Testigo · an open protocol by GoEncode

Proof of what your AI agents did.
Verifiable by anyone.

Testigo turns each agent session into a signed, hash-chained record: the human intent, every approval and its reason, every action, and the diff it left behind. One file. Verified in a browser, with no account and no server.

Verify a real packet Read the spec
fixy-backend 12 events · 8 redacted · chain intact
  1. 00 16:41:19 prompt redacted · linkage intact 18a0e2997f…
  2. 01 16:41:19 snapshot working tree d272287 599cb4536f…
  3. 02 16:41:30 approval_request redacted · linkage intact 6f0d13ed09…
  4. 03 16:41:36 approval_decision allow · “approved once” · Bash 1fb377bca9…
  5. 04 16:41:40 tool_result redacted · linkage intact ea9801e25f…
  6. 05 16:41:40 approval_request redacted · linkage intact 4366f7d552…
  7. 06 16:41:44 approval_decision allow · “approved once” · Bash ec28c8829e…
  8. 07 16:41:45 tool_result redacted · linkage intact 94ff46c97a…
  9. 08 16:41:45 approval_request redacted · linkage intact b95bd7566a…
  10. 09 16:41:46 approval_decision allow · “approved once” · Bash 5d8a5ecdbc…
  11. 10 16:41:48 tool_result redacted · linkage intact 11ebca425e…
  12. 11 16:42:15 turn_end 0 files changed · d272287 → 5523ec5 4e18791074…
DSSE · ed25519 · key 8caf0907… verify a packet ↓

A real packet: a production deploy check on Fixy, 15 Jul 2026. Three agent commands, three human approvals, zero files changed. Content redacted before export; linkage verifiable by anyone.

Why this exists now

Everyone records what agents do. Nobody hands you proof.

Platform logs live with the platform, for the employer. A Testigo packet is for the third party: the auditor, the customer, the underwriter.

Regulators
EU AI Act articles 12 and 14 are enforceable for high-risk systems since 2 August 2026: automatic logs, and evidence that human oversight was meaningful, per decision.
Buyers
Enterprise procurement checklists now ask for append-only, hash-chained logs and an answer to “who approved this” before signing an agent contract.
Insurers
Agentic-liability underwriters ask for documented human oversight of consequential decisions, and a track record that survives a change of platform.

The chain

Witness, not gatekeeper.

Testigo records; it never orchestrates or blocks. A local ledger captures the session as it happens. At export, a human reviews everything the packet would contain, redacts what must not leave, and signs.

Captured ambiently from Claude Code hooks by the CLI and plugin, and from the permission path itself by agent-console, which is where approvals become evidence.

  1. 01

    Intent

    A prompt or a ticket opens a turn. The case id binds the work to the requirement it serves.

  2. 02

    Approval

    Every request the agent makes, and the human's allow or deny with the stated reason, hash-chained between the request and the result.

  3. 03

    Action

    Tool calls and their results, size-bounded, in the order they happened.

  4. 04

    Evidence

    A working-tree snapshot before the turn, the list of files it changed after.

  5. 05

    Packet

    The segment exported as an in-toto statement, signed as a DSSE envelope with ed25519, optionally timestamped by an RFC 3161 authority. Redact any event; the chain still verifies.

What a valid packet proves

  • The signer exported exactly this segment, and nothing shared has changed since.
  • Every link in the chain holds, through redacted events and pruned stubs.
  • Which requests a human approved or denied, and the reason they gave.
  • What the turn changed: the tree before, the tree after, the files in between.
  • The instructions the agent ran under, the models it used, when the session started and ended.

What it does not

  • That the ledger is complete. A producer can omit events before sealing; the spec says so.
  • That each event's clock was accurate. Timestamps inside the chain are the producer's.
  • What an independent observer would have seen. Compose with an observed-effect record for that.

The ledger is tamper-evident, not tamper-proof. We say it in the spec, not in a footnote: a smaller true claim beats a bigger false one.

Try it

Verify a packet. Nothing leaves your browser.

  1. 01Download the demo packet: one redacted event, one pruned stub, a real RFC 3161 timestamp.
  2. 02Drop it on the verifier. The page checks the signature, the subject digest, and every link of the chain, and reports what was redacted instead of passing it silently.
  3. 03Compare the key id with the publisher through another channel. The packet carries its own key; the trust anchor is the id.

The verifier is one HTML file with no dependencies and no network calls. Open it full-page or read its source.

What you can get

The protocol is free. The notary and the hands are not.

Protocol · MIT

Testigo

The specification, the JSON schema, the conformance corpus, the browser verifier, a zero-dependency CLI and a Claude Code plugin, and the reference implementation in agent-console.

Freeforever

GitHub

Hosted · early access

Testigo Cloud

The notary. Trusted timestamps and anchoring as a service, organisation keys and revocation, multi-year retention, a portal your auditor logs into, and evidence packs mapped to ISO 42001, SOC 2 and EU AI Act art. 12 and 14. Integrations with Vanta, Drata, Jira and GitHub.

From USD 200per team, per month

Join early access

Services · by GoEncode

Agent audit and implementation

Agent audit, one weekUSD 3,000
An inventory of what your agents do, what evidence they leave, and what is missing to audit them. A written report; no tooling required.
Implementationfrom USD 8,000
Testigo in your agent workflows: capture, review, redaction, signing, and the evidence pack your auditor expects. Fixed scope, fixed price.
Book an agent audit

Standing on standards

Interoperate, don't invent.

A packet is an in-toto statement in a DSSE envelope. Any tooling that verifies those verifies a packet.

in-toto
The session-chain predicate draft in in-toto/attestation#554, with a checker written independently from the spec text that reaches verdict parity on every vector.
Source
FINOS AI Governance Framework
Aligned with the Agentic Process Evidence proposal: a packet slots in as a signed session log, with a field-by-field mapping published.
Source
Conformance corpus
27 golden vectors signed with a published throwaway key, including valid signatures wrapped around internal defects. A green signature is not a green verdict.
Source
EU AI Act, art. 12 and 14
Record-keeping per decision and durable evidence of human oversight, mapped in the spec. Informative, not legal advice.
Source

GoEncode Tech LLC · since 2021

We operate agents ourselves. That is why this exists.

GoEncode is a software company from Las Vegas and Uruguay. We run Fixy, a local-services marketplace operated with AI agents, and we needed to show what those agents did without handing anyone our servers. Testigo is that answer, published as an open protocol. The first packet ever verified came from our own production.

Teams we have worked with

IBEC SITI Solvisse Omnisauto Snapclear

Start with the audit. One week, one report, no tooling.

You leave knowing what your agents do, what evidence they leave today, and what an auditor or an underwriter will ask you for.

Book an agent audit Write to us