Why a receipt, not a screenshot

When an agent loses your money, you get a P&L number and a vibe. The market moved, the model is nondeterministic, and the prompt may have changed. There is no way to reconstruct what it saw or why it acted, which is exactly why nobody hands one real size.

Agent OS already solves the authority problem: isolated sub-accounts, no withdrawal scope, human confirmation on every action. It doesn't solve the evidence problem. That's the gap 0xWitness fills.

Verify it yourself
npm run keys # generate the signing keypair
npm run fixture # deterministic market data, fixed seed
npm run run -- --offline # one decision cycle, produces receipt #0
npm run verify # hashes, signatures, chain
npm run replay -- --offline # re-derive the decision from the receipt
npm run tamper -- --seq 0 # edit one close price inside a sealed receipt
npm run verify # hash no longer matches
npm run replay -- --seq 0 --offline # decision visibly changes

Replay prints identical. Tamper with one sealed receipt, and both verify and replay catch it, without trusting us.

Inside a receipt
snapshot
Every kline, funding rate, and book level the agent saw, frozen. Replay never re-fetches.
snapshotHash
Detects edits to the market data.
decision.prompt + promptHash
The literal prompt, built purely from the snapshot: no clock, no ambient state.
decision.rawOutput
What the model actually said, before parsing.
policy.checks
Each deterministic charter check, with its arithmetic shown.
outcome
Submitted or blocked, and why. Blocked proposals are recorded too: a log of only the trades you took is a highlight reel, not an audit trail.
prev + hash + sig
Hash chain plus ed25519 signature. Nothing can be edited, deleted, reordered, or forged.
Architecture

The agent reaches the world only through a transport layer. Live and replay differ by one swap, so reproduction is exact, not approximate. The policy engine deciding whether a trade goes through is deliberately not an LLM: charter limits for notional, leverage, symbol scope, position concentration, and losing streak are arithmetic, so they replay identically forever and can't be argued out of by a persuasive prompt.

Transport (live or fixture)
Snapshot
Prompt
Model
Policy engine
Receipt
Hash → sign → append
Max notional
$200
Max leverage
3×
Allowed symbols
BTC · ETH · SOL
Max position
25% of equity
Max open positions
3
Losing streak
blocks after 2
What this doesn't claim
Not bit-determinism from hosted LLMs
They batch nondeterministically, so temperature 0 isn't a guarantee. What's actually guaranteed: the inputs are reconstructed exactly, and any output divergence gets surfaced instead of hidden.
Not a claim that the agent predicts markets
The bundled strategy is a plain momentum rule, nothing more. The contribution here is the evidence layer, not the alpha.
Not a tamper-proof log
It's tamper-evident. Someone holding the private key could still rewrite history wholesale. Anchoring the chain head periodically would close that gap.
Not custody of any kind
Agent OS gives agents no withdrawal scope. Neither does this.
Not financial advice, and not a way around Agent OS's confirmation step
--submit still surfaces the order for approval in your own client. This code cannot execute anything by itself.
← Back to site