Provably

Inspiration

zkML is fascinating but brutally heavy: proving an LLM's forward pass costs orders of magnitude more than running it. So we flipped the problem: don't prove the model, prove everything around it. Attest the API call, then verify the harness's computation over the answer.

What it does

Provably is infrastructure for verifiable computation in the agent economy. When one agent pays another, it attaches a proof of how the result was produced (a DAG of transport-attested API calls and re-runnable transforms) so the buyer verifies before trusting, catching a malicious or buggy seller.

How we built it

Built on TLSNotary (the EF/PSE project) in proxy mode: a separate notary witnesses the seller's TLS session to the upstream and signs what crossed the wire. The proof layer is Rust types bound by digest-equality; settlement is real MPP (HTTP 402) on the Tempo moderato testnet.

Challenges we ran into

TLSNotary is a deep, fast-moving design space: proxy mode vs MPC trades privacy for speed, and layering a zk presentation over the notary's signature is still open. Matching the notary's body digest to the exact bytes delivered (identity encoding, no chunking) also took care.

Accomplishments that we're proud of

A full live end-to-end run: a real Anthropic call routed through the TLSNotary, a proof-carrying receipt built over it, settled with real MPP on testnet, plus a cheat mode where a substituted answer is caught by the buyer's verifier. No mocks: real bytes, real crypto.

What we learned

A deep dive into the TLS stack and TLSNotary internals: proxy vs MPC modes, session and certificate verification, and the subtle body-digest contract (encoding, chunking) that must hold for attested bytes to equal delivered bytes. And how to keep the buyer's verifier dependency-light.

What's next for Provably

STARK/zk presentations over the notary protocol (a blind notary instead of a trusted one) for stronger buyer privacy.
Full zkVM / TEE backends for interior proofs and leg attestation.
Recursive composability: fold a leg's proof into the zkVM that proves the DAG, collapsing a whole harness into one proof.