Your agent ran twice. Which step caused it?

Two 47-step runs, side by side, is a spot-the-difference puzzle. behalf records every action an agent takes and shows you the first divergence — not the noise.

the diff

$ behalf diff run_9f2a.jsonl run_c71e.jsonl
first divergence — step 12  orders.search
  run_9f2a: ord_5512  $12.00
  run_c71e: ord_5518  $1,200.00

47 actions. 41 differed. 1 mattered.

Every action is a receipt. Try covering one up.

Each action an agent takes across a trust boundary — a tool call, a delegation, an approval — becomes a signed, hash-chained action receipt in an append-only log. Edit one and everything after it stops verifying:

the cover-up

$ sed -i 's/1200.00/12.00/' run_c71e.jsonl
$ behalf verify run_c71e.jsonl
✘ content tampering at receipt 31
  chain breaks at 31; receipts 32–46 unverifiable
class=content index=31

Verification is offline — no network, no call to us. Hand the export file and the verifier to anyone and they can check it themselves.

How it works

Capture

A proxy sits on the trust boundary and records the request that was actually forwarded — not what the agent says it did.

Receipt

Each action is signed at the edge (DSSE, Ed25519) and hash-chained. The stored bytes are the signed bytes are the hashed bytes — there is no canonicalization step to argue about.

Verify

A small offline verifier checks the whole export and exits 0, 1, or 2 — stable codes you can gate CI on. Reconstruction of what happened, verifiable by a third party.

Verified, asserted, broken

A receipt is verified when its signature and chain position check out against the keys in the export. History imported from other tools, and any hop we could not verify at write time, is marked asserted — recorded honestly as a claim, not evidence. A chain that fails is broken, and everything after the break is reported unverifiable.

The output never lets a green tick imply more than the cryptography delivers. What we explicitly do not claim — and the adversaries we do and do not defend against — is written down in the threat model.

Where it stands

done Receipt schema v1 — frozen, published
done Export format v1, writer, and an offline verifier
done The tamper suite above runs in CI on every commit
in progress The behalf CLI and log service
planned Open source at launch (Apache-2.0)

Want to know when it's usable?