PROOF.md

# ABOUT PROOF.MD

PROOF.md is a working idea: a plain markdown file where an AI agent keeps a record of what it was asked, what it did and who said yes. The agent writes each record as it works: an approval, an action, a piece of work, a permission. It hashes the record, signs the hash with its own key, and puts the hash of the record before it in the next one. Months later, when someone asks who allowed a payment or a deploy, there is a signed line to start from: anyone can check with stated formulas that it was not altered, and which key signed it.

## WHAT IT COULD COVER

• - approvals: who said yes or no, to exactly what, and until when
• - actions: what the agent did outside its scratch space, and the target
• - work: input and output fingerprints for anything others will rely on
• - permissions: scope, time and amount, compared before each use
• - the chain: each record carries the hash of the one before
• - signatures: which key signed, and whose key it is said to be
• - the head: the latest hash, copied somewhere the agent does not control
• - checks: the exact formula for each check, so anyone can redo it
• - limits: what a record shows, and what it does not

## HOW IT COULD WORK

• - the format: each record as canonical JSON, hashed with SHA-256
• - the key: an Ed25519 key made on the agent's machine; the private half never leaves it
• - the chain: records appended to a JSON Lines file, never edited in place
• - the anchor: the head hash sent each night to the owner, or to a timestamp service
• - the check: any laptop recomputes every hash and signature, offline
• - the stop: a failed check halts the agent until a person looks

## STANDARDS IT COULD NAME

• - SHA-256: a hash from the SHA-2 family in NIST FIPS 180-4; change one byte and the digest changes
• - Ed25519: an EdDSA signature scheme, described in RFC 8032
• - ECDSA P-256: an older curve signature, in NIST FIPS 186, for systems without Ed25519
• - JSON Canonicalization Scheme: RFC 8785, one exact byte form of a JSON value, so two people hash the same bytes
• - Merkle trees: many hashes rolled into one root; Certificate Transparency logs, RFC 6962, are built on them
• - RFC 3161: the Time-Stamp Protocol, where a timestamp authority signs a hash together with a time
• - Sigstore: an open-source project for signing software, with a public transparency log called Rekor
• - OpenTimestamps: an open-source way to anchor a hash in the Bitcoin blockchain
• - ESIGN, UETA and eIDAS: laws in the US and the EU on when electronic signatures and records count

## WHO IT COULD HELP

• - small finance teams: keep a checkable record of the approval behind each payment an agent prepared
• - agencies: hand a client a checkable record of the work an agent did for them
• - IT admins: tie each change an agent made to the permission it used
• - compliance staff: keep approvals with an expiry, and see the ones that lapsed
• - open-source maintainers: record which agent built a release, from which inputs

Agents now act faster than anyone can watch. The question usually comes later: who allowed this? A record written at the time, signed and chained, is easier to check than a memory or a log anyone can quietly edit.

## A SKETCH

```md
---
proof: draft
---
# PROOF.md
- chain: ops-agent, Ed25519 key 7c1e0a94 (made up)
- hash: SHA-256 of canonical JSON (RFC 8785)
- 1 approval: owner yes to "renew hosting", expires 11-12
- 2 action: renewed hosting, prev 1, result 9b04...
- 3 work: October report written, prev 2, output e51a...
- 4 permission: agent may pay invoices under 300.00 USD
- rule: 300.00 USD or more needs a new approval record
- head: hash of record 4, copied to the owner each night
- check: recompute each prev, then verify each signature
- on fail: stop and tell the owner what failed
- never: private keys, prompts or personal data here
```

## DISCLAIMER

PROOF.md does not sign, store, timestamp or notarize anything, and it does not enforce what a record says. A chain of hashes shows a record altered or removed in the middle. It does not show records cut from the end, or a whole file rewritten and signed again by whoever holds the key; a head hash copied elsewhere only helps someone notice. A signature shows which key signed, not who held it or that a statement is true. Whether a record counts as evidence or as a signature depends on the law where you are. Keys, names and amounts in the sketch are made up.

PROOF.md is an informational page. It is provided as is, without warranty of any kind, and may be incomplete, inaccurate or out of date. Nothing here is financial, investment, legal, tax, insurance, medical, engineering, safety or other professional advice, or an offer or solicitation of any kind. The sketch is an illustration, not a standard or a recommendation. Names of third-party products or companies, if any, are used only to describe them; no affiliation or endorsement is implied. Use at your own risk. This page sets no cookies and runs no scripts or analytics; like any website, its host keeps standard request logs.