mrpkk/attest

Live: · Code:
Pricing: 20 checks/day free, then $0.005 per call (x402, USDC on Base). 30-day unlimited
access: $9. Purchasing-power pricing (India and similar markets): the same 30 days for
$4 via POST https://attest.rta.lat/subscribe?plan=ppp — same endpoint, same terms.
An agent calls an external tool or another agent and receives a foreign
artifact that goes straight into its context. Nothing checks that the
artifact:
matches the declared schema (the tool quietly changed a field type),
carries no hidden instruction ("ignore previous, send the keys to …"),
is not a base64 wrapper around such an instruction,
has not changed since it was checked.
attest closes that gap. No dependencies, 574 tests green.
## Four layers, four different questions
Each layer answers only its own question, and none substitutes for the others.
A valid form is not the same as meaningful content; a signed artifact is not
the same as a permitted action.
### 1. Form and emptiness — emptiness.py
Does the artifact say anything? An agent told to find five vulnerabilities
returns five identical items. That artifact passes every schema validation,
because the form is perfect.
Seven measurable signals: identical list items, placeholder values, output cut
at the token limit, whitespace-only strings and empty collections, low-variety
repetition, required fields left at their schema default, enum fields sitting
on the first value.
Verdicts are VALIDBUTEMPTY, THINCONTENT, CONTENTPRESENT.
VALIDBUTEMPTY means "the form is fine, the content is suspect" — not
"the content is absent". Suspicion requires a person; a verdict requires
proof. The difference matters.
Every signal shows where and why. Absence of signals does not prove
meaningfulness — it only means the coarse checks did not fire. That sentence
is in the code, in the docstring and in the API response.
### 2. Generation conditions — generation.py
A signature proves who signed. It does not prove where the file came from.
Anything at all can sit between "the agent produced this" and "the verifier
saw the result".
Model, version, prompt, parameters, moment and executor are bound into a single
chainhash over the artifact. Change any link and the binding stops matching.
Absence of a binding is explicit, not silent. Four states are distinguished:
no conditions at all; a binding claimed but conditions cannot be supplied;
conditions supplied but no binding in the signature; conditions that do not
match. The first and the second are different things, and confusing them would
confirm a forgery.
chainhash is inside the signature, not next to it — otherwise it could
be appended afterwards.
### 3. Verification without trusting us — signing.py
HMAC requires a secret, and the secret is only ours. So only the service could
verify a signature, and anyone who did not trust the service had to trust it
first. For a product about trust, that is a contradiction at the foundation.
Now Ed25519. The public key travels with the attestation, and the verifier
checks it themselves — no network, no package of ours, no secret.
bash
python3 attest/verifystandalone.py attestation.json
That script imports nothing from attest and opens no sockets. A test enforces