The cryptographic
evidence layer for AI
Verdict seals each AI agent step routed through it into a single record anchored in Sigstore Rekor, and renders that record for the regulator, auditor or insurance underwriter who has to check it.
Three boundaries.
Closed by construction.
Every byte that moves through Verdict crosses exactly three boundaries. Each absorbs one source of complexity. Everything between them is deterministic.
One call per step → one Evidence Event
What ships today is an MCP connector. Your agent, or the system running it, calls verdict_create_evidence_record at each step that matters. Remote: https://verdict.systems/api/mcp. Local: npx -y @verdict-systems/mcp.
Each call carries what happened: input and output summaries or their hashes, the model provider, the source system, the event time, and the human review status.
A step that never reaches the connector is not in any record, and a single record cannot show that nothing was left out. Framework wrappers and a trace collector are not shipped.
SHA-256 · Record commitment · Sigstore Rekor
Each Evidence Event is content-addressed with SHA-256. Each Sealed Evidence Record is bound by a domain-separated record commitment, a SHA-256 hash over that one record. The wire format names this field merkle_root; it is not a Merkle tree root. The commitment is signed and anchored in Sigstore Rekor, an append-only public transparency log operated by the Linux Foundation. Batch inclusion proofs are planned for SER v0.2.
On the public sandbox the anchor is signed with an ephemeral ECDSA P-256 key generated per request; a hardware-backed Ed25519 production tier is planned. A record can link to the one before it through a prior_root reference — remove a record from the middle of a linked chain and the next link stops matching. A step that was never sealed leaves no gap to find.
Forgery requires breaking SHA-256 and compromising Rekor simultaneously. The moment that becomes feasible is the same moment HTTPS stops working.
The honest boundary: Verdict proves integrity and provenance — that a record existed at a specific time and has not been altered since. It does not prove the factual truth of unverified input, or that the system supplying it was uncompromised. That boundary is what lets the proof survive adversarial review.
One record. Every audience. Zero rework.
Each SER renders deterministically into the artifacts each downstream audience requires:
- SOC 2 Type II — auditor package with control evidence per CC trust services criteria
- EU AI Act Article 12 — logs of automated decision-making for high-risk AI systems
- HIPAA — BAA-conformant audit log with field-level PHI redaction
- FRE 902(13)/(14) — designed to support certification as a self-authenticating record in U.S. federal court
- Armilla / Testudo / Munich Re aiSure — insurer-specific underwriting and claim-attestation submissions
Renderers are versioned alongside the SER spec. Adding a new audience is a pull request, not a re-architecture.
Six terminal outcomes.
No ambiguous states.
Every agent run terminates in exactly one of six states. The taxonomy is exhaustive and mutually exclusive. The seal engine refuses to seal a record with an ambiguous terminal — this is what makes the Evidentiary Completeness Score computable.
Agent reached its goal and produced an output.
Policy gate blocked. Refusal event sealed with reason.
Routed to a human for approval.
Tool error or model error terminated execution.
Wall-clock or budget bound exceeded.
Authorization withdrawn mid-flight.
One command.
First SER in Rekor in under a minute.
# Claude Code: add the Verdict connector (public sandbox)
claude mcp add --transport http verdict https://verdict.systems/api/mcp
# Ask your agent to seal a step. It calls:
# verdict_create_evidence_record
# Back: the sealed record and its Rekor log index.
# Each call writes a permanent fingerprint to the public
# Sigstore Rekor log, so use test data in the sandbox.
The 15-slide thesis. Three forces. One window. Right now.
Origin, mission, market, moat, model. The full reasoning.
