Commitments
SHA-256 commitments to collector-observed events and recorded repository states.
A local receipt for agent runs
The chat moves on. Keep the receipt.
AgentProof leaves a small local receipt made from hashes—digital fingerprints of events its collector could see and of repository states it checked. Later, Verify compares those recorded commitments with the current repository.
It is an unsigned, operator-side record—not a replay, an independent audit or proof that the work was correct.
Codex · Claude Code · OpenClaw
AGENTPROOF / LOCAL RECEIPT
ILLUSTRATIVE
RUN RECEIPT
Observed commitments
LOCAL
- collector
- host-specific
- receipt chain
- internally consistent
- repository check
- MATCH
- raw content in final receipt
- not persisted
01Observed event commitmentsha256:9f83…18a2
02Repository end commitmentsha256:c720…4d91
03Explicit limitsobserved ≠ complete
CHAIN HEAD
7b26e9c1…ca04
The final receipt keeps hashes, relative paths and selected metadata. Capture may transiently observe host event data; raw source, prompts, commands, outputs and diffs are not persisted in the receipt.
Records collector-observed events
Compares checked repository commitments
Does not establish completeness, authorship or quality
The moment it becomes useful
The agent says “done.” Three days later, the chat is not the record you need.
The summary may be confident. The conversation may be compacted, buried or simply too long to inspect. AgentProof does not try to preserve that story. It leaves a smaller artifact: commitments to events its collector could see, alongside repository states checked during the run. That question becomes harder when another session—or another collector—later touches the same repository.
You may never need the receipt. If you do, it has to exist already.
Where it earns its keep
For repositories that outlive the conversation.
AgentProof is most useful when several captured runs—or collectors on different hosts—touch code that will still matter later. A receipt can show which paths were observed as changed during one captured window and let a maintainer compare its final commitments with the repository now.
That supports internal continuity and cooperative review. It does not prove who caused a change, capture every relevant action or create independent evidence against another party.
A strong fit
- Platform and developer-experience teams introducing agents into an established engineering process.
- Repositories maintained and revisited over time.
- Several captured agent sessions or host-specific collectors touching the same codebase.
- Cooperative internal review where preserving a limited technical record is useful.
Use something else when
- The work is a disposable experiment that nobody expects to revisit.
- You need to replay the conversation or recover raw commands, output or source from the receipt.
- You must prove responsibility to a client, auditor, regulator or other counterparty.
- The evidence must be independently witnessed, signed or publicly anchored.
Why the boundary matters. Marketplace receipts are unsigned. Their producer can recompute the chain, so internal consistency is not producer-independent tamper evidence.
A receipt, not a recording
Check whether the recorded commitments still match the current repository.
This small demonstration shows the question Verify can answer. It does not attribute a later change or judge whether that change was legitimate.
RECORDED PATH
src/checkout.py
final commitment c720…4d91
CURRENT REPOSITORY
MATCH
sha256:c720…4d91
The checked commitment currently matches the receipt.
A MISMATCH is not an accusation. It says at least one checked commitment no longer matches. The difference may be legitimate later work. The receipt does not tell you who changed it or why.
What survives the conversation
Enough to compare. Not enough to replay.
Paths and metadata
Relative repository paths, selected typed metadata, explicit gaps and limits.
Raw private content
The final receipt does not retain source bytes, prompts, command text, tool inputs and results, outputs, responses or diffs.
Session replay
The hash-only receipt cannot reconstruct the conversation or tell the story again.
A deliberate path, without adding friction today
Start with the receipt. Add assurance only if you need it.
The marketplace collectors stop at a useful local record. The canonical receipt was kept compatible with a separate assurance path, so a team would not need to recapture the original run before adding a signature or a later public timestamp.
-
LOCAL · AVAILABLE FREE
AgentProof Local
Capture + Verify create and check a local, unsigned, hash-only receipt. No HREVN account, credential or service is required.
-
ASSURANCE · POTENTIAL PAID CAPABILITY
Sign, with optional Anchor
A party other than the receipt's producer could sign its exact canonical bytes; optional anchoring could add a public timestamp from the time of anchoring. Assurance is not available and cannot currently be purchased.
