Receipts

Same answer every time. Every Warden run is a hash-chained sequence of signed receipts. Same inputs, same tokens, a signed and replayable chain. Fork from any step. The original run is preserved untouched.

Same answer every time, fork from any step

Same answer every time, fork from any step

The agent's inference calls go to a determinism-eligible model on a batch-invariant kernel. Same inputs, same tokens, same bytes. A signed receipt mints per step, chained by hash to the prior step. The run's terminal chain hash is the per-run attestation root.

The hash chain

Each step commits to:

• step_input_hash. The hash of the canonical step input.
• step_output_hash. The hash of the canonical step output.
• step_chain_hash. The hash of the prior chain hash plus the input hash plus the output hash.
• previous_chain_hash. The prior step's chain hash. Null on step zero.

The chain is the tamper-evidence substrate. A replay walks the chain and recomputes each hash. If any byte differs, the replay fails. The shared hash utility guarantees the in-memory chain and the persisted chain agree byte-for-byte, so replay works for live agent runs, not just externally-recorded ones.

The step taxonomy

Five step kinds:

• llm_call. One inference call. A dlir_ receipt mints per llm_call step when the receipt port is wired.
• tool_call. One governed tool dispatch. Carries the tool name and the response mode (pinned, mocked, live).
• retrieval. One vector-search retrieval. Carries the pinned corpus snapshot id and the tool-selection breakdown.
• sub_agent. One delegation to a child run. Carries the child run id, so replay can recursively replay the child.
• reasoning. An internal chain-of-thought checkpoint.

Fork from checkpoint

You can fork a run from any step. The fork copies the original run's steps up to the checkpoint, then enqueues a continuation as a new async run. The fork's chain is a verifiable prefix of the original's. A replay of the fork matches a replay of the original's prefix.

• Per-turn. Hover an assistant turn, click the fork button. The dialog says "Start a new conversation seeded from this turn's checkpoint. The receipt chain branches here. The original run is preserved untouched."
• Per-step. Open the "Tool calls, N" disclosure, click "Rewind from here" on any step row. The same dialog with the step index.

A forked continuation runs under the forking caller's identity and access context, not the original run's. The original run's agent scope is preserved across the fork. A forked continuation cannot escape the original agent's tool, server, and skill allowlists.

A breadcrumb at the top of the forked thread shows "Forked from runId, step N" with a branch icon. The visible audit trail that this conversation branched off a past receipt.

The step drawer

The step trace is a collapsible "Tool calls, N" disclosure with a wrench icon. Hidden by default. Each row shows a friendly label, a timestamp, and a speaker label. Friendly labels: "Called toolName," "Thinking," "Searching context," "Delegating," "Planning," "Reviewing," "Step N."

Each row has a per-step rewind affordance. Click "Rewind from here" and the fork dialog opens with the step index.

A parallel "Sub-agent plan, N tasks" disclosure renders the goal tree when the planner decomposed the request into sub-tasks. Each sub-agent child is itself a run, recursively replayable.

The five receipt families

The Glass Box Ledger writes signed receipts in five families. The prefixes are consistent in prose, code, and diagrams.

Prefix	Family	What it records
eh_	eval	Eval harness runs.
dlir_	govern	Governance decisions, the primary verdict ledger.
gr_	gate	Egress and human-in-the-loop gate holds.
evow_	winner	Eval winners, the chosen model or config.
ema_	monitor	Continuous-assurance monitoring events.

The ReceiptStrip (in the workbench)

The verbose ReceiptStrip (chain-hash pill, "Deterministic Receipt" label, "Signed & verifiable" subtitle, copy-id chip, "kernel" fingerprint chip, "Verify this result" button) is deliberately kept out of the chat. It is enterprise audit chrome that belongs in the workbench. The chat keeps the calm fork-and-thumbs footer.

In the workbench, the ReceiptStrip turns an id into evidence: id, fingerprint, verify, replay. On verify, a panel shows a colored dot and the success verb ("Reproduces bit-for-bit," "Attestation holds," "Envelope intact") or the failure ("Verification failed," "Could not verify, this is not a pass"). A failure never paints green. The brand is built on not over-claiming reproducibility.

Where to go next

• Chat shell for where the fork button and step drawer live in the settled turn.
• BYOK models for the one seam that can route off the deterministic brain, and why regulated work ignores it.
• Inline UI for the inline receipt.strip mount and the confirm-card gate receipts.