Four hops. Every hop accounted for.
Latency budgets are measured across the last 30 days of production runs. Verification overhead is billed to RIG, not to you.
Sealed is a state, not a slogan. A packet only exists when the verifier passed and the chain accepted the hash.
Every field, in writing.
This is the complete schema. If a field isn't here, it isn't in the packet.
| Field | Type | Description |
|---|---|---|
| proof_id | string | Unique packet identifier, pkt_-prefixed. Addressable via the proof API. |
| agent | string | Name of the agent that produced the run, e.g. prior. |
| agent_version | semver | Exact agent version sealed, e.g. 2.4.1. A version bump never reuses a packet. |
| runtime | string | Runtime fingerprint of the builder environment (image digest). |
| job_id | string | Caller-supplied job correlation id. Yours, not ours. |
| builder_run | object | Builder attempt record: started/finished timestamps, model id, token counts. |
| verifier_runs[] | array | One entry per refute attempt (max 3): verdict, evidence refs, latency. |
| verifier_status | enum | PASSED · REFUTED · EXHAUSTED (3 failed attempts). Only PASSED seals. |
| input_hash | sha256 | Hash of the frozen input, captured before the builder ran. |
| output_hash | sha256 | Hash of the exact artifact the verifier passed. |
| prev_hash | sha256 | this_hash of the previous packet in the ledger. The chain link. |
| this_hash | sha256 | Hash over prev_hash + input_hash + output_hash + sealed_at. Locally recomputable. |
| sealed_at | RFC 3339 | Seal timestamp, UTC. Part of the hashed payload. |
| sealed_by | string | Identity of the govern node that signed, e.g. govern-us-east-1/04. |
| signature | ed25519 | Signature over this_hash. Verify offline with the published govern pubkey. |
{
"proof_id": "pkt_9f31aa2",
"agent": "prior",
"agent_version": "2.4.1",
"runtime": "sha256:8bd04e1",
"job_id": "acme-q3-forecast-0117",
"builder_run": { "model": "claude-sonnet-4-6", "started": "2026-08-04T17:02:11Z", "finished": "2026-08-04T17:02:19Z", "tokens": 41280 },
"verifier_runs": [
{ "attempt": 1, "verdict": "REFUTED", "evidence": "brier-missing", "latency_ms": 388 },
{ "attempt": 2, "verdict": "PASSED", "evidence": "all-checks-green", "latency_ms": 331 }
],
"verifier_status": "PASSED",
"input_hash": "c41dd90",
"output_hash": "77be1a4",
"prev_hash": "5e02c8f",
"this_hash": "a3f9c21",
"sealed_at": "2026-08-04T17:02:20Z",
"sealed_by": "govern-us-east-1/04",
"signature": "ed25519:6f2…c9"
}
curl -s https://api.rig.run/v1/proof/pkt_9f31aa2 \
-H "Authorization: Bearer $RIG_TOKEN"
const crypto = require('crypto'); const p = await (await fetch('https://api.rig.run/v1/proof/pkt_9f31aa2')).json(); const h = crypto.createHash('sha256').update(p.prev_hash + p.input_hash + p.output_hash + p.sealed_at).digest('hex').slice(0, 7); console.log(h === p.this_hash ? 'CHAIN OK' : 'DIVERGENT — do not trust');
What you can hold us to.
The left column is contractual. The right column is us telling you where the contract ends — before your security review finds it.
Guaranteed hold us to it
Structural, not conventional. Separate process, runtime image, memory space, and credential scope. The verifier cannot read the builder's context; the builder never sees the refutation strategy. Enforced by the orchestrator.
If a replayed run diverges from the sealed output, the packet is marked DIVERGENT, surfaced in the ledger, and alerted. It is never silently resealed. The original packet stays immutable either way.
No unrecoverable side effects mid-workflow. Any step that can touch the outside world requires a sealed checkpoint first; a failed run rolls back to the last sealed state, not to zero.
Alert fires when an agent's verifier pass-rate drops >3pp over a 7-day rolling window, or replay-divergence rate exceeds 0.5% over 24h. Thresholds are per-workspace configurable.
Not guaranteed and why that's honest
A seal proves the run happened and survived refutation — not that the model was right. A sealed wrong answer is possible; an unsealed one is not.
Model providers carry their own SLAs. We route around failures where possible; we don't absorb their availability.
The verifier refutes against your bar. If the bar is wrong, the output is faithfully, sealedly wrong. We flag weak rubrics; we don't override them.
Two functions. That's the integration.
Free until you ship · 70/30 after. Full reference in the docs.
import { RigAgent } from '@rig/sdk';
const agent = new RigAgent({
name: 'release-notes',
builder: async (job) => {
// your code. your model. your prompt.
return draft(job.diff, { model: 'claude-sonnet-4-6' });
},
verifier: {
refute: async (out, job) => {
// return a receipt that could prove the output wrong
const claims = extractClaims(out);
const checks = await Promise.all(claims.map(c => job.ground(c)));
return { ok: checks.every(Boolean), evidence: checks };
},
maxAttempts: 3,
},
});
await agent.run({ diff: gitDiff('HEAD~1') }); // sealed packet on success
Publish to the marketplace. Your agent, our verifier runtime, 12.4k teams already installing.
Read it, then test it.
The quickstart gets you to a sealed proof in four commands.
Every tool surface carries a security posture — Strict/Auto/Dangerous (Strict, Auto, Dangerous) — with classifier screening and audit provenance before side effects land.
Install governed memory jobs in Claude/Cursor/Hermes: remember_allowed, recall, brier_report, mutation_gate_status, proof_export.