bootproof — the proof company for the agent era

No proof,
no green check.

Your AI agent says it's done. Your CI badge says it passed. One is a claim, the other is a setting — neither is evidence. BootProof observes what actually happened and signs it. Actenon binds authority to the exact act and verifies it at the edge. WorkProof puts a receipt on every agent-assisted PR. Deterministic end to end: no LLM judges, no telemetry, ever.

Live on this page — the agent's lie, caught by arithmetic
real Ed25519 · your browser · zero network calls
01 · what the agent reported
$ agent --task "fix checkout and verify"
…editing src/server.ts…
…running tests…

✅ Done. Server running on :3000,
   tests pass. Ready to merge.

Every agent on earth reports success on command completion. The industry has a name for work that claims to be done and isn't: agentic ghosting.

02 · what BootProof observed & signed
BOOTPROOF RECEIPT acme/checkout · #2481 · 09:41:12Z
bootedfalse
health probeGET /health → ECONNREFUSED
exit code1
verdictREFUSED · boot_not_observed
trust levellocal_developer_signed
SIGNATURE VALID ed25519 ·
demo keys generated on this page — production receipts are signed at capture time

This is the whole company in one button. The tamper button makes the receipt say what the agent said — booted: true — and the signature collapses, because that is not what was observed. A green check you can't lose an argument with.

$ npx bootproof up . a signed receipt for any repo, 60 seconds observes a real boot, or refuses and says why · npm bootproof@0.4.1
$ pip install actenon-scan && actenon-scan scan . finds where your agent can act without authority · PyPI actenon-scan@1.4.0
open source, Apache-2.0 51 conformance vectors SDKs: Python · TypeScript · Go · Rust
01 · the problem

The industry is drowning in work that claims to be done.

This is not a prediction or a pitch — it is a measurement, taken by other people, with receipts of their own. The volume of asserted-but-unverified work crossed the threshold where human review stopped scaling. The maintainers noticed first.

400,000
pull requests from Codex alone in two months. Every one of them asserted completion. Review capacity did not grow 400,000-fold.
+91%
rise in median PR review time measured by Faros as agent-generated code flooded the review queue.
1-in-20
valid rate of security reports at curl before Daniel Stenberg shut its bug bounty in January 2026 — down from 1-in-6. "Running it was the filter," and the filter broke.
0
external PRs accepted at tldraw (auto-closed) and Jazzband (shut down entirely). The strongest projects on earth are opting out of contribution rather than trusting assertions.

Every green check on the internet certifies one of two things: something observed, or something asserted. Nobody can tell which. That gap is the entire company.

02 · the stack

Three questions. One answer: prove it.

Agent work needs three different kinds of proof — that it worked, that you can show what you did, and that it was allowed. Three products, one primitive underneath: observed evidence, signed, verifiable by anyone.

Layer 1 · Observe
Did it actually work?

BootProof

The zero-trust supervisor. Inspects a repo, builds an evidence-based run plan, executes only what it can justify, observes real health, and writes a signed attestation — for success or for failure. A process starting is not proof. A container existing is not proof. An agent saying "done" is not proof. This is proof.

Receipt Gate — no observed boot, no merge repo-proofer — zero-network sandbox for stranger repos gates Claude Code via Stop hooks
$ npx bootproof up . or gate merges: uses: bootproof/receipt-gate@v1
Layer 2 · Show your work
Can you prove what you did?

WorkProof

The DCO sign-off of the agent era. Honest AI-assisted contributors attach a signed receipt of the work they actually performed — commands run, outputs hashed, repo tree state, AI level declared (none · assisted · agent), sessions hash-chained against tampering. Missing receipts become a triage signal. No LLM calls anywhere in the product — determinism is the differentiation.

signed in-toto Statements reports test-weakening signals, file:line GitHub Action verifies receipts on PRs
$ workproof run -- pytest && workproof attest --ai-level agent receipt lives in the PR body, not the git tree — the anti-laundering contract
Layer 3 · Authorize
Was it allowed?

Actenon

Authority bound to the act, not the actor. AuthN, policy engines and audit logs answer should this requester be allowed to do this kind of thing? Actenon answers the question the execution edge actually needs: is the exact action about to execute still the exact action that was authorized — this endpoint, this scope, this time window, this single attempt? No valid proof, no execution.

protocol — neutral wire contract kernel — the verifier · 51 conformance vectors permit — bounded grants · approvals · kill switch scan — finds the execution gap SDKs: Py · TS · Go · Rust
$ pip install actenon-permit && permit demo human approval, hard runtime limits, tamper-evident ledger — in one command
03 · prior art

Standing on giants, cited up front.

