CRF ProofOps

A local-first Evidence Immune System that blocks poisoned evidence, exposes missing proof, and keeps authoritative status deterministic.

Comment

Inspiration

A pipeline can produce a confident result while the proof, checker receipt, artifact hashes, evidence manifest, or release receipts behind that result are incomplete or inconsistent.

AI can summarize evidence and help developers investigate failures, but confidence is not evidence. Prompt-like instructions embedded inside evidence must never be allowed to change an authoritative status.

We built CRF ProofOps to make this boundary visible, deterministic, testable, and reusable.

What it does

CRF ProofOps is a local-first Evidence Immune System for computational and software-release evidence.

The Evidence Lab accepts a local JSON package or one of four included samples. It separates:

  • what was claimed;
  • what deterministic checks verified;
  • what evidence is still missing;
  • which status remains authoritative;
  • whether prompt-like content was detected and treated only as data;
  • the source hash and portable evidence outputs.

The four included scenarios are:

  1. Poisoned computation

    • Requested status: VERIFIED_UNSAT
    • Authoritative status: UNSAT_UNVERIFIED
    • Promotion: blocked
    • Missing evidence: 4 obligations

  2. Verified computation

    • Authoritative status: VERIFIED_UNSAT
    • Promotion: permitted
    • Missing evidence: 0 obligations

  3. Incomplete CI release

    • Requested status: RELEASE_EVIDENCE_COMPLETE
    • Authoritative status: RELEASE_REVIEW_REQUIRED
    • Promotion: blocked
    • Missing evidence: 6 obligations

  4. Verified CI release

    • Authoritative status: RELEASE_EVIDENCE_COMPLETE
    • Promotion: permitted
    • Missing evidence: 0 obligations

Prompt-like content is treated as untrusted data. It cannot execute commands, invoke tools, access the network, use credentials, or modify an authoritative status.

Evidence Immune System

A blocked claim does not produce only a generic failure message.

CRF ProofOps generates:

  • Proof of Non-Promotion — records that an unsupported transition did not occur;
  • Minimal Evidence Delta — identifies the exact evidence obligations still required;
  • Immunity Capsule — converts the blocked incident into a reusable regression contract;
  • Decision JSON and Markdown report — create portable, reviewable outputs.

When all required evidence is complete, ProofOps generates an:

  • Evidence-Supported Promotion Receipt — records why the deterministic gate permitted the transition.

How we built it

The judged browser experience is static and local-first.

It includes:

  • strict JSON parsing;
  • a 512 KiB input limit;
  • schema and field validation;
  • protection against unsafe prototype keys;
  • deterministic domain policies;
  • fail-closed status transitions;
  • source and decision hashing;
  • downloadable Markdown and JSON reports;
  • responsive and accessible controls;
  • computational and software-release evidence domains.

The browser path requires:

  • no account;
  • no project API key;
  • no backend;
  • no cloud execution;
  • no solver;
  • no proof generation;
  • no execution of commands supplied by evidence.

The same authority policy is also available through a reusable Python CLI/CI gate and GitHub Actions workflows.

How Codex and GPT-5.6 were used

Codex and GPT-5.6 were used throughout Build Week to:

  • inspect the existing CRF repository and architecture;
  • define a focused developer-tool product;
  • implement the Evidence Lab and deterministic CI gate;
  • prepare bounded multi-file changes;
  • generate and expand regression tests;
  • inspect security and authority boundaries;
  • improve accessibility and mobile behavior;
  • investigate failures and produce reviewable repair plans;
  • create documentation and judge-facing explanations.

Codex accelerated repository navigation, implementation, testing, debugging, and review across a mature codebase.

GPT-5.6 supported product reasoning, adversarial-case analysis, developer experience, and clear explanations of verified and missing evidence.

Neither Codex nor GPT-5.6 was granted authority over evidence-backed status.

AI may explain and assist. The deterministic evidence gate owns authoritative status.

What is new during Build Week

The underlying CRF research foundation existed before the submission period.

