SealedRun

Every step your AI agent takes, sealed in real time.

A signed hash chain of model calls, tool calls and policy decisions, anchored in a public witness. Verified offline by anyone, without trusting you.

Verify a bundleRead the specSource on GitHub
Ed25519 + ML-DSA-65SHA-256 chainRekor / RFC 3161
seq
8
kind
anchor
witness
rekor 2908934665
hash
f04cd7a72d762a458218471eb31b0a59541dfcb7b73ef0eb9fbab4c092a3ca4f
chain
intact · 9/9 signed

How it works

  1. 01
    Delegate

    The accountable organisation (Principal) signs a Delegation for an Agent key set.

  2. 02
    Record

    Every step of a run — model call, MCP tool call, memory access, policy decision, human approval — becomes a Record with payload digests, data labels, policy reason, prev_hash and hash.

  3. 03
    Sign

    Each Record carries a hybrid Ed25519 + ML-DSA-65 signature by the Agent, so the chain stays verifiable after classical signatures fall.

  4. 04
    Anchor

    The chain head is periodically anchored in an external witness (Sigstore Rekor, RFC 3161), so the operator cannot silently rewrite history.

  5. 05
    Verify

    Records, delegations, payloads and a signed manifest are exported as a Bundle. Anyone verifies it offline with the open verifier, without trusting the operator.

What a valid bundle proves

  • Every record was produced by a key the Principal delegated to.
  • No record was inserted, removed or reordered after the fact.
  • Payload digests match the payloads, where payloads are included.
  • The chain existed no later than the external anchor timestamp.

What it does not prove, and the attacks it handles, are spelled out in the trust model.

Standards, not invention

  • RFC 8785 canonical JSON, SHA-256 hash chain
  • Ed25519 (RFC 8032) + ML-DSA-65 (FIPS 204) hybrid signatures
  • Sigstore Rekor and RFC 3161 anchoring
  • Record format compatible with MCP SEP-3004 and IETF agent audit trail drafts
  • JSON Schemas published at /schema/0.1/

Install

pip install sealedrun
npm install @sealedrun/core
docker run -p 8080:8080 ghcr.io/sealedrun/sealedrun:0.1.1

Python and TypeScript packages contain the format, signing and the verifier. The Docker image runs the recorder service and the Inspector. Live recording of agent traffic is in development; see the changelog.