AI agents should not make irreversible changes. TraceFold escrows the inverse before an effect lands — or refuses the effect — and issues receipts anyone can verify offline.
Not an observability tool. It sits before the effect.
See the Scope Exclusions table below and docs/LIMITS.md for what this does not cover.
┌────────────────────────────────────────────────────────────────────────────┐
│ 🔴 🟡 🟢 tracefold-demo-session — 10s Verification Probe │
├────────────────────────────────────────────────────────────────────────────┤
Three files on that terminal: a receipt, a signed checkpoint, a public key. No account, no network call.
- Valid receipt: verifies instantly and exits
0. - Flip exactly one byte:
cmp -lconfirms the 1-byte diff, and the exact same command exits7.
▶ View Asciinema Cast (Raw Timings) · Read Offline Verification Mechanics
Reproduction: examples/demo_one_screen.sh runs the longer, 8-stage version of the same idea end to end — commit → receipt → tamper → verify → undo → redo — against a real cloned repository, not a fixture.
|
Open tracefold.github.io/tracefold/verify.html Paste a receipt and key. Runs 100% via in-tab WebAssembly (network requests strictly 0). |
|
import { readFileSync } from "node:fs";
import { verifyReceiptOffline } from "@mahirhir/tracefold";
const key = JSON.parse(readFileSync("key.pub.json", "utf8"));
const result = verifyReceiptOffline(
readFileSync("commit_receipt.json", "utf8"), key.key_id, key.public_key,
readFileSync("checkpoint.json", "utf8"), key.key_id, key.public_key
);
console.log(result.valid, result.checks.inclusion); // true "verified"| Dimension | Traditional Post-Hoc Audit Logs | TraceFold Pre-Fact Provenance |
|---|---|---|
| Execution Order | Action executes first $ | |
| ightarrow$ Logged afterwards | Inverse constructed & checked $ | |
| ightarrow$ Action lands | ||
| Irreversible Damage | Discovered only after system corruption | Blocked at the gate; escalates to human approval |
| Verification Trust | Must trust the host/server that produced the log | Zero-trust offline verification via standalone WASM |
| Verdict Precision | Binary (Pass/Fail) conflates errors with attacks | Tri-state: Verified, Refuted, Unknown/Unparseable |
[ 01. AI Agent Action ]
│
▼
[ 02. Deterministic Gate ] ──(Cannot build inverse S⁻¹)──► [ 🔴 Halt & Escalate to Human ]
│
(Inverse S⁻¹ sealed)
│
▼
[ 03. Action Lands & Receipt Issued ]
│
▼
[ 04. Offline WASM Verifier ] ──► Exit 0 (Verified) / Exit 7 (Refuted)
TraceFold implements the Deterministic Approval Gate (Layer 3: Mechanical Laws) and the Receipt & Escrow Substrate (Layer 8: Provenance & Receipt) within the broader Glovrex Digital World computing architecture (Paper DOI: 10.5281/zenodo.22168558).
| Dimension | Measured Value | Conditions & Scope |
|---|---|---|
| Test Floor | 2,602 probes | 454 suites + SDK 36 passed · fresh clone · 25 Aug 2026 |
| Lean Formal Proofs | 154 theorems | Lean 4, 14 files: 154 theorems, 14 of them counterexamples, 1 axiom, sorry 0, recounted 1 Sep 2026 with the attribute-aware predicate (SS1001-consistent; see docs/LIMITS.md item 8) |
| Open High Holes | 0 | Out of 44 adversarial audit rounds, same 25 Aug 2026 table/commit as above (not independently re-dated by this pass) |
| Unmeasured Platforms | 3 environments | Windows native, OneDrive, SMB |
Deliberately absent: no CI/build badge on this page, and the honest reason is worse than not
having one. GitHub Actions has run zero jobs on any push since the account went billing-blocked at
2026-08-15T17:25:29Z (req/908) — not because of a code defect, but a green tick here would not
mean what a green tick usually means while that stays true. The last time CI ran (commit
f65aac2f), it covered 16 of this project's 17 workspace crates automatically; the TypeScript
SDK's tests have never run under CI at all. See docs/LIMITS.md item 8 for the
full, dated detail (checked current as of 2026-09-01).
| Out of Scope | Why it cannot be closed from inside |
|---|---|
| Root or kernel-privileged writes | Bypasses the tool entirely at the operating system level |
| Writes into tool's own state dir | A detector living in that directory cannot judge itself |
| Policies encoding the wrong intent | Enforced faithfully; intent correctness is external |
▶ Expand Environment, Verification & Technical Specifications
- Formal Technical Report: Complete mathematical proof and receipt encoding: docs/TRACEFOLD_TR.md.
- Foundational Paper: A Mechanical World Model for Agents (DOI: 10.5281/zenodo.22168558).
- Formal Verification Spec: Machine-checked Lean 4 theorem suite: lean/README.md.
- Exclusion Taxonomy: Test-enforced scope boundaries and limits: docs/LIMITS.md.
- Adapter Guide: What it takes to connect a new substrate to the escrow gate, measured cost, and what conformance requires: docs/ADAPTER_GUIDE.md.
- Error Classification: Error taxonomy and exit code specifications: docs/ERROR_TAXONOMY.md.
- Recoverability Mechanics: Reversible execution state definitions: docs/RECOVERABILITY.md.
- Development Tree Tests: Full-spectrum test probe taxonomy: docs/DEVELOPMENT_TREE_TESTS.md.
- The undo has to exist before the write does — 30 Aug 2026
- What "undo" actually means when the target is a real repo, not a fixture — 30 Aug 2026
- I ran 10,373 mutations through a reversibility gate. Tamper detection caught 600 of 600. — 31 Aug 2026
Everything shipped here is free — verification, receipts, self-hosting — and stays free for as long as a single person uses it. Nothing is for sale, and paying changes nothing about what you get.
If you want to fund the work anyway, there is exactly one channel:
Support TraceFold — pay what you want, via Stripe
Changed from Polar to Stripe on 1 Sep 2026 (the Polar checkout account's onboarding was not finishing). Nothing is promised in return either way.