Retrace

A true story from our own ledger · 28 August 2026

The commit that lied about its author

Six AI agents share one checkout of this repo. At 20:37, Claude Code finishes 296 lines of timeline UI and leaves them uncommitted, waiting for review.

At 20:54, Codex gets a one-word instruction — "Re-integrate" — and does the obvious thing: it commits whatever is in the working tree. Commit bfe87c3 lands on main. Its trailers say codex · gpt-5. From here on, every tool that reads git believes Codex wrote the UI.

git blame can't tell you otherwise. The commit message can't either — the agent that pushed wrote it. In a team without a ledger, this is where the story ends and the wrong name sticks.

With Retrace it takes one query. Claude's edit was already in the chain 17 minutes earlier, in Claude Code's own name — the same three files, linked by caused_by to the human instruction that asked for them. The server had sequenced and hashed it in ahead of bfe87c3's own event — though without a credential stamp, since the server did not start recording which credential sealed an event until 28 hours later — so its place in the order is held by every hash after it, while a commit message is written by the agent committing, at the moment you'd want to doubt it. Codex's commit sits after it with a different root. Fifteen minutes later an amendment and an empty correcting commit put the truth in both git and the ledger — without rewriting history. The record shows the mistake and the correction. That's the point.

Don't take our word for it — this ledger is public:
Download the pre-verified snapshot (bundle + checkpoints + witnesses + keys, 3 September 2026) — verify it yourself: npx -y --package=@retrace-dev/cli retrace-export verify retrace-ledger.json --pubkey https://retrace-api.slcwitit.workers.dev/.well-known/retrace-pubkey
Read-only live browsing is paused while export redaction is built.

project retrace · chain intact2026-08-28 · local time

jordansboxing@… instructed · 20:28 · #217

"Let's improve overall functionality of UI. Sometimes you click a highlighted section, button etc. that is clickable but…" evt_0423c151 — the human root.

claude-code edited · 20:37 · #231 · before server stamps

retrace.html, ui-detail.test.ts, ui-html.ts (+296 −45) · caused_by evt_0423c151 · evt_4231942b

codex committed · 20:54 · #243 · git hook

bfe87c3 "Make Retrace UI interactions reliable" · trailers name codex — but the files match Claude's edit above.

claude-code amended · 21:09 · #258

bfe87c3 was authored by claude-code, committed by codex. Correction commit c375ed4. History kept.
Since 0.1.7 the correction is first-class: a human-sealed attribution amendment changes a file's effective author where server-stamped evidence exists, leaving the recorded one visible. The first real one is ledger #2543 on commit 5d7290f (seven files, codex → cursor-agent) — a later event, not in the 2026-09-03 snapshot linked above, whose full export is not currently public. bfe87c3's own evidence predates server stamping, so it stays an honest gap rather than a forced demo.

What it records

Who. What. Why. Sealed by the server, not the agent.

Every agent and every tool writes to one chain. Each event is hashed onto the previous one, and since 30 August 2026 the server records which credential sealed it: an agent on its own pinned credential can only write as itself, and when it relays your instruction the ledger records that it relayed.

WHO

One identity per agent

Claude Code, Codex, Grok, Copilot and Cursor each hold their own pinned credential. Since 4 Sept 2026 every agent credential also signs its MCP events with an Ed25519 producer signature the server verifies before sealing; git-hook and webhook seals are credential-stamped but unsigned; events from before 30 Aug 2026 (947 of them in the snapshot) carry no stamp at all; and the export says which is which. Humans appear as themselves; when an agent relays your instruction, the ledger says so.

WHY

Every action has a root

caused_by links each agent action back to the human instruction that started it. A link that can't be verified is flagged, never silently dropped.

WHAT · WHEN · WHERE

Commits, PRs, docs

Git commits via a post-commit hook, GitHub pull requests via HMAC-verified webhook, Google Drive edits via forwarder — files, hashes, session, IDE, and both timestamps.

Agents — each sealing under its own credential

Claude CodeCodexGrokGitHub CopilotCursor AgentNOOA (NVIDIA Labs research preview)Others — ask us

Sources it records from — not agents, no identity of their own

Git (post-commit + post-merge hook)GitHub (HMAC-verified push webhook)Google Drive (forwarder)

Prove it

Verify offline. It tells you when it can't.

Export a signed bundle and check it anywhere — no server, no account. Without a trusted key the verifier refuses to say "valid": a bundle that only proves it agrees with itself is self-attested, and the tool says so.