No upgrade is required to use AgentProof today. The current Codex, Claude Code and OpenClaw marketplace collectors expose Local Capture + Verify only. Assurance would establish narrow signature and timestamp properties—not truth, authorship, completeness or work quality.
Voluntary product research
Would Assurance solve a real problem for your team?
Tell us which production need sits beyond the free local receipt. This is an inbound research signal—not an order, reservation, waitlist or promise of a product, price or delivery date.
HREVN will not treat this form as proof of market demand. It complements direct research conversations with platform and engineering teams.
One receipt doctrine, three host-specific collectors
The host changes what can be observed.
AgentProof does not flatten three different execution environments into one claim. Each collector states how it starts, what it observes and what remains outside its evidence boundary.
01
CODEX
A new captured session
OPENAI DIRECTORY STATUS
PUBLISHED 31 JUL 2026 · v0.1.0
Starts a separate, non-interactive Codex CLI child. It does not capture the Codex conversation that invoked the Skill.
- Observed
- Hash-only command and file-change evidence exposed to the collector
- Connection
- The installed Codex CLI uses its existing authentication and normal network behavior
- Use it
- Start the important task through AgentProof
The requested child sandbox remains part of the run. Capture is not a claim of completeness or authorship.
Install from the OpenAI directory →
02
CLAUDE CODE
A new Bash-only session
DIRECTORY STATUS
SUBMITTED 27 JUL 2026 · REVIEW PENDING
Starts a separate Claude Code run with Bash as its only agent tool, then cross-checks its event stream, hooks and repository snapshots.
- Observed
- Bash event commitments and before/after repository commitments
- Boundary
- Requests the native sandbox; administrator policy may change the effective boundary
- When listed
- Approve and start the important task through AgentProof
It cannot capture the invoking conversation, does not override administrator policy and does not claim to know the complete effective policy.
View Claude Code source →
03
OPENCLAW
The current run, recorded in-process
CLAWHUB STATUS
AVAILABLE NOW · v0.1.0
Runs inside OpenClaw and records commitments to hook events exposed for the current run, plus repository changes visible to Git snapshots. It does not launch another agent.
- Observed
- Tool-event commitments exposed by hooks and repository changes visible to snapshots
- Boundary
- A tool that emits no hook can be invisible unless its change appears in a repository snapshot
- Use it
- Enable AgentProof before the run that matters
Capture is host-version gated. Local Verify remains separate from the live hook contract.
For agents reading this page
When to invoke AgentProof—and when not to.
The decision boundary is part of the product. A receipt is useful only when its narrower question is the question you actually need answered.
Use AgentProof when
- A user wants a new important Codex or Claude Code task to leave a local receipt.
- An OpenClaw operator has enabled Capture before the run begins.
- A user wants to compare a strict receipt with the current repository.
- The explicit collector limits are acceptable for the task.
Do not use it to
- Reconstruct a past session or the current invoking Codex or Claude Code conversation.
- Prove exclusive causation, authorship, completeness or correctness.
- Turn
MATCHinto “verified work” orMISMATCHinto wrongdoing. - Claim compliance, legal evidence, payment authorization, signing or anchoring.
The honest boundary
A useful record can still be a limited record.
The marketplace collectors deliberately expose no HREVN service, credential, Sign, Anchor, payment or settlement path.
It can establish
It does not establish
It can establishWhether the canonical receipt and its internal event chain validate
It does not establishThat every relevant action was observed
It can establishWhether checked final repository commitments currently match
It does not establishWho produced the state or why it later changed
It can establishWhich observed paths within the collector's supported snapshot scope changed during the captured window
It does not establishChronological edit order or exclusive agent causation
It can establishWhich collector profile and explicit limits accompanied the receipt
It does not establishTruth, work quality, safety, compliance or legal admissibility
Looking for the signed certificate and public Anchor system built for OpenAI Build Week? That is a separate AgentProof assurance line with different guarantees. View the Build Week landing →
Two adjacent questions
Start with the question you searched. Continue with the product you can use.
These guides explain the terms people often use too broadly, then point back here for current collectors, installation and host-specific limits.
Is an AI agent session receipt an audit trail?
See what a local receipt can support in later review—and why it is not an independent or exhaustive audit.
