bootproof v0.4.0 Apache-2.0 deterministic · no AI verdicts
Your AI agent says it's done. Make it prove it.
Agent-written code compiles, passes the tests it wrote for itself, and dies on boot. bootproof is the run button that can't lie: it boots the repo under supervision, observes real HTTP health, and signs an attestation of what actually happened. No observed proof, no green check.
$ npx bootproof up .
the first run is a read-only diagnosis — nothing executes without explicit consent. there's a test ↗
Exhibit A — the receipt itself
This one is real. Try to break it.
BOOTPROOF ATTESTATION
bootproof/result/v1 · signed content shown in full below
sig ed25519 · —
key · —
running Ed25519 verification in your browser…
The signature above was produced by actually signing the payload this page displays, and your browser is re-verifying it right now — WebCrypto Ed25519, no server involved. Change one byte and watch the stamp collapse. That collapse is the entire product: evidence that can't be quietly edited. When an agent — or a contractor, or you six months ago — claims "it works," this file is what the claim looks like when it has to survive scrutiny.
A local receipt proves the record is intact since signing — not that the signing machine was honest. That limit is printed on every real receipt, and the trust ladder (local → CI-OIDC → beyond) is the documented upgrade path, not a hidden asterisk. The engine's honesty contract ↗ holds 21 rules like this, each enforced by tests.
Standing bounty, severity zero: make bootproof print a green check it can't justify, and the bug gets fixed, publicly advised, and credited to you. Overclaiming is this project's worst defect class — including on this page.
Exhibit B — in your CI
Start advisory. Graduate to enforcement.
Two published actions, one adoption ramp. The reporter tells you the truth about every pull request with zero blast radius. When you trust it, the gate starts refusing merges that can't prove they run — which is exactly the check agent-written PRs currently walk straight past.
BootProof ADVISORY
Runs on every PR, posts an honest verdict comment, retains signed evidence as an artifact. Reports; never blocks.
- uses: actions/checkout@v4 - uses: bootproof/bootproof@main # pin to @v1 once tagged
Receipt Gate ENFORCEMENT
No merge without an observed boot and health signal. Fails closed. The signed receipt uploads with every run.
- uses: actions/checkout@v4 - uses: bootproof/receipt-gate@v1
A tool that's green on everything is lying about something.
Exhibit C — the gauntlet
Real repos. Signed outcomes. Replayable receipts.
Not a benchmark — a docket. Every entry below is backed by attestations you can re-verify yourself in docs/REAL_REPO_EVIDENCE.md ↗. The refusals are listed with the same pride as the boots: honest scope is the product.
Exhibit D — when it doesn't boot
Deterministic repair, with the safety on.
bootproof fix maps exact, classified failures to known repair actions — a registry of 20+ classified causes ↗ (the taxonomy has grown well past that; count them yourself). Deterministic repairs come first; AI suggestions are optional, bring-your-own-key, and only offered when no known fix exists.
Every mutating command shows its exact scope and risk and runs only when you type an uppercase Y. Repairs are previewed and tested in a sandbox, never on your working tree, and every outcome — declined, failed, progressed, verified — gets its own signed repair receipt. there's a test for the safety ↗
Exhibit E — the other direction
bootproof proves the code you wrote. repo-proofer checks the code you didn't.
That repo with the slick README and the confident install steps? Some of them quietly read your SSH keys and phone home the moment you npm install. Before you — or your agent — runs a stranger's repo, repo-proofer v0.6.1 MIT runs it in a sealed sandbox first and reports what it actually did, not what it claims.
$ uvx repo-proofer https://github.com/someone/that-repo
no install, no account. one verdict, in your terminal, in about a minute.
Clone
Fresh, shallow, into an isolated workspace. Nothing from your machine goes in.
Seal
Read-only filesystem, decoy credentials, syscall tracing on. Your real keys are not present to steal.
Execute
Dependencies install with the network on — recorded. The entrypoint then runs with it off — enforced.
Verdict
Green, red, or amber, computed from the trace. Deterministic: same repo, same verdict.
repo-proofer report — excerpt Network calls attempted 2 → 203.0.113.42:443, 198.51.100.7:80 Sensitive paths read ~/.ssh/id_ed25519 (flagged — decoy) Files written outside tmp 0 Entrypoint network access blocked — 0 packets left the sandbox Verdict ■ RED — exfiltration behavior observed
To be precise about the boundary, because it matters: the network stays on during dependency install — every connection attempted in that phase is recorded in the report. It is switched off before the repo's own entrypoint runs. Sensitive-path reads are flagged whenever they happen, in either phase. No model reads the code and guesses: the verdict is computed from observed syscalls, so the same repo produces the same verdict every time.
Exhibit F — for machines
Built to be read by the agents it supervises.
Every command speaks --json with a strict schema and a deterministic exit code, so an agent can consume verdicts without parsing prose. Point your agent's stop-hook at it and the agent hands you a signed verdict every time it claims "done":
# Claude Code · .claude/settings.json → hooks.Stop npx -y bootproof up . --json --timeout 60000 # booted:true, or the classified reason it isn't
Exhibit G — the plan, in plan language
Shipped things get a check. Unshipped things say “would.”
Committed receipts (.bootproof/ in your repo) already work — proof travels with the code. Exports are opt-in and redacted. No telemetry, ever. The long game is a commons: an atlas of how software actually breaks, built from receipts people chose to share.
dry runs execute nothing and say so — including this one.