HREVN AgentProof

The description states that HREVN AgentProof:

• Converts observed Codex sessions into a privacy-preserving, tamper-evident Evidence Bundle.
• Uses SHA-256 commitments for file states and diffs, while keeping prompts, source code, stdout, stderr, and diff contents private.
• Anchors the canonical receipt in an Ethereum Sepolia transaction using Ed25519 signing.
• Provides a browser-based verification process where reviewers can compare repository files against sealed commitments without uploading them.
• Includes a reusable GitHub Action that verifies repositories before sealing evidence.
• Operates with a CLI capture adapter and public interface built in Python, FastAPI, and JavaScript.

Inference The system appears to be designed for AI agent auditing or trust verification in software development workflows. It is not described as a general-purpose tool but rather one tailored for Codex-based agents.

The description states:

• AgentProof replaces “trust the agent” with a portable, independently verifiable receipt.
• It aims to prove integrity and order of events observed by an instrumented collector.
• The system is described as tamper-evident but not exhaustive — it does not claim to observe bypassed actions.

Inference The positioning centers on trust in AI agents through cryptographic verification. The evolution from a general HREVN system to a specific layer for agent sessions suggests a targeted application within the AI coding space.

The description states:

• AgentProof is built for developers or reviewers who need to audit Codex agent actions.
• It supports use cases in CI/CD pipelines via GitHub Actions.
• A reviewer can verify the integrity of a repository without needing an account or access to sensitive content.

Inference The primary ICP appears to be developers or teams using AI coding agents (e.g., Codex) in software development workflows, particularly those concerned with auditability and trust in automated actions.

Not evidenced. The description does not mention pricing, monetization, or business model details.

The description states:

• Built using Python, FastAPI, JavaScript, Docker, GitHub Actions, Ethereum Sepolia.
• Uses Ed25519 signing and SHA-256 commitments.
• Implements a browser-based verification process with Web Crypto API.
• Includes a CLI capture adapter, public interface, and GitHub Action.
• The system is described as reproducible via Git diff and includes Apache-2.0 license.

Inference The technical stack suggests a developer-oriented tool built for integration into CI/CD pipelines. The use of cryptographic commitments and Ethereum anchoring indicates a focus on verifiability rather than performance or scalability.

Not evidenced. There is no mention of revenue, customers, usage metrics, or product maturity beyond the hackathon demo.

Not evidenced. No information is provided about competitors or market positioning in relation to other tools for AI agent auditing or verification.

• The project is described as a hackathon submission with no evidence of traction or real-world adoption.
• It relies on a single developer (Miguel Herrero) and lacks team or organizational structure.
• No external validation, third-party audits, or independent verification are mentioned.
• The system is described as “deliberately” not exhaustive — it does not claim to observe all actions, which may limit its utility in high-security environments.

1. What is the actual use case for this tool beyond the demo?
2. Has there been any real-world testing or feedback from users?
3. How does AgentProof handle edge cases like agent runtime failures, network interruptions, or malicious inputs?
4. Is there a plan to expand support beyond Codex agents?
5. What are the long-term maintenance and scalability plans for this system?