For the research side of the independent observation channel, I would start with “AI Control: Improving Safety Despite Intentional Subversion” (arXiv 2312.06942). It assumes the agent may be trying to get around the monitor, which is the same threat model as your level-two observer. On the practical side, one thing that helped me: make the record append-only and hash-chained, so a later step cannot quietly rewrite history. I work on FerrumDeck, an alpha control plane where a run that needs approval parks as WaitingApproval, and audit events are append-only with a per-tenant hash chain. That is tamper-evident, not tamper-proof, and it only governs its own runs, so treat it as a reference, not a drop-in.
What will the agent act on in the prototype: files and shell, or API calls?