§ 01 — Proof layer

Governance receipts for every agent run.

Signed, tamper-evident, verifiable by anyone.

A cryptographic record of every AI agent run — mapped to the controls, policies, and frameworks your organization already uses. Send your auditors and enterprise buyers a verifiable link instead of screenshots and PDFs.

Every agent. Every framework. Every model.

The ones you build, the ones you buy, and everything in between — including:

Claude Code
Cursor
LangGraph
OpenAI Agents SDK
Microsoft Agent Framework
Google ADK
AWS Strands
CrewAI
Pydantic AI
LlamaIndex
AI agent sessions
Record tool calls, policy gates, blocked attempts, and run boundaries.
Coding-agent changes
Bind file edits, bash commands, PR review, and policy outcomes to one artifact.
Open verification
Use the Apache-2.0 verifier without calling Primust.
VPEC · Coding Agent Session
signedoffline
VPEC ID
vpec_b135298a...c7bf6
Run ID
run_629312ff5174409c
Workflow
df40d664...17b8b
Surface
Claude Code
Bundle
agent_change_review_v2
Proof floor
Execution
Proof coverage
92% provable
Issuer
kid_live_2026_01
Credential hash
sha256:0c31...9a4f
Proof coverage
92% provable · floor: Execution
Mathematical
24%
Verified
18%
Execution
50%
Gaps
8%
Recorded
16
Governed
13
Blocked
2
Open gaps
3
Evidence bound
Commit rootsha256:6fa27160...bc760
Policysha256:c8cb744d...10960
TimestampRFC 3161 · digicert_us
Verifier keykid_live_2026_01
Checks
PresidiookGitleaksokSemgrephighUnit testspassDiff hashboundTool boundarygap
Run trace
00:00startClaude Code session
00:05testnpm test passed
00:08gatesemgrep high finding
Gaps declared
SEM-012unsafe redirecthigh
G-017tool visibilityopen
Signature
valid
Timestamp
witnessed
Policy pack
matched
Content
commitments only
Ed25519 · RFC 3161 · sha256 commitmentsFull artifact model on Product

Start with the governance question you need to answer. Map the obligation, choose the checks, record the run, then hand over a verifier-readable artifact.

Governance Mapping
Compile obligations into control plans, map controls to evidence, and keep the review boundary explicit.
Check Integrations
Use built-in checks, policy engines, detectors, SDK/OpenTelemetry paths, API-backed checks, or your own check logic.
Runtime Evidence
Capture agent sessions, model calls, policy gates, blocked actions, human approvals, and coding-agent changes as they happen.
Verified Inference
A future assurance path for binding model identity, prompts, retrieval, tools, environment, and outputs.
§ 02 — What you get

One evidence layer for maps, checks, runs, and proof levels.

Primust does not replace your policy engine, detector stack, dashboard, or enforcement layer. It binds what they did into evidence another party can verify later.

Governance maps
Applicability snapshots compile into obligation and control plans, so each evidence record points back to the governance requirement it supports.
Check execution
Built-in checks, policy engines, detectors, SDK adapters, OpenTelemetry traces, external services, and custom checks all land in one evidence model.
Signed credentials
Every governed run becomes a portable VPEC with committed inputs, outputs, controls, proof levels, timestamps, and gaps.
Assurance ladder
Run evidence is the start. Human review, linked VPECs, deterministic checks, and future verified-inference paths can support stronger claims where the evidence allows.
§ 03 — How it works

Map. Wire. Record. Verify. One artifact model.

At the top level: turn governance requirements into runtime checks, then issue evidence that survives outside the original system.

Map the obligation
Select the framework, regulation, or internal policy. Primust compiles the applicable obligations and control plan.
Choose the checks
Install built-ins, policy engines, detectors, SDK adapters, OpenTelemetry, API-backed checks, or custom checks from your own stack.
Record the run
Agent actions, model calls, policy gates, human approvals, linked VPECs, and check results bind to committed inputs and outputs.
Verify the artifact
The VPEC declares the proof level, coverage, gaps, plan hashes, timestamps, and the evidence path used.
§ 04 — Inside the credential

A VPEC shows what ran, the proof floor it reached, and where the gaps remain.

The artifact can leave your system and still answer the review question later: what happened, what was proven, and what stayed outside the proof.

VPEC · Credential Anatomy
signedcontent-blind
VPEC ID
vpec_refund_04b7
Workflow
refund_agent.review
Request
order_9F2 · $184 refund
Agent
support-agent@v4
Proof floor
Execution
Surface
0.84
Bundle
refund_policy_v3
Issuer
kid_live_2026_01
Proof coverage
84% provable · floor: Execution
Execution 84%
Declared gap 16%
Run evidence captured
01
Customer asks
input committed
A buyer asks for a refund after a delayed shipment.
02
Agent checks
3 tool calls
The agent calls order lookup, refund policy, and risk-score tools.
03
Policy gates
2 gates passed
Delay verified, amount below threshold, no fraud hold.
04
Outcome
signed result
Refund approved. Raw customer text stays outside the credential.
Control evidence
order.lookup
executed
refund_policy_v3
passed
risk_hold_v2
passed
approval.tool
executed
settlement
gap
Credential summary
Committed
request, tool inputs, tool outputs
Controls
refund_policy_v3, risk_hold_v2
Surface
84% provable
Gap
payment settlement is downstream
Signature
valid
Timestamp
witnessed
Raw text
not present
Verifier
offline
Ed25519 · RFC 3161 · poseidon2 commitmentsverify offline
What ran
The refund agent invoked order lookup, refund policy, risk scoring, and an approval tool. The VPEC records the tool calls and committed inputs/outputs.
What proof level was reached
The workflow reached Execution proof for the declared tools and policy gates, without exposing raw customer text.
Where the gaps remain
The payment processor settlement happens downstream, so the credential records that boundary instead of pretending the whole refund lifecycle was proven.
The verifier is open source. The format is portable. Review does not depend on a Primust dashboard being available when someone needs the evidence later.
§ 05 — AI Agents

Instrument agent runs. Verify the credential later.