What this transcript is: a later 2,646-event export with checkpoint #2580 (2026-09-08). It is not the downloadable 2026-09-03 snapshot (1,585 events, head #1584) and its full export is not currently public — it is shown to demonstrate what the verifier says, not as something you can reproduce from that download. The snapshot verifies with the command above under “Download the pre-verified snapshot”, which names its own asset retrace-ledger.json; expect 1585 of 1585.

$ retrace-export verify retrace.json

NOT VALID — signature: self_attested (kid 51f6ac4c…, key embedded in bundle — NOT a trusted key); events intact: true; links: true; coverage: complete — 2646 of 2646 events

pass the issuer's public key (--pubkey, RETRACE_PUBKEY, or RETRACE_URL for its /.well-known/retrace-pubkey)

$ RETRACE_URL=https://retrace-api.example.workers.dev retrace-export verify retrace.json --checkpoint .retrace/checkpoints.jsonl

VALID — signature: valid (kid 51f6ac4c…, trusted key from …/.well-known/retrace-pubkey); events intact: true; links: true; coverage: complete — 2646 of 2646 events

attribution amendments: 1 effective · 0 ineffective · 0 superseded

checkpoint #2580 (2026-09-08): EXTENDS — bundle contains the checkpointed head #2580 unchanged and continues to #2645

OMISSION

Nothing left out

A full export must carry every event it claims, contiguous from #0 to the signed head. A dropped tail or a missing middle is NOT VALID, with the missing sequence numbers named.

CHECKPOINTS

The head, witnessed — twice

Every hour, each project that opted in (today: retrace) and whose head moved gets a signed checkpoint submitted to the public Rekor transparency log; once a day one is also committed to git and merged by a human — so rewriting a witnessed head means rewriting a Merkle log we don't operate, within an hour of it happening. A later export missing that head is a conflict, whatever date it claims.

GATE

Complete, or the build fails

retrace doctor --gate runs in CI against the signed ledger only: a signed export plus a chain-verified tail anchored to a signed live head, so an unsigned response can't change its answer. It runs on every pull request and again on every push to main, so a commit with no provenance behind it turns the build red — before a merge, and again after one lands. Every documented local step also runs in CI from an empty machine with our own server blocked. Merges here are pushed by the repository owner, who is exempt from the branch ruleset, so what stops an unprovenanced commit is that red build and the merger who reads it: the check is automatic and its verdict is public; the merge itself is a person's call.

What it can't do

Tamper-evident, not tamper-proof. Here's the line.

We'd rather you read this here than discover it in a review. Everything on the left is proven by code on main; everything on the right is a claim we don't make.

What Retrace proves

Any edit to a sealed event, and any removal of events after a checkpoint, is detectable offline.
Which credential sealed each event — recorded by the server since 30 August 2026. The 947 events sealed before that carry no such stamp, and the export says which is which.
That an agent action is linked to a specific human instruction — or that it isn't.
That a full export contains everything the server claimed at export time.

What it doesn't

It can't stop an operator with database access from rewriting history before a checkpoint — it can only show that the head moved.
The model name an agent reports is what the agent said. We record it; we don't verify it.
Line-level attribution ("this function was written by GPT") is not a feature.
It records what producers log. The CI gate checks that the commit it runs on is complete; keystrokes are never captured.
The gate is a check, not a lock. On this repository the owner pushes every merge and is exempt from the branch ruleset, so GitHub does not refuse a red merge — a person does.
Commit attribution trusts the trailer the committing agent writes. A seal-time check that would refuse a wrong trailer is designed and peer-reviewed, not built; today a wrong trailer is caught by the gate and corrected by amendment, not prevented.

A security assessment on 30 August 2026 found two high-severity gaps in exactly this verification path. Both were closed the same day — read the full report, every finding with file, line, and the commit that fixed it. A second independent audit on 7 September 2026, run on a different vendor's model, found a High in the CI gate's trust boundary; it was closed the same day in PR 16.

Pricing

Free to run yourself. One flat price to have it run for you.

Self-hosted

Apache-2.0 core, CLI and Cloudflare Worker
Unlimited projects, agents, events
Signed exports, offline verify, CI gate
Your Cloudflare account, your keys

Read the setup guide

Team

$49 / month, flat

Hosted ledger with hourly Rekor-witnessed checkpoints (opt-in per project)
Up to 10 agent identities, unlimited humans
Read-only share links and printable provenance reports for clients
Your hosted ledger is provisioned within one business day of checkout; setup help included

Start Team — $49/month

Secure checkout by Stripe. Cancel any time; your ledger export is yours either way.

Team is an early price for the first ten teams. It will go up; yours won't. After checkout you get an email with your ledger URL, your agents' credentials, and a 30-minute setup slot if you want one.

The flight recorder for AI coding agents.