Internal consistency
Verify checks the canonical receipt and its event chain. It does not turn the producer into an independent witness.
receipt chain → valid / errorAI agent audit trail, defined carefully
Is a session receipt an audit trail? Not by itself.
AgentProof creates a local, hash-only receipt of collector-observed events and checked repository commitments. It can support later review, but it is not an independent or exhaustive audit and does not prove that the work was correct.
Codex · Claude Code · OpenClaw. Marketplace receipts are local, unsigned and unanchored.
SESSION RECEIPTCOLLECTOR-OBSERVED
AP-1042
-
001
OBSERVED EVENTcommitment✓
sha256:9f83…18a2 -
002
CHECKED PATHsrc/calculator.py✓
final commitment 14f1… -
003
EXPLICIT LIMITobserved ≠ complete✓
authorship not established
LOCAL RECEIPT CHAIN
UNSIGNED
72bb0d9e…c8a91fThe final receipt persists hashes, relative paths, selected metadata and explicit limits—not a replay of the session.
Collector-observedSHA-256 chainChecked commitmentsExplicit limits
The terminology gap
When a technical record is mistaken for an audit.
“Audit trail” often means a durable record that can be reviewed later. In stricter use, it also implies defined scope, completeness controls, governance and an observer whose independence is understood.
AgentProof supplies the narrower part: a host-specific local receipt whose internal chain and checked repository commitments can be tested later. Its collectors are not independent witnesses and can miss actions outside their observation surface.
AgentProof can answer: do the checked commitments still match? It does not answer who caused a change, why it happened or whether the work was correct.
A record for later comparison
It preserves commitments, not the whole story.
Each host-specific collector creates a canonical local receipt from events it could observe and repository states it checked. Local Verify validates that receipt and can compare its recorded final commitments with the repository as it exists now.
Observed order
The chain preserves the order of events emitted to the collector, not a guarantee that every relevant event was present.
observed order ≠ complete historyRepository comparison
Compare checked final commitments with the repository now. A mismatch says that state differs, not who changed it or why.
src/file.py → MISMATCHHash-only receipt
The final receipt does not persist raw source, prompts, command text, output or diffs.
local bytes → SHA-256One receipt, three moments
Capture. Keep. Compare.
Capture through the host collector
Codex and Claude Code start a separate captured child run. OpenClaw records the current run after its collector has been enabled.
Keep the local receipt
The canonical hash-only receipt survives after the conversation moves on. Marketplace receipts are not signed or blockchain-anchored.
Run local Verify later
Validate the receipt and compare its checked final repository commitments with the current repository.
When the narrower record helps
Useful before a conversation becomes the only surviving account.
Keep a local receipt for an important run before the chat is compacted, buried or forgotten.
See which paths changed within the collector's supported snapshot scope and whether checked commitments still match.
Attach explicit observation limits instead of presenting a confident summary as a complete execution history.
Host-specific collectors
One receipt doctrine. Different observation surfaces.
Codex, Claude Code and OpenClaw expose different event and execution boundaries. AgentProof does not flatten those differences: each collector records its own capabilities, gaps and limitations alongside the receipt.
Current availability: installation status and exact host behavior are maintained on the AgentProof Session Receipts product page.
Codex child runClaude Code child runOpenClaw current runhost-specific gaps
→
LOCAL RECEIPTObserved commitments
capabilities + explicit limitsHonest boundary
A session receipt, not an independent audit.
AgentProof checks a local receipt produced by the same operator-side environment it records. A useful technical record is not automatically complete, independent or authoritative.
It can establish
- Whether the canonical receipt and internal chain validate
- Which collector profile and limits accompanied it
- Which observed paths changed within supported snapshot scope
- Whether checked final commitments currently match
It does not establish
- Complete capture or independent observation
- Exclusive authorship or causation
- That the work is correct, safe or compliant
- Legal admissibility, signing, anchoring or payment authority
How to read the record
A valid receipt can still be incomplete.
AgentProof can validate the receipt's canonical form and internal chain, then compare checked repository commitments. Those checks are repeatable. They do not turn the collector into an independent witness.
- MATCH means the commitments checked now match those recorded at the end of the run
- MISMATCH means at least one checked commitment no longer matches
- Neither result identifies who changed the repository or why
- Neither result establishes that the work was correct, safe or complete
LOCAL SESSION RECEIPTILLUSTRATIVE
CHECKED NOW
agent-session.jsonCanonical receipt · internal chain valid
MATCH
- Observation
- collector-specific
- Repository
- checked commitments match
- Authority
- not established
A narrow technical result, not a verdict on the work.
Different questions need different tools
A receipt records. A sandbox constrains. A backup recovers.
AgentProof session receipt
Keep a local, hash-only record of collector-observed events and checked repository commitments, with the collector's limits attached.
See collectors and availabilitySandboxing and backups
Use host permissions and sandboxes to constrain actions, and version control or backups to recover. AgentProof does not replace either one.
Learn what can be verifiedFrom the question to the product
Keep a receipt before the run becomes yesterday's story.
You may never need it. If you do, it has to exist already. The product page explains which collectors are available, how each one starts capture and what each receipt can support.
Open the AgentProof product pageNeed the evidence vocabulary?
Read the conceptual guide next.
“Verifiable” is not one property. The companion guide separates the checks a receipt supports from claims about truth, authorship, completeness and work quality.
What makes AI agent evidence verifiable?Questions people ask about AI agent audit trails
Read the limits before you read the result.
Is AgentProof an independent AI agent audit trail?
No. The marketplace collectors are operator-side records, not independent or exhaustive witnesses. AgentProof preserves collector-specific limits so a session receipt is not mistaken for a complete audit.
What do MATCH and MISMATCH mean?
MATCH means the repository commitments checked now match the final commitments recorded in the receipt. MISMATCH means at least one checked path no longer matches. Neither result establishes who produced the state, why it changed or whether the work is correct.
Can AgentProof prove that an AI agent ran the tests correctly?
No. A collector may record a commitment to an observed command event, but that does not establish that the intended tests ran meaningfully, that their output was interpreted correctly or that the work passed.
Does the final receipt expose source code or prompts?
The final receipt does not persist raw source, prompts, command text, output or diffs. Capture may transiently observe host event data, and Codex or Claude Code child sessions still use their providers' normal services and authentication.
Which AI coding agents have collectors?
AgentProof has host-specific collectors for Codex, Claude Code and OpenClaw. Availability and installation status can change, so the product page is the current source of truth.