Layer 02 · While it works · logbook

What did it
actually do?

An agent reads files, runs commands, edits code, makes claims. Today that history evaporates — you get a diff and a chat log, and whoever holds them can edit them. Logbook records the run as an ordered, hash-chained, Ed25519-signed document and ships a verifier a third party runs themselves, offline, with no account and no API call.

The record is written by the harness running the agent, not by the agent. That is the point: something that could lie about its own history never gets to choose what goes into the record.

Interlocking brass seal links laid across the gutter of a leather-bound ledger.

In detail

How it
works.

Formatagent-work/record@0 — owned by the agent-work repo; logbook extends it additively and never forks it
ChainEach step hashes its own contents and names the previous hash. Alter one step and verification fails at exactly that step
SignatureEd25519 over canonical JSON (RFC 8785), domain-tagged so a record can never verify as some other product’s artifact
ContentsDigests by default, bodies by opt-in — so a record can cross a trust boundary without leaking your data or IP
VerifyExit 0 = chain and signature hold. No network, no dependencies
Check one yourself, right now.

The homepage runs a real verifier in your browser — it rebuilds the chain and tests the Ed25519 signature with WebCrypto, in your tab, with no request to us. Press tamper and it refuses, naming the step that changed. Go and break one.

Straight answers

What this
does not prove.

Stated here, at full size, rather than in a footnote. Every tool in the stack carries its own ceiling, and they are not the same ceiling.

Changes show up not unchangeable

Anyone can edit the file. What they cannot do is edit it without the edit becoming obvious to the next person who checks it.

Signed by that key not a trustworthy run

A valid signature means the record is unchanged since sealing and was signed by that key. Whether the key’s holder is honest, and whether the agent’s work was any good, are different questions entirely.

Complete as captured not all-seeing

The agent cannot quietly drop a step, because it is not the one writing them down. But nothing can record what the harness never saw.

Run it

Free,
and local.

build itnpm install && npm run build
a development key — never for productionnode bin/logbook-keygen.mjs dev
exit 0 = chain and signature holdnode bin/logbook-verify.mjs record.json

Everything above runs on your machine with no account and no network call. Checking an artifact is free permanently — see what we actually charge for.

Previous in the stackWhat was it allowed to do? Next in the stackIs the result actually true?

The agent will act either way.

The only question is whether anything survives it that a stranger can check.

Check a record See all four