Nothing here was invented from nothing, and pretending otherwise would be the first lie on a page about proof. The lineage is real and we claim our place in it precisely: here is what each generation proved, and here is the specific thing it left open.

LineageWhat it provedWhat this stack adds
in-toto · SLSAsupply-chain attestation Build steps can be attested and artifacts bound to their build lineage — the supply chain became auditable. The runtime observation layer: what happened when it actually ran, observed at the edge, with a refusal taxonomy. A receipt can say NO and sign it.
DCO / sign-offdeclared provenance Contributors can declare the provenance of their work, and the declaration is enforceable. WorkProof extends sign-off from declaration to evidence — commands run, outputs hashed, AI level declared — for agent-assisted work.
FIDO2 / WebAuthnpresence at an edge Cryptographic proof of user presence, bound to a single act, verified at an edge. Actenon's direct inspiration, applied to agents: authority bound to the exact act — scoped, single-use, revocable, verified before the side effect.
Sigstore · TUFsigning infrastructure Artifact signing and verification can be public, free, and impossible to opt out of quietly. Same primitives — Ed25519, hash chains, a transparency ladder — applied to workflows and actions instead of artifacts.
CI itselfautomated checking Automation can check anything it is configured to check, on every change. CI checks what it's told to check. BootProof decides what to observe and signs what it saw — the check cannot be talked to, prompted, or socially engineered.
Reproducible buildsdeterminism Deterministic processes make claims checkable by anyone, forever. That principle is constitutional here: no LLM anywhere in the proof path. Every verdict is re-derivable from evidence or it doesn't ship.

If you think something here is prior art we missed or misread, that's exactly the kind of issue report we want — the conformance suite exists so you can check us the way we check agents.

04 · the artifact

Proof that travels.

The Living Receipt is the same evidence as the JSON attestation, rendered as a single self-contained HTML file that re-verifies its own Ed25519 signature in your browser with zero network calls. No server, no account, no trust in us — the math either checks out on your machine or it doesn't.

Inside the download: two real captures from a real bootproof up run — a repo that boots to HTTP 200, and one that segfaults at runtime. Click Tamper with signature and watch the verdict collapse. That's not a mockup of a verification UI; that's verification.

1.download the file (right-click → save as .html)
2.double-click it — opens locally, no network needed
3.click Tamper with signature — watch the verdict die
4.generate your own: npx bootproof up <repo> --receipt
the trust ladder — documented in the artifact itself
L1local_developer_signedintegrity since signing — shipped today
L2ci_oidc_signedsigned inside CI, identity from OIDC
L3neutral_runner_signedexecuted on a third party's runner
L4transparency_loggedappend-only public log, like CT
Exhibit Areal capture · not a mockup
The Living Receipt

Two receipts from one real run: the boot that answered HTTP 200, and the one that segfaulted. Both signed. Both self-verifying. Both happy to prove you can't quietly edit them.

The receipt carries the evidence, the signature, the trust level it was signed at, and what this receipt does not prove — printed on its face. A proof artifact that hides its own limits would be a strange proof artifact.

↓ Download the Living Receipt self-contained HTML · verifies itself offline · ~84 KB
05 · honest limits

What a receipt does not prove.

Every other section on this page sells. This one doesn't — and that's deliberate. A trust product that overclaims is a contradiction, so the limits are printed on the front door, the same way they're printed on the receipts. Full threat models live in each repo.

Not comprehension

A receipt proves commands ran and a service answered. It does not prove the contributor — human or agent — understood the output. Neither does a review, to be fair. But we say so.

Not code quality

No LLM judgment, no score, no suspicion score. A receipt is evidence, not opinion. If you want a machine's opinion about code, there are plenty of vendors.

Not absence of malice

A local attacker holding the signing key can fabricate a session around doctored tests. Mitigations are real but partial: CI re-execution, policy pinning, keyless signing on the roadmap.

Not a perimeter

Actenon's edge guarantee holds when the protected edge is the only path to the resource and the agent has no standing credential. Preconditions, stated in full in the kernel's scope document — no hand-waving.

"Raising the cost of lying is the claim — not eliminating it." — the WorkProof threat model, which is exactly as fun to read as it sounds