HREVN AgentProof

Cryptographically verifiable receipts for Codex agent sessions.

Comment

Inspiration

AI coding agents can run commands, modify repositories, and make consequential decisions, but reviewers usually receive only the agent's account of what happened. We built HREVN AgentProof to replace “trust the agent” with a portable, independently verifiable receipt.

What it does

AgentProof converts an observed Codex session into a privacy-preserving, tamper-evident Evidence Bundle.

Each observed event commits the hash of the previous event, preserving sequence. Commands, outputs, file states, and diffs are represented by SHA-256 commitments, while prompts, source code, stdout, stderr, and diff contents remain private.

The canonical receipt is sealed inside an HREVN EB1 Evidence Bundle. Its root is signed with Ed25519 and anchored in a real Ethereum Sepolia transaction.

A reviewer can select a repository locally in the browser and obtain:

  • A green MATCH when its files reproduce the sealed commitments.
  • A red MISMATCH identifying the exact modified or missing file.

Repository files never leave the browser during this comparison.

The reusable GitHub Action verifies the checked-out repository before sealing. On success, it uploads the receipt and signed evidence, then creates or updates a pull-request comment containing verification, artifact, bundle, and Etherscan links. If the repository does not match, it refuses to anchor the receipt.

How we built it

Codex was the primary engineering environment used to inspect the existing HREVN system, design the AgentProof semantic profile and canonical receipt format, implement the Codex CLI capture adapter, build the event hash chain and repository verifier, create the public interface and GitHub Action, run tests, deploy, and verify production.

GPT-5.6 powered this engineering workflow and also performed the real Codex CLI task captured in the public demonstration. Codex is therefore both the tool used to build AgentProof and the agent whose actions AgentProof proves.

The implementation uses Python, FastAPI, canonical JSON, SHA-256, Ed25519, the browser Web Crypto API, GitHub Actions, Docker, and Ethereum Sepolia.

HREVN's EB1 bundle generation, signing, anchoring, and generic verification existed before Build Week. AgentProof was added as a new capture and verification layer without duplicating that core. The repository contains the public baseline tag pre-agentproof-buildweek, making the complete Build Week extension inspectable with:

git diff pre-agentproof-buildweek..HEAD

Challenges we ran into

The main challenge was preserving privacy without reducing the receipt to a meaningless badge. We solved it by keeping private content local while committing its bytes cryptographically.

A second challenge was protecting sequence integrity. Every event includes the previous event hash, so alteration, insertion, deletion, or reordering breaks the chain.

We also had to make repository re-verification useful without uploading source code. The browser hashes selected files on-device and compares them with the sealed commitments.

Finally, we had to separate the pre-existing HREVN core from the work completed during Build Week. We solved this with a public baseline tag, dated commit history, documented architecture, and a reproducible Git diff.

Accomplishments that we're proud of

  • A real Codex session produces a signed and publicly anchored EB1 without manual bundle assembly.
  • A reviewer can reproduce the MATCH/MISMATCH test without a Codex or HREVN account.
  • A real pull request contains an automatically generated AgentProof verification comment.
  • The GitHub Action verifies before sealing, preventing mismatched evidence from being anchored.
  • The project includes an Apache-2.0 repository, sample data, offline verification, installation instructions, tests, and a no-login live demo.
  • Identical canonical receipt bytes deterministically reproduce the same root.

What we learned

Verifiability does not require publishing sensitive content. Carefully designed commitments can prove integrity and ordering while keeping prompts, source code, outputs, and diffs private.

We also learned that a useful trust signal must be reproducible. A badge alone is not evidence; reviewers need the receipt, its specification, its signature, its public anchor, and a practical way to compare it with the current repository.

AgentProof is deliberately described as tamper-evident, not exhaustive. It proves the integrity and order of events observed by the instrumented collector; it does not claim to observe actions that bypass that collector.

What's next for HREVN AgentProof

Future work can add stronger collector isolation, signed runner identities, hardware-backed keys, policy-bound capture profiles, support for additional agent runtimes, and organization-level verification dashboards.

The architecture is also prepared for automated policies in which CI systems or AI agents accept actions only when the supporting evidence can be independently verified.

Try the public demo at agentproof.hrevn.com: download the tiny repository, verify the green MATCH, modify calculator.py, and verify the red MISMATCH.

Built With

Share this project:

Updates