Traceseal launches signed receipts for AI agent accountability

Traceseal is an open accountability platform designed to provide cryptographically verifiable proof of AI agent execution. At its core, the system generates signed receipts for every agent invocation—self-contained JSON documents that capture the skill identity, content-addressed manifest, input and output hashes, sandbox configuration, and signatures from both the publisher and operator.

The verification model is built around three distinct roles. First, the publisher signs the skill (agent code) bundle with an ed25519 key, covering every source file via a content-addressed manifest recorded in the transparency log. Second, the operator runs the signed skill inside a bwrap kernel-namespace sandbox (configured with read-only root and no network access), records inputs, outputs, timing, and sandbox settings as hashes, and signs the resulting record with their own ed25519 key. Third, any third party can independently verify the entire receipt by installing traceseal-verify (available on PyPI) and running a single command with only the receipt.json file—no operator connection or trust assumptions required. The verifier checks the operator's signature over the canonical JSON and exits with code 0 (valid) or 1 (invalid).

The platform includes a public transparency log at log.traceseal.io where published skill manifests and receipt chains are recorded. This allows any observer to re-verify the entire execution history with a single command, and receipts chain together so that any modification breaks the cryptographic seal. The open-source toolkit ships with multiple components: traceseal-verify (the independent verifier), traceseal-observe (runtime attestation and receipt signing), traceseal-langchain (a drop-in integration for LangChain-based agents), and alibi (an open-source trust harness for reproducible behavioral probes that emit witness-cosigned receipts).

The timing of this launch aligns with regulatory momentum: the EU AI Act's Article 50 transparency obligations take effect on 2 August 2026, requiring organizations to demonstrate what their AI systems have actually done rather than merely document or assert their behavior. Traceseal converts that compliance obligation from a documentation exercise into a cryptographically verifiable proof. Because the verifier, receipt spec, and transparency log are all public, any third party—regulators, auditors, or end users—can independently hold an agent to account without requiring access to the operator's machine, keys, or audit infrastructure.