Prove the record wasn't altered. Without sending it anywhere.
Attestroot is a local-first evidence layer for AI agent activity. It will capture a tamper-evident record of what your agents do — entirely inside your own infrastructure — hash-chain it, and commit it to an RFC 6962 Merkle tree, so that only the 32-byte root ever needs to leave your perimeter to be independently countersigned.
Stated up front because the product's whole premise is not overclaiming. If this page described a finished system, you should not trust the rest of it.
Every log you have is controlled by the party being audited.
AI coding and automation agents now read source code, execute commands and modify production systems on their own. Your organisation is accountable for what they did. When a SOC 2, ISO 27001, DPDP or HIPAA assessor asks you to evidence it — which files, which commands, and whether the record is complete and unaltered — most teams cannot answer at all.
The reason is structural, not a missing feature. Your records come either from the AI vendor or from your own systems. Both are self-attested: the party being audited holds the evidence and can add to it, remove from it, or backdate it without detection. That is why financial statements have required an independent auditor for over a century — and it is the same gap, arriving in a new place.
Capture locally. Commit cryptographically. Countersign independently.
Capture, locally
You install it. It records agent activity inside your own infrastructure and appends each record to a hash chain. Nothing is routed through us — a vendor in the request path is itself an exfiltration risk.
Commit
Records are committed to an RFC 6962 Merkle tree, producing one 32-byte root that binds the whole set. Any insertion, deletion or reordering changes it. The root discloses nothing about the content.
Countersign not built
Only the root would cross the boundary, to be countersigned and timestamped by a party that is not you — so your assessor verifies against someone other than the organisation being audited.
countersignature
Source code, file contents, prompts and command output never cross the dashed line. The root is a hash — it cannot be reversed into the records it commits to.
"Independent" — of whom, exactly?
Independent of the organisation being audited. That is the property audit standards require, and the one a customer cannot manufacture for itself.
It does not mean independent of us. Avatrox would run the countersignature service and is the vendor — so the honest description is a second party holding a commitment the first party cannot retroactively change, not a neutral arbiter. That is weaker than a public transparency log and stronger than self-signing, and it is worth being precise about, because an assessor will ask this question first.
A defensibility grade your assessor can read without reading your source code.
Sealed record sets are graded D0–D4 against the published framework below. The grade is deterministic by design: the same evidence and the same grader version produce a byte-identical report, with no model judgement anywhere in the loop. The scheme is published; the grader that emits it is not yet written.
| Grade | What it means | Requires |
|---|---|---|
| D0 | No verifiable structure at all. | |
| D1 | Structured record, but completeness is unproven. | |
| D2 | Complete, hash-chained, integrity verifies — self-signed. | free tier ceiling |
| D3 | Independently countersigned and timestamped. | a third party |
| D4 | Fully replayable from the bundle alone, on a clean machine. | assessor-grade |
Free · open source
Unlimited local capture and retention, full grading, offline verification. MIT, no signup, nothing leaves your machines.
CEILING: D2Team
Countersignature of Merkle roots by a party that is not you, with timestamp anchoring. Multi-repository views.
UNLOCKS: D3Compliance
Assessor-ready report packs issued under the company's name, SSO, SLA, priority support.
PATHWAY: D4Indicative pricing for a service that is not yet live. Nothing is for sale on this page and there is nothing to sign up for.
The free tier stops at D2, and that is not a paywall dressed up as a limitation. Self-attested evidence is structurally weaker — that is the entire premise of auditing. You cannot be your own independent witness, which is also why the paid tier cannot be forked: client-side limits in MIT code are one constant and one recompile, but you cannot fork a counterparty.
What we do not claim.
Products in this category tend to overclaim here, and the first assessor who tests the claim finds it. So this is stated plainly, on the homepage, rather than buried:
Our own grade, disclosed before you ask
Applying this scheme to itself: the Attestroot implementation is self-graded D3. That grade is single-author, self-assessed, and has not been externally verified by anyone. No independent party has reviewed the construction, the grading logic, or this claim.
By the standard's own logic that is exactly the weakness it was written to expose — self-assessment is what D3 is supposed to rule out. External verification is a prerequisite before any of this is sold, not a nice-to-have afterwards. Stated here because a scheme about independent verification that quietly exempts itself is worth nothing.
