Signed receipts for consequential agent actions
RC6 prereleaseAgentProof
Authorise once. Execute once. Prove what happened.
AgentProof is a public developer prerelease for binding authority to one exact repository-patch transaction, executing it once, independently checking the resulting repository state, and emitting signed evidence that can be verified offline.
AgentProof 0.1.0-rc.6 packages a real local CLI and SDK around one deliberately narrow action: agentproof.repository_patch.v1. It preserves transaction-bound approval, durable state, exactly-once retry behaviour, deterministic reconciliation, independent postcondition checks, Receipt V2, and signed compensation successors.
Current status
RC6 prereleaseAgentProof 0.1.0-rc.6 is a public GitHub developer prerelease for one proven local action, agentproof.repository_patch.v1. RC5 includes transaction-bound approval, durable exactly-once execution, reconciliation, independent repository-state verification, signed Receipt V2 evidence, offline verification, and signed compensation successors. The npm prerelease, production authority/signing, hosted coordination, and additional action classes are not yet released.
This page separates the proven RC6 local action from production capabilities that remain gated.
Design goals
What AgentProof is designed to offer
These are current design goals, not claims about a generally available runtime.
- Transaction-bound approval
- Approval binds the exact prepared transaction, intent, target, policy, expiry, nonce, and authority environment rather than granting open-ended permission.
- Exactly-once execution
- Durable transaction state and idempotency prevent an ordinary retry from silently repeating the same consequential repository mutation.
- Independent postcondition check
- The receipt path observes resulting repository state instead of trusting the executor's own success message.
- Signed Receipt V2
- RC6 emits cryptographically bound receipt evidence whose trusted interpretation requires an explicitly pinned signer fingerprint.
- Recovery and reconciliation
- Interrupted executions can be re-observed and reconciled rather than guessed complete or blindly replayed.
- Signed compensation successor
- Compensation does not rewrite the original receipt; it creates an authenticated successor that binds back to the prior evidence.
Current limits
What AgentProof is not claiming
Product limits and maturity are part of the public description, not footnotes.
- Only agentproof.repository_patch.v1 is enabled in RC6
- Development authority is not production authority; no production KMS/HSM signer is shipped
- No hosted coordinator, remote action router, merge, deploy or release action is enabled
- The npm prerelease is not yet public; the current packaged prerelease is distributed through GitHub
Current status
A real developer prerelease, not production authority
AgentProof RC6 already executes one bounded local repository-patch transaction and emits signed, independently checkable evidence. The remaining work is distribution, adoption proof, production authority/signing and carefully canaried additional action classes.
Product family
How the products fit together
Each product has a distinct job, and their maturity is stated independently.
Live
DoneState
Automated maintenance that stays reviewable.
Available
OpsTruth
Check what changed without changing it again.
DoneState prepares reviewable repository maintenance. OpsTruth checks software evidence independently. AgentProof is the future signed-evidence component and remains in development.