Your agents edit, run, and decide.
Capsules prove what they did.
agent-capsule seals every AI coding session into a tamper-evident SHA3-256 + Ed25519 hashchain. Verify it yourself, in the browser, fully offline. Nothing to trust but the math.
A Chat Log Is Editable Text.
A Capsule Chain Is Not.
When an agent edits your code, runs your tests, and makes calls, the transcript is just a file anyone can rewrite. A sealed chain proves exactly what happened, and breaks the moment a single byte changes.
Open the file, change a line, save. No trace.
Nothing attests the log matches what really ran.
You see output, not why the agent chose it.
Records can be inserted or deleted silently.
Each record is SHA3-256 hashed and Ed25519 signed.
Change a byte and verify points to the exact seq.
Unified diffs, tool results, and the model's reasoning.
Re-check the math offline. No account, no server.
agent-capsule verify → ✓One Tool. Four Agents.
agent-capsule hooks into the agent you already use. The hook fires when a session ends, and the session is sealed before it can be edited.
Claude Code
Stop and SessionEnd hooks fire on every turn
agent-capsule install claude-codeCursor
~/.cursor/hooks.json stop hook, enriched from globalStorage SQLite
agent-capsule install cursorCodex
~/.codex/config.toml notify program
agent-capsule install codexCline
~/Documents/Cline/Hooks TaskComplete, Cancel, and Start
agent-capsule install clineLet the Agent Install Itself.
Paste one prompt and your agent registers its own hook. Or run two commands yourself. Either way you are sealing sessions in under a minute.
Install agent-capsule so all my coding sessions, from now on, are sealed into a tamper-evident audit trail. Fetch https://raw.githubusercontent.com/quantumpipes/agent-capsule/main/INSTALL.md and do every step for whichever agent you are, then confirm the hook is registered.
Three Primitives.
Hash, Sign, Chain.
No new cryptography. Just three well-understood operations composed into a record that cannot be quietly rewritten.
Each capsule is serialized to canonical JSON, then SHA3-256 hashed. Same bytes, same hash, every time.
The hash is signed with a local Ed25519 key. The signature proves the record came from your machine and was not altered.
Every capsule stores the previous capsule's hash plus its own sequence number. The records are welded into one line.
Not a Summary. The Receipts.
A capsule records what the agent actually did, at full fidelity, so a reviewer can reconstruct the session from the sealed record alone.
Real diffs
Rendered unified diffs with per-file +/- counts, not a vague summary of what changed.
Full tool results
Actual stdout and stderr, file contents read, and web URLs fetched. The receipts, not the recap.
The model's reasoning
Where the tool persists it, the reasoning behind each turn is sealed alongside the action.
Subagent scorecards
A compact tally per subagent, for example [Explore: 2 edits, +14/-3, 9 tool calls].
Cost and provenance
Token and cache usage, the per-turn model, and the permission posture in effect.
Summarized blobs
Heavy payloads are summarized with their hash, never inlined wholesale. The chain stays lean.
Nothing to Trust
But the Math.
The chain ships the canonical bytes and the public key. Anyone can re-hash every record and re-check every signature, in Python, in JavaScript, or in the browser with Capsule Explorer. You do not have to trust agent-capsule. You can check it.
Seal Every Session.
Prove Every Edit.
Open source, offline, no account. Install it once and every coding session your agents run becomes a tamper-evident record you can verify yourself.