Reads the destination directly. Live means verified today.
“Done” is a claim, not a fact.
Tracing tools record what the agent reported. Reputation systems record reviews and payments. When the push never happened, the post never went live or the budget never moved, the report still says success — and somebody finds out days later, if at all.
The only thing that settles it is the destination's own record.
“Pushed a1b2c3 to main.”
Did not match: main's commit list has no a1b2c3.
“The deploy is live and answering.”
Matched: The URL answers 200. It matches.
“Published the launch post at 09:02.”
Did not match: The account's own timeline stops at 08:14.
All three reported success. Only one of them was telling the truth.
How a claim becomes a receipt
Six stages, in this order, every time. The rule that shapes all of them: the evidence comes from the destination, never from the agent that made the claim.
- 1
A claim arrives
“I pushed a1b2c3 to main.” From an SDK call, an MCP tool or a Claude Code hook. It is untrusted from the moment it lands.
- 2
The destination is read
Not the agent's log, not its trace — GitHub's own commit list, over read-only access you grant and can revoke.
- 3
A verdict is decided
Verified, Failed, Mismatch, Late, or Couldn't check. A verifier that times out or loses permission gives Couldn't check. It can never give Verified.
- 4
A receipt is signed
Ed25519, over the canonical bytes. The receipt carries the evidence, not the content it came from.
- 5
It joins an append-only log
Each receipt is a leaf in a Merkle tree. Nothing already in the log can be edited or quietly dropped.
- 6
The root lands on Base Sepolia
The log's root is published on-chain through EAS, on Base Sepolia (testnet) today. After that, not even we can backdate a receipt.
A document, not a dashboard row.
A receipt carries three proofs and nothing else it doesn't need: an Ed25519 signature over its canonical bytes, its position in the append-only log, and the on-chain anchor that fixes the log in time. It records fingerprints, never the content it read.
All three check independently. The verifier is open source and talks to a public Base RPC, so the person you send a receipt to needs no QED Proof account, no QED Proof API, and no reason to take our word for anything.
$ uv run check.py receipt.json poaw-keys.json \
--rpc https://sepolia.base.org
signature ✓
inclusion ✓ leaf 8 of 9
anchor ✓ block 47,309,207
trust level 2 proven by 21:38:22Four people open this. They ask four things.
The team running agents in production
“Which of last night's runs actually landed?”
The claims list, filtered to everything that didn't verify.
A marketing agent that posts and moves ad budgets, a coding agent that pushes, an ops agent that deploys — each one reports its own success.
The operator, arriving from an alert
“What broke, and is it still broken?”
One verdict, the destination's own words for why, and the one thing to fix.
They were doing something else ninety seconds ago. The page has to answer before it explains.
The developer wiring it in
“What do I POST, and what comes back?”
An API key, a claim payload, and a receipt with a reason code you can branch on.
A verifier that errors returns Couldn't check, never Verified. That is the contract, not a caveat.
Whoever was sent the receipt link
“Why would I believe any of this?”
The signature, the inclusion proof and the anchor — checked in your own browser.
They have no account and no reason to trust us. The proof has to hold anyway.
What it reads today
Written the way the product works: a destination is either being verified now, connectable while its verifier is built, or not started. We don't list a check we haven't shipped.
Verifying now
- github.commit.pushthe branch's own commit list, for the SHA the agent named
- github.pr.openthe pull request, and whether it is really open
- github.checks.passthe check runs on that commit, and their conclusions
- http.url.statusthe URL itself, from our network, at the status claimed
- slack.message.postthe channel's own history, for the message at the timestamp the agent named
- x.post.publishthe post itself, and whether it came from the connected account
Connectable · verifier next
- Meta — Pages, Instagram, Adsconnected read-only today; posts, Reels and ad-account changes next
Not started
- WhatsAppno connector yet — waiting on Meta Embedded Signup
- Gmailno connector yet — gated on a catalogue and pricing check
Prove only what costs you money.
Proving that an agent pushed a commit won't keep anyone up at night. Proving that it changed an ad budget will. A pipeline is a rule you write once, in a form or in JSON, that says exactly which actions deserve a receipt.
Facts still come only from the destination, and your conditions can narrow a verified, never create one. The rule itself is hashed into the receipt, so whoever holds it can see precisely what was checked.
A marketer's pipeline, part by part
- Connectora vetted, read-only connection to one destinationMeta Ads account act_… , ads_read only
- Triggerthe agent's claim, or a poll of the destination's own change historyboth
- Filterconditions on the destination's own event fieldsevent is a budget change · campaign in {A, B} · new budget ≥ $50
- Checka published verifier profile, narrowedthe new budget matches the claim, changed by the agent's app, within 10 minutes
- Outcomesa receipt, and alerts where you already lookreceipt always · alert on mismatch, late, or a change nobody claimed
And the case plain logging never catches: a budget change the agent didn't report. Watch mode reads the account's own change history, matches it against open claims, and anything left over is an unclaimed change.
Open where trust needs it.
A verifier nobody can inspect is just another claim. QED Proof's spec, verifiers, node and checker are public, and you can run the whole thing yourself. There's no token — the chain only timestamps the log.
Read the protocol on GitHub- The receipt spec, the verifiers, the node and the checker are public.
- docker compose up runs the whole node on your own machine.
- A receipt verifies against a public Base RPC, with no QED Proof in the path.
Find out what your agents actually did.
Connect a repository, send one claim, read the receipt. Questions go to our Discord.