Free2PA

Free2PA is a C2PA-style provenance checker with GPT-5.6 behavioral auditing that verifies control files before they are used for agentic context. This ensures only authorized changes are read.

Comment

Free2PA is a C2PA-style developer load gate for AI agent control files, featuring GPT-5.6 behavioral auditing. It verifies signed receipts, in the form of sidecar files, before an agent loads prompts, skills, tools, policies, manifests, or other instruction files into model context.

If a file changed after signature, Free2PA can fall back to the last signed version, run with that trusted text, and report the unsigned edit. If the new edit is signed by someone in the verifier's ad hoc trust network, it becomes the trusted version until another signed edit replaces it.

GPT-5.6 behavioral auditing is an after-provenance review layer for agent control files. Free2PA first uses deterministic checks; receipt signature, file hash, certificate validity, and verifier-local publisher trust; to decide whether a file may enter model context. After a control file passes that gate, GPT-5.6 can review the verified text for behavioral risks such as prompt injection, secret access, destructive actions, data exfiltration, unsafe downloads, or excessive permissions. GPT-5.6 helps explain what the verified instructions do, but it does not make or override the hard LOAD / REJECT trust decision.

Inspiration

When I updated my developement skills at the University of Arkanasas last fall, the professor asked me how a C2PA-style implementation might help students protect their OpenClaw agents. These agent frameworks like OpenClaw rely on editable text files: system prompts, AGENTS.md, SOUL.md, SKILLS.md, tool manifests, policy files, and workflow definitions. Those files are powerful supply-chain inputs. A one-line change can redirect every later agent action. An unauthorized change to a control file could be from an outside attack, from a developer working around the framework, or from a modification by the agent itself.

The missing control is simple: before loading one of these files, the host should know whether this is the exact file someone signed and whether this project currently trusts that publisher.

Free2PA focuses on verifier-local trust: a class, a project team, an open-source collaboration, or a contractor engagement. Instead of a verifier that recognizes conforming trust groups, these groups need an ad-hoc verifier they control.

What It Does

Free2PA puts a signed receipt beside each protected agent control file.

At load time, the verifier checks:

  1. Is the receipt signature valid?
  2. Does the current file match the signed hash?
  3. Is the signing certificate current?
  4. Is the publisher in this verifier's local trust network?

If the proof matches, Free2PA returns LOAD.

If the file was edited but not signed, the app can use Free2PA's guarded repair path: restore the last signed version, run with that trusted text, and report the unsigned edit.

If the edited file is signed by someone in the verifier's ad hoc trust network, that new file becomes the trusted version until another signed edit is in place.

Live Demo

The live page shows a small Hello World agentic application and the Free2PA verify console side by side.

The Hello World app reads SOUL.md, sends hello to the model, and expects an optimistic greeting. Free2PA is applied at the file-read boundary before that control text reaches model context.

The demo shows this sequence:

  1. The original signed SOUL.md verifies and returns LOAD.
  2. The user edits the control file but does not sign it.
  3. Free2PA detects that the saved text no longer matches the signed receipt.
  4. The app falls back to the last signed file, runs safely, and reports the unsigned edit.
  5. The user signs the intended change from the local verify console.
  6. The newly signed control file becomes trusted and loads on the next run.

This makes the point visible in a tiny app: saving a control-file edit is not the same thing as approving it for model context.

Developer Interfaces

Free2PA ships one verification core across multiple developer surfaces:

  • CLI for startup scripts and local workflows
  • free2pa/load-gate Node API for direct runtime integration
  • HTTP API for local verifier services
  • Streamable HTTP MCP server with verify_asset
  • GitHub Action for pull-request enforcement
  • Guarded repair flow
  • Installable Codex skill for retrofitting existing agent apps

The simplest Node integration is:

import { loadVerifiedFile } from 'free2pa/load-gate';

const instructions = await loadVerifiedFile({
  assetPath: 'agent/SOUL.md',
  trustStore: '.free2pa/trusted-publishers',
});

startAgent({ instructions });

The file content is returned only when the deterministic checks pass or when the host intentionally chooses a guarded repair policy.

Codex and GPT-5.6

Codex gpt-5.6 and Codex gpt-5.5 were used to turn the original research idea into a distributable developer tool: CLI, load-gate API, MCP verifier, CI action, Azure-hosted demo, guarded repair, tests, docs, and an installable Codex integration skill.

The included $free2pa-protect-agent skill asks Codex to inspect an existing agent repository, identify which files enter model context, find the real load boundary, and wire Free2PA before that read. It also adds tests proving trusted, changed, and outside-publisher behavior.

GPT-5.6 is separate from the hard gate. Cryptographic verification decides whether a file may load. GPT-5.6 can review verified instructions for behavioral risks such as prompt injection, secret access, destructive actions, exfiltration, or excessive permissions, but it cannot turn a failed gate into LOAD.

Technical Implementation

The implementation uses Node.js 20, Express, Node's native crypto and X.509 APIs, OpenSSL for publisher identity generation, the Model Context Protocol SDK, and the OpenAI Responses API for optional GPT-5.6 structured audits.

Signing creates a canonical JSON claim containing:

  • SHA-256 hash of the file
  • Base64 copy of the signed original
  • Publisher certificate
  • Signed metadata
  • ES256 signature

Verification enforces:

  • Sidecar parse validity
  • Declared algorithm support
  • X.509 certificate parse and validity window
  • Signature verification over canonical JSON
  • Exact-file SHA-256 match
  • Membership in the local trust directory

The test suite covers signing, trust admission and revocation, tamper detection, outside-publisher rejection, guarded repair, CLI behavior, MCP structured results, HTTP cleanup/security behavior, and optional GPT-5.6 audit contracts.

Why It Matters

AI agent security often focuses on model behavior, but the files loaded before the model runs are just as important. Free2PA gives developers a practical runtime control for those files without asking them to adopt a permanent public PKI or manually inspect receipts.

The central idea is verifier-local trust. The same signed, unchanged file can load in the project that admitted the publisher and fail everywhere else. Removing a public certificate revokes that publisher on the next verification.

That fits real-world collaboration: classes, hackathon teams, contractors, client work, open-source maintainers, and short-lived project groups.

What Changed During Build Week

The project began as C2PA-inspired research around provenance for agent skill files. During Build Week, it was turned into a judgeable developer tool:

  • Installable CLI
  • Explicit local trust-store lifecycle
  • Load-gate API
  • Generic MCP verify_asset tool
  • HTTP verifier
  • Guarded repair
  • GitHub Action
  • Codex retrofit skill
  • Live Hello World demo
  • GPT-5.6 behavioral audit
  • Automated test suite and judge fixtures

C2PA Disclosure

Free2PA is C2PA-inspired but is not a conforming C2PA implementation and does not claim interoperability with C2PA Content Credentials. It uses a Free2PA receipt format to bring signed provenance to text-based agent control files, then applies a local project trust decision before loading those files.

Public Links

Built With

  • azure-openai
  • codex
  • ecdsa-p-256
  • express.js
  • github-actions
  • gpt-5.6
  • model-context-protocol
  • node.js
  • openai-responses-api
  • sha-256
  • x.509
Share this project:

Updates