Your AI agent says it's done. Your CI badge says it passed. One is a claim, the other is a setting — neither is evidence. BootProof observes what actually happened and signs it. Actenon binds authority to the exact act and verifies it at the edge. WorkProof puts a receipt on every agent-assisted PR. Deterministic end to end: no LLM judges, no telemetry, ever.
Every agent on earth reports success on command completion. The industry has a name for work that claims to be done and isn't: agentic ghosting.
This is the whole company in one button. The tamper button makes the receipt say what the agent said — booted: true — and the signature collapses, because that is not what was observed. A green check you can't lose an argument with.
This is not a prediction or a pitch — it is a measurement, taken by other people, with receipts of their own. The volume of asserted-but-unverified work crossed the threshold where human review stopped scaling. The maintainers noticed first.
Every green check on the internet certifies one of two things: something observed, or something asserted. Nobody can tell which. That gap is the entire company.
Agent work needs three different kinds of proof — that it worked, that you can show what you did, and that it was allowed. Three products, one primitive underneath: observed evidence, signed, verifiable by anyone.
The zero-trust supervisor. Inspects a repo, builds an evidence-based run plan, executes only what it can justify, observes real health, and writes a signed attestation — for success or for failure. A process starting is not proof. A container existing is not proof. An agent saying "done" is not proof. This is proof.
The DCO sign-off of the agent era. Honest AI-assisted contributors attach a signed receipt of the work they actually performed — commands run, outputs hashed, repo tree state, AI level declared (none · assisted · agent), sessions hash-chained against tampering. Missing receipts become a triage signal. No LLM calls anywhere in the product — determinism is the differentiation.
Authority bound to the act, not the actor. AuthN, policy engines and audit logs answer should this requester be allowed to do this kind of thing? Actenon answers the question the execution edge actually needs: is the exact action about to execute still the exact action that was authorized — this endpoint, this scope, this time window, this single attempt? No valid proof, no execution.
Nothing here was invented from nothing, and pretending otherwise would be the first lie on a page about proof. The lineage is real and we claim our place in it precisely: here is what each generation proved, and here is the specific thing it left open.
| Lineage | What it proved | What this stack adds |
|---|---|---|
| in-toto · SLSAsupply-chain attestation | Build steps can be attested and artifacts bound to their build lineage — the supply chain became auditable. | The runtime observation layer: what happened when it actually ran, observed at the edge, with a refusal taxonomy. A receipt can say NO and sign it. |
| DCO / sign-offdeclared provenance | Contributors can declare the provenance of their work, and the declaration is enforceable. | WorkProof extends sign-off from declaration to evidence — commands run, outputs hashed, AI level declared — for agent-assisted work. |
| FIDO2 / WebAuthnpresence at an edge | Cryptographic proof of user presence, bound to a single act, verified at an edge. | Actenon's direct inspiration, applied to agents: authority bound to the exact act — scoped, single-use, revocable, verified before the side effect. |
| Sigstore · TUFsigning infrastructure | Artifact signing and verification can be public, free, and impossible to opt out of quietly. | Same primitives — Ed25519, hash chains, a transparency ladder — applied to workflows and actions instead of artifacts. |
| CI itselfautomated checking | Automation can check anything it is configured to check, on every change. | CI checks what it's told to check. BootProof decides what to observe and signs what it saw — the check cannot be talked to, prompted, or socially engineered. |
| Reproducible buildsdeterminism | Deterministic processes make claims checkable by anyone, forever. | That principle is constitutional here: no LLM anywhere in the proof path. Every verdict is re-derivable from evidence or it doesn't ship. |
If you think something here is prior art we missed or misread, that's exactly the kind of issue report we want — the conformance suite exists so you can check us the way we check agents.
The Living Receipt is the same evidence as the JSON attestation, rendered as a single self-contained HTML file that re-verifies its own Ed25519 signature in your browser with zero network calls. No server, no account, no trust in us — the math either checks out on your machine or it doesn't.
Inside the download: two real captures from a real bootproof up run — a repo that boots to HTTP 200, and one that segfaults at runtime. Click Tamper with signature and watch the verdict collapse. That's not a mockup of a verification UI; that's verification.
.html)Tamper with signature — watch the verdict dienpx bootproof up <repo> --receiptTwo receipts from one real run: the boot that answered HTTP 200, and the one that segfaulted. Both signed. Both self-verifying. Both happy to prove you can't quietly edit them.
The receipt carries the evidence, the signature, the trust level it was signed at, and what this receipt does not prove — printed on its face. A proof artifact that hides its own limits would be a strange proof artifact.
↓ Download the Living Receipt self-contained HTML · verifies itself offline · ~84 KBEvery other section on this page sells. This one doesn't — and that's deliberate. A trust product that overclaims is a contradiction, so the limits are printed on the front door, the same way they're printed on the receipts. Full threat models live in each repo.
A receipt proves commands ran and a service answered. It does not prove the contributor — human or agent — understood the output. Neither does a review, to be fair. But we say so.
No LLM judgment, no score, no suspicion score. A receipt is evidence, not opinion. If you want a machine's opinion about code, there are plenty of vendors.
A local attacker holding the signing key can fabricate a session around doctored tests. Mitigations are real but partial: CI re-execution, policy pinning, keyless signing on the roadmap.
Actenon's edge guarantee holds when the protected edge is the only path to the resource and the agent has no standing credential. Preconditions, stated in full in the kernel's scope document — no hand-waving.
"Raising the cost of lying is the claim — not eliminating it." — the WorkProof threat model, which is exactly as fun to read as it sounds