TraceProof

• 

  Dashboard

Inspiration

AI coding agents can produce large changes in minutes, but reviewers still need to answer a slower and more important question: why should I trust this change?

Existing traces often show activity—prompts, tool calls, and tokens—but do not connect the original request to code changes and successful validation. I built TraceProof to make AI-assisted work reviewable by default.

What it does

TraceProof is a local-first Codex plugin and interactive dashboard that turns coding sessions into tamper-evident proof packs.

Codex lifecycle hooks capture requests, tool activity, permission boundaries, Git state, and test execution. Likely credentials are redacted before storage, and captured data remains on the developer's machine.

Every event is linked to the previous event using SHA-256. A separate head anchor detects tail truncation. The dashboard verifies the event chain, regenerates claims and evidence directly from the sealed events, and displays a claim-to-change-to-validation graph, timeline, evidence inspector, and transparent proof score.

TraceProof also supports live multi-project monitoring. Projects appear by name, with concurrent Codex tasks shown as separate proof instances.

The Integrity Lab lets judges modify a real sealed event and immediately watch verification fail.

How I built it

• Native Codex lifecycle hooks for evidence capture
• Node.js for the local capture, verification, live bridge, and export CLI
• SHA-256 hash chaining and a separate head anchor
• Git snapshots for branch, commit, and working-tree state
• Credential redaction and bounded payload capture
• Next.js, React, and TypeScript for the dashboard
• Browser-side proof verification and data re-derivation
• Node's built-in test runner for integrity, redaction, and scoring tests

The public demo contains only fictional projects and synthetic sessions processed through the real sealing, scoring, derivation, and verification pipeline. It contains no personal projects or private transcripts.

How I used Codex and GPT-5.6

I worked as a solo entrant and retained control over the product direction, privacy decisions, publishing, and submission.

Codex with GPT-5.6 helped research the challenge requirements and Codex hook system, design the architecture, implement the plugin and dashboard, write automated tests, diagnose failures, perform release audits, and prepare the submission.

TraceProof also dogfoods this collaboration by recording the active model and Codex session identifier in captured evidence.

Challenges

The hardest problem was distinguishing activity from evidence. Running a command is not proof that it succeeded, and requesting a test is not the same as receiving a passing result. TraceProof only awards verification evidence when a recognized validation command has an explicit successful outcome.

I also had to treat the trace itself as sensitive. TraceProof redacts likely credentials before writing data, keeps capture local, and requires an intentional export before a proof pack can be shared.

Accomplishments

• Built a real installable Codex plugin
• Detects edited, reordered, and tail-truncated histories
• Recomputes dashboard claims and scores from sealed events
• Supports live monitoring across projects and concurrent Codex tasks
• Makes missing or degraded evidence visible
• Provides a judge-safe demo with no entrant data
• Explains the integrity story in under 30 seconds

What we learned

Agent observability and software assurance are different problems. More trace data does not automatically create more trust. Trust comes from connecting a specific claim to a specific change and then to evidence capable of proving or disproving it.

What's next

• Developer and CI cryptographic signatures
• Pull-request proof checks
• Framework-specific validation adapters
• OpenTelemetry interoperability
• Team policies for minimum evidence coverage
• A public proof-pack schema

Built With

• codex
• github
• gpt-5.6
• local
• next.js
• openai
• privacy
• react
• sha-256
• typescript