Agent Week

An agent's own log is the worst possible evidence: the thing being audited writes it. agentproof gives an agent two things it cannot give itself.

1. A gate it cannot skip. Five classes of action - spending money, sending messages, publishing, touching credentials, deleting - go through an approval gate. The agent may draft, never dispatch. Approval signs an HMAC over the exact payload; execute() recomputes it and refuses on a single changed character, so a bug, a retry, or a prompt injection hidden in a tool result cannot widen what was approved. There is no approve-all.

2. A receipt it cannot rewrite. Every intent, approval, refusal and execution is sealed into an append-only hash chain (prevHash -> hash). Batches are summarised by a Merkle root, and that root is written to Solana as an SPL Memo. Re-derive the root from the file on disk and compare it with the chain: a deleted, edited or reordered entry changes the root, and the verifier prints exactly which record broke.

What is real: the gate, the HMAC binding, the hash chain, the Merkle batching, the devnet memo anchor, the verifier (including its tamper tests), the CLI and the test suite - all runnable from a clean clone with npm test and npm run demo.

What is mocked: the demo agent is a stand-in that performs harmless sample actions (write a file, "send" a mail to a local sink) so the gate and the log can be shown end to end; no real money, no real recipients, devnet only.

Pre-hackathon work is marked in the README: our own ops stack already had a click-to-approve queue; the gate semantics, HMAC binding, hash chain, Merkle anchor and verifier in this repo were built for Agent Week.