Proof Gate — No Proof, No Money

Inspiration

The author's paper "Permission in the Blank" (Elsayad, 2026 — Zenodo record 23994480) names the failure mode: a language model writing its own authorization into an empty target slot. Proof Gate is the gate that catches exactly that, before money moves.

What it does

An agent that wants to be paid submits a claim: what was done, how much, who the payee is, who authorized it, and the evidence. A second, skeptical checker — the Evidence Auditor — independently verifies that proof: it fetches every cited source itself and tests whether the source actually says what the claim says it says, whether the amounts and payee match, and whether the authorization names a real external authorizer. Pass releases a PayPal sandbox invoice to the payee. Fail, blank, or self-authored proof kills the payment, with a written reason naming exactly which check failed, stored in a permanent audit trail. A rejected case has no payment path at all.

How we built it

Node.js, zero dependencies, node:http server with a JSON file store. The checker is a deterministic, rule-based verifier: it fetches cited URLs (5s timeout, redirects followed), matches key terms of each claim against the fetched text, and checks amount and payee consistency. The payment side reuses the PayPal Invoicing client proven in the author's earlier InvoicePilot project. The UI is one page: submit a claim, watch the checks run, see pass/fail with reasons and the PayPal result.

Challenges we ran into

The hard part is honesty: a demo that claims a payment without a real PayPal round trip is a fake. So the product refuses to fake one. Without sandbox credentials an approved case stops at an explicit "approved, not paid" state and the release endpoint answers 503. The checker also had to be a real verifier, not a label: it fetches sources live, so a dead link or a source that does not back the claim fails the case.

Accomplishments that we're proud of

34 of 34 tests pass. A legitimate case citing the author's real Zenodo record was audited against the live page, approved, and released as a real PayPal sandbox invoice (INV2-CPP6-RL73-MT6E-HP9G, status SENT). The attack case — an agent that wrote its own blank authorization — was rejected with the blank authorization named as the reason. A rejected case cannot be released, period.

What we learned

Authorization is the weakest link in agent payments, not the payment rail. Verifying the claim against the raw source catches what a signature or a token cannot: proof that was never real in the first place.

What's next for Proof Gate

A hosted demo, live-mode PayPal credentials, and webhooks so a case can be followed from submission to settled invoice.

Built With

• node.js
• paypal-invoicing-api-(sandbox)
• zenodo