No proof, no green check. The proof company for the agent era.
Your AI agent says it's done. Your CI badge says it passed. One is a claim, the other is a setting — neither is evidence. Everything in this org exists to replace asserted success with observed, signed, portable proof.
$ npx bootproof up . # a signed receipt for any repo, 60 seconds
Agent work needs three kinds of proof. Three products, one primitive underneath: observed evidence, signed, verifiable by anyone. Deterministic end to end — no LLM judges, no telemetry, ever.
| Question | Product | What it does |
|---|---|---|
| Did it actually work? | bootproof |
Zero-trust supervisor: inspects a repo, runs an evidence-based plan, observes real health, signs the outcome — success, failure, or refusal |
| No observed boot, no merge? | receipt-gate |
GitHub Action that blocks PR merges until BootProof observes a real boot. Emits an ed25519-signed receipt |
| Is a stranger's repo safe to run? | repo-proofer |
Zero-network sandbox + strace exfil detection. uvx repo-proofer <url> — 100% deterministic, no AI |
| Can you prove what you did? | workproof |
The DCO sign-off of the agent era: signed receipts on AI-assisted PRs — commands run, outputs hashed, AI level declared, sessions hash-chained |
| Was it allowed? | Actenon |
Authority bound to the act, not the actor: protocol · kernel (51 conformance vectors) · permit (bounded grants, approvals, kill switch) · scan · SDKs in Python/TS/Go/Rust |
cd /path/to/any/repo
npx bootproof up .BootProof inspects the repo and either proves it booted or explains why it refused.
Prefer not to run a stranger's code first? Download the Living Receipt — a single HTML file that re-verifies its own ed25519 signature in your browser with zero network calls. Two real captures inside: a repo that boots to HTTP 200, and one that segfaults. Click Tamper with signature and watch the verdict die:
curl -sL https://github.com/bootproof/bootproof/raw/main/assets/living-receipt.html -o proof.bootproof.html
open proof.bootproof.htmlMake the agent hand you a receipt every time it claims done — in .claude/settings.json:
{
"hooks": {
"Stop": [{
"hooks": [{
"type": "command",
"command": "npx -y bootproof@0.4.1 up . --provider local --unsafe-local --json --timeout 60000 > .bootproof-last.json; node -e \"const r=require('./.bootproof-last.json'); console.log(r.booted && r.healthVerified ? '✅ RECEIPT: work boots and answers' : '❌ NO RECEIPT: ' + (r.failureClass||'boot not observed'));\""
}]
}]
}
}This stack stands on in-toto and SLSA (build attestation), DCO (contribution sign-off), FIDO2/WebAuthn (per-act cryptographic presence), Sigstore/TUF (public signing infrastructure), and CI itself. The specific gap all of them leave: they attest lineage or check what they were configured to check — none of them observe the runtime, sign what actually happened, and refuse. A BootProof receipt can say NO and sign it. The full delta table is on the front door.
A receipt does not prove comprehension, code quality, or absence of malice — a local attacker holding the key can fabricate a session. Mitigations are real but partial: CI re-execution, policy pinning, keyless signing on the roadmap. The trust ladder (local_developer_signed → ci_oidc_signed → neutral_runner_signed → transparency_logged) is documented in every artifact. Raising the cost of lying is the claim — not eliminating it. Full threat models ship in each repo.
Everything above, with a live in-browser Ed25519 demo (watch an agent's lie break a signature): bootproof.github.io
Apache-2.0 · deterministic · no telemetry, ever. Built by one person and their agents — every PR to these repos carries its own receipt, including the ones that built the receipts.