09/04/3356410/0/en/axis-robotics-open-sources-one-of-the-largest-franka-arm-simulation-datasets-for-physical-ai.html) and the access terms from [the Hugging Face dataset card](https://huggingface.co/datasets/axisrobotics/Franka-Dataset).*

## Why does owning the AI stack matter?

**ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.**

- **You own all the code and the data.** Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours.
- **Model-agnostic.** Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform.
- **No per-seat pricing.** Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ.
- **Deploy anywhere.** Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity.

1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.

ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.