# Verify, don't trust.

**`@coproduct_inc/verify`** turns an agent run into **verifiable evidence** that it
stayed inside a declared capability boundary — evidence a third party can check
**offline, without trusting the agent or the platform that produced it.**

```sh
npx @coproduct_inc/verify nucleus-verify run-receipt.json
#  exit 0 → in bounds   ·   exit 1 → refused
```

## The problem everyone now has

97% of security leaders expect a material AI-agent incident in the next 12 months;
6% of budgets address it. The dominant failure mode has a name: the **lethal
trifecta** — an agent with private data + untrusted content + an exfiltration sink
gets turned into a *confused deputy*, exercising its authority for an attacker
(OpenClaw, CVE-2026-25253; Invariant Labs' GitHub-MCP exploit). Regulators are
arriving too: the EU AI Act's high-risk regime (Aug 2, 2026) demands **productized
evidence tied to real runs and operator identity** — not a dashboard, an artifact.

The runtime's job is to make that trifecta safe by *non-interference*. This
package's job is to **prove it happened**: an offline-verifiable receipt that the
agent stayed inside its declared boundary — i.e. was *not* a confused deputy.

## The one thing that's different: we recompute the verdict

Most "agent receipts" — including Microsoft's Agent Governance Toolkit — are a
**signed record of what the platform's own engine decided.** You trust the engine.

`@coproduct_inc/verify` is a **second, independent check.** Given the declared
boundary and the observed trace, it **re-derives** the in-bounds verdict and
confirms it matches the receipt — then checks an Ed25519 signature and a SHA-256
hash-chain. A **forged or mistaken** verdict is caught two ways: the recompute
disagrees, *and* the signature (taken over the honest verdict) breaks.

> A platform vendor is structurally incentivized to be *trusted*. A neutral
> verifier is incentivized to be *checkable*. That's the wedge.

| | Microsoft Agent Governance Toolkit | `@coproduct_inc/verify` |
|---|---|---|
| Capability manifest / policy | ✅ (denies outside the manifest) | relies on yours (any runtime) |
| Signed, hash-chained receipts | ✅ Ed25519 decision receipts | ✅ Ed25519 + SHA-256 chain |
| **Independent verdict recompute** | ❌ (trust the engine's decision) | ✅ **soundness floor — catches a forged claim** |
| Keyed on cryptographic principal, not display name | partial | ✅ rules out OpenClaw by construction |
| Verdict logic backed by machine-checked theorems | ❌ | ✅ (IFC noninterference, leanchecker-rechecked) |
| Footprint | a governance framework | one `npx` / one GitHub Action, **zero runtime deps** |
| Position | the platform | the **neutral verifier above any platform** (incl. AGT) |

We don't compete with the guardrail. We're the evidence layer **above** it — and
we verify *their* agents too.

## See it (90 seconds)

```sh
npx @coproduct_inc/verify --help          # or: bash examples/converting-demo.sh
```

1. **Clean run → attests** (exit 0). Auditor-grade evidence the agent stayed in bounds.
2. **OpenClaw bypass** — a call wearing an allowlisted *display name* but a different
   cryptographic principal → **refused** (exit 1). The CVE class, ruled out by construction.
3. **Forge the verdict** (claim `inBounds:true`) → **caught** by the independent recompute
   *and* the broken signature. This is the difference between a signed log and verifiable evidence.
4. **CI gate** — drop the Action in a PR; an out-of-bounds run **fails the build.** A merge gate, not a dashboard.

## Who it's for

- **AppSec** — a 30-second drop-in CI/PR gate, no platform migration, works above your existing guardrails.
- **GRC / SOC 2 / EU AI Act** — the receipt **is** the exportable audit artifact: offline-verifiable, tied to real runs and operator identity.

## Honest scope

It attests that the **observed trace** stayed within the **declared boundary** —
integrity-axis, model-level evidence. It is **not** a proof of arbitrary agent
behavior, and it does not vouch that the trace is a *complete* record of what the
agent did (completeness of capture is the runtime's job). It's the verifiable
evidence layer above probabilistic guardrails, not a replacement for them.

---

Sources for the market claims: [VentureBeat / Arkose 2026 agent-security survey](https://venturebeat.com/security/most-enterprises-cant-stop-stage-three-ai-agent-threats-venturebeat-survey-finds), [EU AI Act Art. 16 / Aug 2026](https://artificialintelligenceact.eu/article/16/), [Microsoft Agent Governance Toolkit](https://opensource.microsoft.com/blog/2026/04/02/introducing-the-agent-governance-toolkit-open-source-runtime-security-for-ai-agents/), [PipeLab — mediator receipts / independent attestation](https://pipelab.org/blog/independent-attestation-mediator-receipts/).