habitatAI provenance · agent traces
Did the agent’s own actions leak into its record of what happened?
You ship agentic systems. A trace interleaves collected observations — tool results — and the model’s own generated turns. The unspoken fear: the agent’s generated actions get recorded and later treated as collected fact. The system trusting its own output as the world.
Value Given a declared observed-vs-generated boundary in an agent's own record, the receipt detects movement across that boundary and reproduces byte-identically.
Boundary Detection, not adjudication.
the pain
It is silent and it compounds. A generated action is written into the record; a later step reads it back as an observation; the agent builds on its own invention as if it were something it saw. Nothing errors. The trace looks complete. There is no line in it that says “this part was observed, that part was authored.”
the exhibit — recompute it yourself
corpus: trace-commons/agent-traces (Hugging Face, CC-BY, 2026-06) · 28 donated coding-agent session traces · certified field = 4,262 observed (eligible) events; 7,499 model-generated events withheld; 11,761 events total · protected geometry: n_tool_use, the count of tool_use blocks, constant on the eligible pool. Register: detection — byte-decidable. Any leak changes the digest; no floor, no null and no ranking is needed to see it.
The trace changed — its order changed. The certified geometry did not move, to the byte.
That magnitude is set by the ridge, not measured. See the sweep →
This red is a deliberate leak we inject as a brake test — proof the instrument rings on exactly this boundary, not an incident that happened.
A noise floor, not a materiality threshold. Below 1e‑06 a digest difference is floating‑point, not movement. It answers whether anything happened, never whether it matters — and nothing published here has come near it.
recompute fingerprint — the digit the kit’s verify step reproduces from the artifact, byte-for-byte on any engine that follows the kit’s published canonicalization · sha256 =
67a6f95ee308a2884f73e071ed72bfb0326ba1b7d6da08a147e6ef10394009aa
The GREEN before/after and the RED
“before” above are this same clean fingerprint; the RED “after” is the identical recompute
with the withheld generated turns leaked in.
You recompute the geometry, the byte-identical benign baseline, and the declared tamper yourself — no trust asked. That those vectors are drawn only from the named reference is attested by the certificate; here the reference is public, and it has been checked at the source.
what this does not prove
The certificate attests that the observation/generation boundary held within a declared frame. It does not say the agent is correct, or that its observations are true. It detects a boundary violation; it is not a correctness guarantee. A clean certificate means the machine didn’t confuse its own voice for the world — not that the world it saw was right.
verify this receipt in your browser
This case's receipt records its verdict and both digests above, and carries its own SHA-256. Recompute it here (WebCrypto, in your tab, nothing sent) and it matches; alter one character of a copy and it fails. It is the smallest version of the whole move: recompute, don't trust. The geometry digest itself you can recompute in this tab, on the method page, or on your bench from the kit.
published fingerprint ·
or download this receipt and check it on your bench:
receipt-agent-trace.json.
shasum -a 256 prints the same number. Every receipt is on
the ledger.
request the kit
The recompute kit for this case — artifact, manifest, verify.py. A person sends it: the kit and its
verification steps arrive by reply, usually within a business day.