Logs can be rewritten.
Signatures cannot.
When an agent breaks out of its sandbox, "trust our logs" is not evidence. It is a press release. Probity runs agent code you don't trust in a locked box and signs a receipt of what it did. Anyone can check that receipt offline, with no trust in us.
July 2026: an OpenAI eval agent broke out of a "highly isolated" sandbox. It then broke into Hugging Face production.
The only proof of "containment"? Reconstructed logs and a press release.
When agents act on their own, a log a company writes about itself is not proof.
I'm not claiming I'd have stopped it. I'm saying there was no record an outsider could check. That is the gap Probity closes.
Run it in a box
Foreign agent code boots in a hardware-isolated microVM. Secrets never enter it.
Watch & contain
Every file, network, and egress attempt is intercepted at the host boundary.
Sign the receipt
Emit a DSSE / in-toto ed25519 receipt of exactly what happened — tamper-evident.
Anyone verifies it offline with cosign and a public key you supply — no dependency on us.
- A verdict, not a log. Deterministic, cryptographically signed, and re-checkable by a third party — offline.
- An open standard. An independent engineer rebuilt the conformance spec from scratch — 125/125 first run, blind.
- Runs the real thing. Not regex over source — we execute the code and watch what it actually does.