Your AI acted.
Prove what it did.
An agent read your files, ran your commands, changed your code. All you have afterwards is a diff and a chat log — and anyone holding those can edit them. Rotairo checks the agent's work at four points and turns each one into a file that carries its own proof, then gives away the tool that re-checks it.
The problem
A log is a story.
Evidence is a check.
Every tool watching your agents stores what happened in its own database and asks you to believe it. That works right up until somebody with a reason to doubt you — an auditor, a regulator, an insurer, opposing counsel — asks how they would know.
Rotairo's answer is not a better dashboard. It is an artifact you can hand that person, which they check themselves, on their own machine, with a tool they did not get from us.
The four checks
Four questions,
in the order
they get asked.
Nobody asks these all at once. They arrive in sequence — before you let the agent run, while it runs, after it finishes, and again months later when someone wants the paperwork. Each has its own tool, and each tool writes down its own limits.
01 · BEFOREportcullis
What was it allowed to do?
Reads the plugins, skills and instructions your agent will obey — as text, never running them — and flags what can read secrets, open sockets, delete files, or quietly override its orders.
Gives you a receipt that the review ran. Never a statement that the package is safe.
Scan the instruction layer →
02 · DURINGlogbook
What did it actually do?
Writes every step of the run into one sealed file, each step locked to the one before it. Alter any part of it afterwards and the check fails — at exactly the step that changed.
Shows the record is unchanged since sealing. Not that the recorder told the truth while writing it.
See a sealed run →
03 · AFTERtouchstone
Is the result actually true?
Takes a claim the agent made — the tests pass, the guard strips uncited figures — and tries to break it. The verdict is computed from checks that really ran, never from the model's say-so.
A verdict from captured evidence. Not a human attestation, and never a certification.
Break a claim →
04 · LATERbinder
Will an auditor accept it?
Reads what the first three produced, maps it onto your control framework, and states per control exactly what exists and what is missing — every line cited by file, digest and field.
Evidence you assembled yourself. Not an audit opinion, and it binds no insurance.
Assemble a pack →
THE FOUNDATIONagent-work · fleet-attestation
One record shape. One way of signing it.
All four write the same open format and sign it the same way, with no runtime dependencies beyond what ships with Node. That is why the artifacts stack instead of needing a platform to hold them — and why a competitor could implement the format tomorrow. Clocks are passed in, never read: the same inputs produce the same bytes and the same signature, forever.
Proof, not a promise
Check one now.
Nothing leaves this page.
Below is a real sealed record from layer 02. Press check, and your own browser does the maths — it rebuilds every link in the chain and tests the signature. No upload. No account. No request to us at all.
Then press tamper. One word changes, and it refuses. Every layer in the stack hands you something you can interrogate exactly like this.
Press “Check it”. Everything happens in this tab.
The artifact
Something you can
hand to someone.
Not a login to our dashboard. Not an export from our database. A file, holding its own proof, which keeps working after we are gone.
“Show me what the agent actually did.” If the honest answer is a chat log, you do not have an answer.
THE QUESTION AN AUDITOR ASKS FIRSTSince 2 August 2026, EU law requires automatic logs of what automated systems do. Exposure runs to €15M, or 3% of worldwide turnover.
EU AI ACT, ARTICLES 12 / 19 / 26Before the price
What this
does not prove.
Six words are banned in our code and checked on every commit: tamper-proof, unforgeable, guaranteed, immutable, forge-proof, authentic run. If your job is to find the overclaim, here it is first, at full size, above the money.
Anyone can edit the file. What they cannot do is edit it without the edit becoming obvious to the next person who checks.
We prove which key sealed it. Whether the key's owner is honest, and whether the work was any good, are different questions.
A scan reports the patterns its rules match, with the file and line. Nothing matching is not the same as nothing there.
The agent cannot quietly drop a step, because it is not the one writing them down. But nothing can record what the harness never saw.
Who needs this
Three rules,
one requirement.
Each of these already asks the same thing in different words: show a durable record of what the machine did, that someone outside your company can review.
EU AI Act
Automatic event logs, kept at least six months, for systems that act on their own.
SEC 17a-4 · FINRA 4511
Records preserved so they cannot be rewritten or erased. FINRA's 2026 report names generative AI a recordkeeping risk outright.
Auditors and insurers
SOC 2 auditors now ask how automated actions are evidenced. Carriers are writing AI exclusions and asking for the logs in writing.
Pricing
Checking is free.
Always will be.
Every tool in the stack is free to run and free to verify. We charge for the infrastructure around the artifacts — storing them, timestamping them, issuing identities, and standing in front of your auditor. Never for the act of checking one.
Permanently. Not a trial.
- All four tools, run locally
- The offline checker, no dependencies
- The open record format
- Development keys and test files
Self-serve. No sales call.
- Hosted timestamping and public log
- Retention with a stated posture
- Real identity issuance (OIDC)
- Dashboards and record search
Design partners wanted now.
- EU AI Act evidence packs
- 17a-4 / 4511 retention mapping
- Auditor-facing exports and liaison
- SSO, SLAs, named support
Checking a record never costs money. The moment verification sits behind a subscription, “you do not have to trust the issuer” becomes something you buy from the issuer — and the only thing that made this worth having is gone.
Where to start
Two ways in.
The stack is the same either way. What differs is which question you are being asked, and by whom.
For the regulated enterprise
You have an obligation with a date on it and an auditor who will not accept a screenshot.
- Start at layer 04 — the control mapping
- Work backwards to find what evidence you already have
- Bring your own framework file; ours is illustrative
- Design-partner slots are open now
For the builder
You are shipping agents and want the run to leave something behind that survives the argument.
- Start at layer 02 — wrap the calls you already make
- Everything runs locally with no account
- The format is open; implement it yourself if you prefer
- Read the limits before you rely on any of it
The agent will act either way.
The only question is whether anything survives it that a stranger can check.