Read the audit-trail guide →What makes AI agent evidence verifiable?
Separate repeatable receipt checks from claims about truth, authorship, completeness and work quality.
Read the evidence guide →Questions worth answering before installation
What the receipt means—and what it never means.
Is an AgentProof receipt legal proof?
No. It is a technical record of collector-observed events and checked repository commitments. It does not establish legal admissibility, complete capture, authorship, truth or work quality.
Is AgentProof an independent AI agent audit trail?
No. The marketplace collectors create local receipts and are not independent or exhaustive witnesses. AgentProof preserves explicit limits so the receipt is not mistaken for a complete audit trail.
Who is AgentProof most useful for?
AgentProof is most useful for internal platform, developer-experience and engineering teams whose maintained repositories receive changes from multiple captured agent runs or host collectors. It supports continuity and cooperative review; disposable prototypes and adversarial accountability are poor fits.
Can an unsigned AgentProof receipt prove something to a client or auditor?
Not independently. Marketplace receipts are unsigned operator-side records, and their producer can recompute the chain. They can support internal coordination among cooperating parties, but they do not provide producer-independent evidence of authorship, completeness or time.
Where can I get AgentProof today?
The Codex collector version 0.1.0 is published in the OpenAI plugin directory. OpenClaw is available now on ClawHub. The Claude Code collector was submitted to Anthropic on 27 July 2026 and is pending review; its source is public on GitHub.
What files did Codex change?
Within its supported snapshot scope, the Codex collector records observed repository paths whose state changed during the separate captured child session. It does not prove that Codex exclusively caused those changes or establish their chronological edit order.
What files did Claude Code change?
Within its supported snapshot scope, the Claude Code collector records observed repository paths whose state changed during the separate captured child session. It does not prove that Claude Code exclusively caused those changes or establish their chronological edit order.
Is AgentProof a Claude Code session log?
Only in a narrow sense. AgentProof records hash-only commitments to observed Bash events and repository state from a separate Claude Code session started through its collector. It does not log the invoking conversation, persist raw commands or output, establish complete capture, prove exclusive authorship or judge the work.
What files did OpenClaw change?
Within its supported snapshot scope, the enabled OpenClaw collector records observed repository paths whose state changed during the current captured run. It does not prove that OpenClaw exclusively caused those changes or establish their chronological edit order.
Does AgentProof capture the session I am currently using?
It depends on the host. Codex and Claude Code start a separate instrumented child session and cannot capture the invoking conversation. Once enabled, OpenClaw records commitments to hook events exposed for the current run, plus repository changes visible to its snapshots.
Does AgentProof upload source code, prompts or command output?
AgentProof itself sends nothing to an HREVN service, and the final receipt does not persist raw source, prompts, command text, output or diffs. The Codex and Claude Code child sessions still use their providers' normal service, authentication and network behavior; AgentProof does not make those host interactions offline.
What do MATCH and MISMATCH mean?
MATCH means the repository commitments checked now match the final commitments recorded in the receipt. MISMATCH means at least one checked path no longer matches. Neither result establishes who produced the state, why it changed or whether the work is correct.
Can AgentProof reconstruct the conversation later?
No. The final receipt is deliberately hash-only. It does not retain enough raw content to replay or reconstruct the conversation, commands, outputs or source.
Are these AgentProof receipts signed or blockchain-anchored?
No. The Codex, Claude Code and OpenClaw marketplace collectors described on this page create unsigned local receipts and expose no Sign or Anchor action. HREVN's separate Build Week system documents signed certificates and optional public anchoring.
Can an AgentProof receipt be signed or blockchain-anchored later?
The canonical receipt was designed to support a potential AgentProof Assurance service later without changing the recorded receipt. Assurance may combine signing by a party other than the receipt's producer with optional public anchoring. It is not available and cannot currently be purchased. Neither signing nor anchoring would establish truth, authorship, completeness or work quality. If that boundary solves a real production need, you may share the need with HREVN.
Before the next run that matters
You cannot create yesterday's receipt today.
Codex version 0.1.0 is published in the OpenAI plugin directory. OpenClaw is available on ClawHub. Claude Code has been pending Anthropic directory review since 27 July 2026, and its source is public.