Explore a capsule

operator is itself a digest here — even identifying fields can be committed privately.

The agent_input is the whole input the model saw for this action — the system prompt, the context, the tool definitions, and the specific action arguments. The agent_output can be just as large — the full response, tool calls, and results. A capsule commits each as a single SHA-256 digest: fixed-size, however big or sensitive the content, and the raw never leaves your machine. Edit either box — the digest changes with every byte.

Whether the input is 200 bytes or 200 KB, the digest is the same 64 hex characters — so a long system prompt or a sensitive context is pinned exactly, without being stored or revealed. Change one character and the digest is completely different.

Each capsule carries a timestamp and a chain.parent_capsule_id pointing at the one before it by digest. That turns approved → executed → confirmed into a single ordered, verifiable trail — including the human in the loop.

The parent link is a digest, so the order can't be quietly rewritten — change any earlier capsule and every child's link stops matching.

You give someone the three capsules above and say: here's what my agent did — don't take my word for it. They verify each one from the bytes and check the chain links, trusting nothing about you. Try it — and try tampering one first.

Nothing here trusts the operator: the seal is recomputed from the bytes and the chain links are checked digest-to-digest. That's what "verifiable record, trust no one" means in practice.