Every AI agent that does real work ends the same way: it tells you it finished. Pushed to main. Posted the update. Raised the budget. Deployed.
That sentence is doing a great deal of load-bearing work. Dashboards count it. Alerts stay quiet because of it. Some teams now pay agents, or pay for agents, on the strength of it. And it comes from the one party with no way to be independent about the answer: the agent itself.
Self-report fails in boring ways
The failures that matter aren't dramatic. They're the ones where the agent is sincerely wrong:
- It committed to a local branch and the push failed on authentication. The log line says
pushed. - The CI run it waited on was a different commit's.
- The post API returned 200 and the platform rejected the media afterwards.
- It edited the budget on the wrong campaign.
In each case the agent's own trace looks like success, because the trace records what the agent did and believed, not what the destination holds. Tracing and observability tools are genuinely useful — they just answer a different question. They tell you what your agent said. They can't tell you whether it was true.
The only record that settles it
Whether a commit is on main is a fact about GitHub, not about the agent. Whether a URL answers is a fact about the URL. So QED Proof has one rule it never bends: evidence comes from the destination, never from the agent's report.
When a claim arrives, QED Proof waits until the work should be visible, then reads the destination itself over access you grant read-only. It compares what it finds with what was claimed and decides one of five verdicts: Verified, Failed, Mismatch, Late, or Couldn't check — the five verdicts.
Failing in the safe direction
The last verdict is the most important design decision in the product. A verifier can fail for reasons that say nothing about the agent: a timeout, a revoked permission, an action nobody has built a verifier for yet. In every one of those cases the verdict is Couldn't check — never Verified.
A trust product that passes something that didn't happen is finished. One that occasionally says "I couldn't see" is merely honest. So the code is written so that there is no path from an error to a green tick, and "Couldn't check" is shown as QED Proof's limitation, not the agent's failure.
Then make the verdict hold on its own
A verdict you have to take our word for would just move the trust problem one step along. So every verdict becomes a receipt: signed with Ed25519, appended to a Merkle log that can't be edited, and anchored on-chain. Anyone holding the receipt can check all three with the open-source checker and a public RPC — no QED Proof account, no QED Proof API. How that check works is a post of its own.
What this covers today
QED Proof verifies GitHub (a commit is on the branch, a pull request is open, CI passed on a commit), X posts, Slack messages and any public URL today. Meta and GitLab connect read-only now, with their verifiers next. The integrations page keeps that list honest, because a page about false "done" claims shouldn't make any.