During Build Week, we created the operational CRF ProofOps product:

  • the Evidence Lab;
  • computational and software-release evidence policies;
  • local JSON upload and four judge-ready samples;
  • deterministic status transitions;
  • the Evidence Immune System outputs;
  • a reusable Python CI gate;
  • GitHub Actions validation workflows;
  • a repository-local Codex Skill;
  • adversarial prompt-like-evidence testing;
  • a selected-instance real-world CRF pilot;
  • expanded automated tests;
  • accessibility and mobile improvements;
  • the public Netlify demo;
  • final judge documentation and demo video.

The finalist implementation is available on:

feat/proofops-99-finalist

Finalist commit:

967950622f641d56ebeb713afa31cd61841c356d

Challenges we ran into

The most difficult problem was keeping AI useful without allowing it to become an authority.

Evidence packages can contain:

  • instruction-shaped text;
  • apparently successful results;
  • stale receipts;
  • missing manifests;
  • mismatched artifact hashes;
  • incomplete checker evidence;
  • force-push or commit-binding risks.

The system therefore had to treat all supplied evidence as untrusted data, keep the status transition deterministic, fail closed when any required obligation was incomplete, and still explain the missing evidence clearly enough for a developer to act on it.

Another challenge was converting research-oriented verification concepts into a product that judges could test immediately without rebuilding the repository or providing credentials.

Accomplishments that we are proud of

  • Poisoned instructions are detected and remain data-only.
  • AI authority remains NONE.
  • Unsupported promotions are blocked.
  • Missing evidence is presented as actionable obligations.
  • Supported transitions receive portable evidence receipts.
  • The same evidence policy is available in the browser and CI.
  • 75 Python tests passed.
  • 58 subtests passed.
  • JavaScript and browser-core checks passed.
  • GitHub Actions validation passed.
  • The selected-instance real-world pilot passed.
  • Human owner QA test: PASS.
  • The live production smoke test passed all four scenarios.
  • All four generated evidence reports downloaded successfully.

What we learned

AI can be extremely valuable for repository inspection, implementation, investigation, testing, and explanation without being granted authority over evidence-backed decisions.

A strong AI-assisted system is not only defined by what the model can do. It must also make explicit what the model is not permitted to decide.

We also learned that missing evidence becomes far more useful when represented as a minimal and actionable delta instead of a generic error.

What's next for CRF ProofOps

Future work includes:

  • additional evidence domains;
  • configurable evidence-policy packs;
  • stronger signed-receipt verification;
  • broader semantic prompt-injection detection;
  • richer CI and release integrations;
  • organization-specific evidence obligations;
  • broader real-world pilots;
  • independent security and usability evaluation.

Limitations and claim boundary

This submission demonstrates selected instances rather than arbitrary universal validation.

The real-world pilot is limited to one captured CRF instance.

Lexical prompt-like-text detection is not a universal prompt-injection defense.

The project does not claim:

  • universal correctness;
  • formal-security certification;
  • production certification;
  • proof generation;
  • arbitrary computational verification.

Human review remains required.

Test it

Live demo

https://crf-proofops-live.netlify.app/

No login, account, installation, backend, or API key is required.

Run all four included samples:

  1. Poisoned computation
  2. Verified computation
  3. Incomplete CI release
  4. Verified CI release

For each sample:

  1. Select the sample.
  2. Run the authority check.
  3. Review the claimed, verified, missing, and final-decision sections.
  4. Download the generated evidence report.

Demo video

https://www.youtube.com/watch?v=ZG2G41qIAgM

Repository

https://github.com/ravanmusic001/CRF-Research

The repository is private and has been shared with:

Finalist branch

feat/proofops-99-finalist

Finalist commit

967950622f641d56ebeb713afa31cd61841c356d

AI may explain.

Deterministic evidence verifies.

Humans approve.

Built With

  • ci-cd
  • cli
  • codex
  • css3
  • cybersecurity
  • developer-tools
  • evidence-verification
  • github
  • github-actions
  • gpt-5.6
  • html5
  • javascript
  • local-first
  • netlify
  • openai
  • powershell
  • prompt-injection
  • pytest
  • python
Share this project:

Updates