Agent runtimes move faster than their review paths. After primust init, a Python startup hook records governed sessions while they happen and auto-activates in the path before the governed session starts — wrapping whichever supported framework you've imported (OpenAI Agents, LangGraph, CrewAI, LlamaIndex, DSPy, Haystack, LiteLLM, MCP, Bedrock, Strands, Google ADK, MSAF, Pydantic AI, Semantic Kernel, AG2, OTel). Every tool call, every policy gate, every blocked attempt lands in the VPEC — with no change to supported agent code.

pipeline.py
pip install primust · primust init
# one-time setup
$ pip install primust
$ primust init # resolves key, detects 16 frameworks, wires hook
 
# your existing agent code — no imports, no wrapping, no changes
import langgraph # or crewai, openai_agents, llamaindex, …
graph.invoke(input_data) # every tool call, every gate is captured
 
# a signed, portable, offline-verifiable VPEC is emitted at the session boundary.
OpenAI Agents SDK
auto-detected on import
LangGraph
auto-detected on import
Google ADK
auto-detected on import
Microsoft Agent Framework
auto-detected on import
Pydantic AI
auto-detected on import
Semantic Kernel
auto-detected on import
OpenTelemetry
fallback — works with anything
Custom
@record_check decorator
Full AI Agents spec →
§ 06 — Coding Agents

Record coding-agent changes.
Make the session reviewable.

Install Primust before the session: when an agent edits files, runs commands, or opens a PR, the VPEC records what it touched, which policies gated the change, and exactly what was blocked. Without the hook, the git commit is only a diff.

primust-hook is a Go binary. Per-invocation. Zero permanent state on developer machines. IT-deployable. Same governance applies whether the agent is running locally or in CI.

Claude Code
primust-hook · claude-code
hooks + MCP bridge
When primust-hook is installed, every tool call, file edit, and bash command is wrapped in a VPEC. IT-deployable.
Cursor
primust-hook · cursor
background agents + composer hooks
When primust-hook and the Cursor extension are installed, Composer edits, background-agent runs, and terminal commands emit VPECs.
Example coding-agent VPEC
PR #4721needs reviewsigned
Claude Code can write the patch. Primust makes the review trail travel with the patch.

The VPEC is the review handoff for one coding-agent PR: which files changed, which review tools scanned the exact diff, what they found, and why the merge gate stayed closed.

1
Agent patch
Claude Code edits auth/session.ts and routes/oauth.ts, then opens PR #4721.
2 files changed
2
Required review
CI runs npm test. Semgrep and Gitleaks scan the exact diff the agent produced.
3 checks run
3
Finding raised
Semgrep flags an unsafe redirect in the changed auth code. The PR cannot auto-merge.
1 high finding
4
Signed proof
Primust binds the agent run, diff hash, scanner versions, rule packs, and finding into one VPEC.
signed VPEC
Bound evidence
Session
sess_cc_92ab1
Diff commit
poseidon2:c41a...d8e3
Scanner pack
semgrep@1.69 · gitleaks@8.18
Command log
npm test · exit 0
PR status
merge blocked
Issued
2026-04-07 20:36 UTC
Reviewer receipt
Not auto-approved.
The patch is not just logged. The required code-review checks are bound to the exact agent diff, and the finding keeps the PR blocked.
Changed
auth/session.ts and routes/oauth.ts
Reviewed by
npm test, Semgrep, Gitleaks
Finding
unsafe redirect in changed auth code
Result
PR #4721 remains blocked
Agent run
Claude Code session id
Diff hash
exact patch reviewed
Rule packs
scanner versions bound
Signature
offline verification
Gap ledger
SEM-012unsafe redirecthigh
G-017tool visibility boundarydeclared
signature
valid
timestamp
witnessed
diff hash
matched
policy pack
matched
VPEC binds the agent session, diff hash, review checks, scanner rule packs, findings, and merge status.Ed25519 · RFC 3161 · poseidon2
Full Coding Agents spec →
§ 07 — Who it is for

The same credential answers different questions for engineering, security, and compliance.

Engineering
Add evidence to existing governed workflows without rebuilding them. Keep your frameworks, rule engines, and internal checks.
Security
Show that controls and policy gates actually ran without exposing the underlying content or trusting an agent-authored log stream.
Compliance
Hand another party a portable artifact they can verify independently instead of walking them through screenshots and self-attested records.
§ 08 — Honesty

The product works because the claims are narrow, explicit, and defensible.

Sufficiency
Primust does not decide whether your declared controls are sufficient for a specific regulation, policy, or review standard.
Completeness
Primust does not claim the instrumented surface is the entire workflow. Anything outside the declared surface remains outside the credential.
Correctness
Primust proves that a scanner or check ran. It does not prove that the scanner was sufficient, complete, or substantively correct.
Content quality
Primust does not inspect the governed content itself. It records commitments and execution evidence around the workflow.

This is not disclaimer language. It is the boundary that makes the evidence credible.

Verify a sample. Then decide if you want to issue your own.

Start with the hosted verifier or go directly to the sandbox. The product decision should come after you have seen the artifact and its limits clearly.

Verify a sample VPECGet sandbox key