dengyier/OpenWorkProof

What it solves

When an AI agent says it finished a task, there is usually no way to independently prove who authorized the work, what exactly the agent did, whether it stayed within the agreed limits, and who ultimately accepted or rejected the result. Logs only show what the system output, not the chain of authorization, execution, and acceptance. OpenWorkProof solves this by turning each agent task into a portable, signed evidence package that any third party can verify offline without access to the original system.

How it works

OpenWorkProof is an open protocol layer that can be embedded into existing agents, CI pipelines, MCP servers, and multi-agent orchestrators. It chains six types of facts: the work order (what was asked), signed authorization (who allowed it), pre-action policy decisions (allowed or denied), action receipts (what the agent actually did), independent verification (whether evidence supports the conclusion), and human acceptance (who finally accepts or rejects).

The core objects are WorkOrder, CapabilityGrant, PolicyDecision, ActionReceipt, VerificationDecision, and AcceptanceDecision. Each step is cryptographically signed using Ed25519, and the ledger is append-only with content digests. Any modification to the order, authorization, receipts, evidence, or public keys causes offline replay to fail and closes the workflow.

A key design point is that verification and acceptance are strictly separated. A Verifier signs a verification decision, but only a designated Acceptor can sign a separate AcceptanceDecisionBinding to accept or reject the delivery. This prevents a system from claiming that a passed verification equals customer agreement. The protocol also enforces the principle that humans retain control: a Human Agency Profile defines which of the granted capabilities the human actually allows the agent to use autonomously. Reserved actions return an error before execution, requesting human decision.

Who it's for

OpenWorkProof is for teams that build or deploy AI agents and need a trustworthy record of what those agents did and why. It is also for organizations that want to hand over agent work to external customers or regulators and let them independently verify the whole chain of authorization, execution, validation, and acceptance without relying on the platform's own database. It is suitable for anyone using MCP, GitHub Actions, CLI tools, or a Python API who wants to add verifiable accountability to agent workflows.

Highlights

• Provides a complete chain of signed evidence for every agent action, from authorization to acceptance.
• Uses Ed25519 signatures and an append-only ledger so any change breaks offline replay and closes the workflow.
• Separates verification from acceptance with a double-signature mechanism, preventing false claims of final acceptance.
• Includes a Human Agency Profile so humans can pre-define what the agent may do autonomously, with reserved actions blocked before execution.
• Offers multiple integration paths: GitHub Action, CLI, MCP server, AgentTeams orchestration, a DeepSeek Harness plugin (local candidate), and a Python API.
• Supports offline verification of Surface and Acceptance bundles, allowing third parties to audit with just the evidence package and public keys.