The honest boundary
A party that controls its own capture could record something false, and we would faithfully countersign it. Integrity and existence-in-time is a real, useful, checkable property — it is simply not the same property as truthfulness, and conflating the two would make the evidence worthless the moment anyone competent examined it.
This limit is enforced in software, not just in wording. Each capture method declares its own blind spots in a machine-readable manifest, and evidence that lacks independent ground truth is automatically capped at a lower grade with the reason recorded in the report.
What each capture point can honestly prove.
Different integration points see different things, and none of them sees everything. Rather than claim uniform coverage, each declares its own blind spots in a machine-readable manifest — and evidence that cannot establish completeness is capped at a lower grade automatically, with the reason recorded.
| Capture point | Sees | Honest ceiling | Status |
|---|---|---|---|
| Claude Code hooks | Every tool call, plus transcript ground truth | Full completeness provable | FIRST TARGET |
| MCP proxy | All MCP traffic of any MCP-speaking client | Full for MCP tools; blind to native tools — declared partial | PLANNED |
| OpenTelemetry GenAI | Whatever the application instruments | As-instrumented; gaps undetectable | PLANNED |
| Log import (post-hoc) | Whatever survived | No ground truth ⇒ completeness unknowable ⇒ caps at D1 | PLANNED |
That last row is the point, not an apology. "Just import your old logs" cannot produce high-grade evidence, because nothing in an old log proves what is missing from it. Saying so mechanically is more useful than saying yes and being wrong later.
The standard was published first, openly, with permanent DOIs.
Open-access on Zenodo, independently archived and timestamped. The D0–D4 grading scheme and the hash-chained ledger this product builds on are not marketing constructs invented after the fact — they are prior art you can read, cite and disagree with.
Implementing Agentic-AI Accountability: A Minimal, From-Scratch Reference Stack Mapped to the IMDA MGF, EU AI Act, NIST, and ISO/IEC 42001
Governance frameworks require agentic AI systems to prove what they did, but none tells a builder how. Systematises the evidence an accountable agent must produce into five principles — Provenance, Contemporaneity, Reproducibility, Disclosure and Independence — with a crosswalk mapping each to all four regimes at once, and an evidentiary maturity lens grading evidence D0–D4 by what would survive an adversarial challenge.
10.5281/zenodo.21387486incident-ledger: a tamper-evident, append-only evidence log for agentic AI
The reference implementation. An append-only, hash-chained log where each entry seals the one before it, so editing any row invalidates every row after it and verification reports the exact sequence number where the chain broke. Includes RFC 6962 Merkle checkpoints and O(log n) inclusion proofs. Stdlib only, no dependencies, no network. Measured at 0.47 ms per append.
10.5281/zenodo.21387488Suspicion Is Not Confirmation: Behavioral Admission for Runtime Tool Acquisition, with Honest Measurements at Small Scale
An agent that discovers a tool at runtime learns what it does from documentation, and documentation drifts. Shows the gap is not closable by scale, and proposes a behavioural admission gate that derives a contract from the documentation and tests it in a sandbox.
10.5281/zenodo.21447259Scope note, taken from the accountability paper itself: tamper-evident logging, deterministic replay and evidence-maturity grading are cited prior art, not claims of that paper. Its contribution is the systematisation across a fragmented literature, the four-framework crosswalk, the measurement, and the evidentiary lens.
The core is MIT. No signup, no telemetry, no network calls.
Capture, sealing, grading and offline verification are open source and run entirely on your machines. There is no account to create and nothing phones home. Evidence is built on published standards — RFC 6962 Merkle commitments, RFC 8032 Ed25519 signatures, SHA-256 hash chaining — so any party can verify a bundle with their own tools, without our software and without contacting us.
# PLANNED INTERFACE — not yet published. This will not install today. pip install attestroot # capture a session, then seal it attestroot init attestroot seal <session-id> # verify a bundle on any machine, with no local state attestroot verify --offline-bundle session.arbundle
Looking for design partners
If you run AI agents against real systems and have been asked — or expect to be asked — to evidence what they did, I want to hear what actually breaks. Specifically: what your assessor asked for, what you could not produce, and what you had to say instead.
hello@attestroot.com · No signup, no mailing list, no sales sequence — there is nothing to sell yet.
The predecessor implementation this builds on —
incident-ledger —
is public and MIT-licensed today, with its own DOI in
published work
above.
[attestroot repository — link on public release]