Evidence of what your AI agent did. Not a log it wrote about itself.

Every model call, tool call and decision sealed in a signed hash chain, bound to the mandate the agent was given, corroborated by the systems it touched, anchored in a public witness. Verified offline by anyone, without trusting you.

Verify a bundle Read the spec Source on GitHub

Ed25519 + ML-DSA-65SHA-256 chainRekor / RFC 3161

seq: 8
kind: anchor
witness: rekor 2908934665
hash: f04cd7a72d762a458218471eb31b0a59541dfcb7b73ef0eb9fbab4c092a3ca4f
chain: intact · 9/9 signed

Change one field. Watch verify refuse it.

Thirteen seconds, real commands: the example bundle verifies, one record is edited the way an insider would, and the verifier names the file whose digest no longer matches. Reproduce it with scripts/demo_tamper.py from the repository.

How it works

01
Delegate
The accountable organisation (Principal) signs a Delegation for an Agent key set.
02
Record
Every step of a run — model call, MCP tool call, memory access, policy decision, human approval — becomes a Record with payload digests, data labels, policy reason, prev_hash and hash.
03
Sign
Each Record carries a hybrid Ed25519 + ML-DSA-65 signature by the Agent, so the chain stays verifiable after classical signatures fall.
04
Anchor
The chain head is periodically anchored in an external witness (Sigstore Rekor, RFC 3161), so the operator cannot silently rewrite history.
05
Verify
Records, delegations, payloads and a signed manifest are exported as a Bundle. Anyone verifies it offline with the open verifier, without trusting the operator, and gets the answers an auditor asks for: what was allowed, what was touched, who asked.

A signed log says nobody edited it. An auditor asks three more questions.

Did the agent stay within its mandate?

The Principal writes what the agent may touch into the delegation: targets, locations, data labels, a record budget. The verifier checks every step against it and names each one outside, by step number. Nothing is buried in a log you have to read.

Does the changed system confirm it?

Each relayed call carries a receipt the recorder wrote from the upstream's own reply. Steps reported from the agent's code carry what the target returned: a commit sha, a file digest, a transaction id. The auditor checks them against that system's log, and the trust model says plainly what a self-reported step does not prove.

Is the chain across agents one chain?

When agent A asks agent B, B's run names the exact record that asked and the authority it derives from. The verifier binds the runs: the record exists, B started after A, B's mandate is within A's. A, B, C, D become one provable sequence, not four logs with similar timestamps.

OK bundle 0192b3c4-…: 1 run(s), principal trusted
  run 0192b3c4-…: 9 records, complete, anchors 1, witness verified 1,
      scope findings 1, receipts 7 proxy / 1 self-reported
    seq 5 scope.target: target filesystem/write_file is not in allowed_targets

What a valid bundle proves

Every record was produced by a key the Principal delegated to.
No record was inserted, removed or reordered after the fact.
Payload digests match the payloads, where payloads are included.
The chain existed no later than the external anchor timestamp.
Every step stayed within the delegation's scope, or the verifier names the ones that did not.
Relayed replies are the ones the upstream returned; runs started by other agents name the record that asked.

What it does not prove, and the attacks it handles, are spelled out in the trust model.

Standards, not invention

RFC 8785 canonical JSON, SHA-256 hash chain
Ed25519 (RFC 8032) + ML-DSA-65 (FIPS 204) hybrid signatures
Sigstore Rekor and RFC 3161 anchoring
Record format compatible with MCP SEP-3004 and IETF agent audit trail drafts
JSON Schemas published at /schema/0.1/

Install

pip install sealedrun
npm install @sealedrun/core
docker run -p 8080:8080 ghcr.io/sealedrun/sealedrun:0.8.1

Python and TypeScript packages contain the format, signing and the verifier. The Docker image runs the recorder service and the Inspector. Live recording of agent traffic is in development; see the changelog.