The Agent Accountability Platform
Cryptographic proof of what your AI agent did.
Verifiable receipts, ground-truth verification and replayable governance for agent work. A tamper-evident audit trail for every invocation — verifiable by anyone, no access to the operator required.
receipt.jsonv1.0
skillagentmail v1.2.0
operatored25519:f19bc125…
publishered25519:a07c7eb5…
inputs_hashsha256:62622f40…
outputs_hashsha256:86f2cb02…
sandboxbwrap · no net
structure✓ valid
manifest✓ consistent
signature✓ verified
SEALED
ed25519
◆
◆ signed by publisher
◆ sealed in sandbox
◆ verified by anyone
Platform
Trust infrastructure for the agent economy.
Agents are doing real work — writing code, moving money, touching production. Traceseal is the accountability layer underneath: prove what ran, verify it against ground truth, replay it under governance.
/ RECEIPTS
Verifiable receipts
what ran, signed
Every agent invocation emits a signed, self-contained receipt: skill identity, content-addressed manifest, input/output hashes, sandbox profile, operator signature.
- ed25519 signatures
- SHA-256 content hashes
- canonical JSON — any tamper breaks the seal
/ VERIFICATION
Ground-truth verification
did it actually work
Attestation goes beyond "it ran": commands re-execute inside a kernel-namespace sandbox, and forbidden actions are enforced by the sandbox itself, not merely observed.
- bwrap isolation — read-only root, no network
- enforcement-as-attestation
- independent witness cosigning
/ GOVERNANCE
Replayable governance
audit at any time
Receipts chain into a transparency log. Any third party can re-verify the whole history with one command — no access to the operator's machine, keys or audit trail.
- public transparency log
- chained run receipts
- exit codes: 0 valid · 1 invalid
How it works
Three roles. One verifiable proof.
Every receipt has three sections: what ran, who authorised the code, and who vouches for the execution. Any third party can verify all three.
01
Sign
publisher → skill
The publisher signs the skill bundle with an ed25519 key. The signature covers every source file via a content-addressed manifest, recorded in the transparency log.
- Algorithm: ed25519
- Covers: manifest over all source files
- Published: transparency log entry
02
Seal
operator → execution
The operator runs the signed skill inside a kernel-namespace sandbox. The runtime records inputs, outputs, timing and sandbox configuration as hashes, then signs the record.
- Sandbox: bwrap isolation
- Records: input/output content hashes
- Signed: operator ed25519 signature
03
Verify
anyone → receipt
Any third party installs traceseal-verify and runs one command. The verifier checks the operator's signature over the canonical JSON. No operator connection. No trust assumptions.
- Input: receipt.json only
- Dependency: cryptography
- Exit codes: 0 valid · 1 invalid
Regulation is arriving
The EU AI Act makes agent transparency mandatory.
Article 50 transparency obligations take effect on 2 August 2026. Organisations deploying AI systems will need to demonstrate what their systems did — not assert it. Signed execution receipts turn that from a documentation exercise into a one-command verification. Read Article 50 →
02 AUG 2026EU AI Act · Article 50 applies
Built in the open
Open spec. Open verifier. Public log.
Everything a third party needs to hold an agent to account is public — the receipt spec, the verifier, the runtime attestation tooling, and the transparency log itself.
traceseal-verifyPyPI v1.0
The independent verifier. One command, one receipt.json, zero trust assumptions. Ships with the open receipt spec.
traceseal-observePyPI
Runtime attestation: records execution inside the sandbox, hashes inputs and outputs, and signs the receipt with the operator key.
traceseal-langchainPyPI
Drop-in LangChain integration — signed receipts for chain and tool invocations without changing your agent code.
alibiopen source
The trust harness: reproducible behavioural probes that grade agent CLIs, emitting signed, witness-cosigned Traceseal receipts.
Transparency log: log.traceseal.io
Get started
Verify a receipt in 30 seconds.
No account. No API key. Just a receipt and the open-source verifier.