Re-run it.
Check it yourself.
Every agent workflow ships with the inputs and the steps that produced it. Your own machine re-runs those steps offline and returns OK, REJECT, or ERROR. An ERROR never becomes an OK. Model output is never re-run. It gets a record of what went in and what came out.
The workflow ships with its inputs and steps. Your machine re-runs them offline: OK, REJECT, ERROR. Model output is never re-run.
From record to verdict.
What the agent actually didWhat the agent did
The agent leaves a folder behind: the inputs it used, the rules it ran under, every step it took.The inputs, the rules, every step taken.
Written as it runsAs it runsAnyone can re-run the checksAnyone re-runs it
Your machine re-runs every step against rules fixed before the agent ran. Nobody softens them now.Rules pinned before the agent ran.
Runs offlineThe verdict is one of threeThree verdicts
OK means the steps hold up. REJECT means they did not. ERROR means it could not run.OK holds. REJECT fails. ERROR could not run.
Never fakes an OKNo fake OKNo step is left uncheckedNo step skipped
Every step must be accounted for, or the run is an ERROR. Anything extra in the record is a REJECT.Missing step, ERROR. Extra file, REJECT.
Nothing slips throughWhy re-run at all.
A pre-registered Stanford RegLab study found that the two leading AI legal-research tools, both sold on the promise of grounded citations, still invented answers 17% to 33% of the time (Magesh et al., 2024). A wider sweep of 13 models found every one of them fabricated citations, at rates from 14% to 95% (GhostCite, arXiv preprint, 2026). Nothing here tries to detect a fabrication. The record re-derives from the inputs it declares, and a record that will not re-derive comes back REJECT.
A Stanford RegLab study found two leading AI legal tools invented answers 17% to 33% of the time. Nothing here detects a fabrication. A record that will not re-derive comes back REJECT.
The rule sits with the auditor. Never inside the thing being audited.
The rule sits with the auditor.
Most assurance ends with the producer shipping its own checker. The manifest says what to verify, the bundle carries the code that verifies it, and the system under audit gets to define what passing means.
The recompute code belongs to the verifier
The checker brings its own code.
A bundle can never carry the thing that checks it. The tool arrives from the side doing the checking.
The rule is pinned by the checker
The auditor pins what passes.
What counts as passing comes from the auditor’s own spec anchor, not from the producer’s manifest.
An error never becomes a pass
An error is never a pass.
If the check cannot run, that is not a green light. It is its own answer, and it is not yes.
An undeclared file is a rejection
An undeclared file is a rejection.
Something sitting on disk that the record never mentioned fails the check. It does not get a shrug.
Reperformance involves the independent execution of procedures or controls that were originally performed by company personnel.
What a check leaves behind.
One honest limit. A re-derivation proves an answer was not changed and can be rebuilt from the inputs it declares. It does not prove the call was right. The C2PA specification draws the same line. It validates that an assertion is well-formed, bound to the asset and untampered, and declines to judge whether the assertion is true.
One honest limit. The check shows the answer rebuilds from its declared inputs, not that the call was right. C2PA draws the same line.
See it run live →See it run →Strike a proof and watch it hold.Strike a proof.
The demo re-derives a real SHA-256 receipt in your browser, then voids it the instant a single byte moves.
A real SHA-256 receipt, voided by one changed byte.