Five steps, from the moment an agent says it's done to a receipt no one can quietly change.
The claim names an action, a target and a deadline. The agent sends it the moment it thinks it's done.
POST /v1/claims
{ "agent_id": "release-bot",
"action": "github.commit.push",
"target": "Nuraveda-Labs/qed-proof",
"params": { "branch": "main", "sha": "a1b2c3…" } }After the deadline, a verifier reads GitHub or the web directly, with read-only access. An error, a timeout or a missing permission gives Couldn't check, never Verified.
The verdict and the evidence it rests on go into a receipt, canonicalised and signed with Ed25519. QED Proof stores fingerprints, not your content.
Receipts are leaves in an RFC 6962 Merkle log. Each receipt carries a proof that it's in the log. Removing or editing one would break every later root.
Every ten minutes, when there are new receipts, QED Proof records the log's root on Base Sepolia (testnet) as an EAS attestation; mainnet is next. After that, not even QED Proof can backdate a receipt.