Know your AI ran exactly what you approved — and prove it later.
AI tools can now write code, move files, and run commands on your machine. That power needs a receipt. SealRun checks an AI session before it starts — if the plan doesn't match what you signed off on, it doesn't run — and seals a tamper-evident record of everything that happened, so anyone can check it afterwards.
Why SealRun
Trust, but verify — before and after
Most AI safety tools only watch, or only keep a log you have to take someone's word for. SealRun does the two halves together.
Nothing runs unverified
Before a session starts, SealRun checks its signed manifest — what is about to run, under whose approval. If anything has been swapped, edited, or rolled back to an older version, the launch is refused. The check happens before, not as an apology after.
A record that shows its own tampering
Everything the session does is written to a journal where each entry is locked to the entry before it — a hash chain. Change one line in the middle and every lock after it breaks. Quietly rewriting history stops being quiet.
Proof that doesn't depend on trusting you
Optionally, the head of that journal is anchored into the BSV blockchain in a single small transaction. After that, the record's existence and integrity can be checked by anyone, against a public ledger — not against your copy of the file. A human, not the AI, reviews and signs that anchor transaction.
How it works
Four steps, in plain language
No blockchain knowledge needed for steps 1–3. They run entirely on your own machine, with no third-party dependencies to install or trust.
The manifest
A small signed file — the sealrun-manifest-v1 — states what a session is allowed to be: the program, its files, and who approved them. Think of it as the sealed envelope's label.
Verify, then launch
At launch, SealRun re-checks every file against the manifest and confirms the signature. Match: the session runs. Anything off — a changed file, a forged manifest, an old version replayed — and it refuses to start.
The chained journal
As the session runs, each event is appended to a journal and chained to the previous entry by its hash. The journal can be re-verified at any time, by anyone with the file.
Pin it in public
The journal's head hash is written into a BSV transaction (an 84-byte OP_RETURN payload). The AI prepares the transaction; a human reviews exactly what will be signed and approves it — the key stays behind that human gate, out of the AI's reach.
Honest limits
What it proves — and what it doesn't
A seal is only worth something if its limits are printed on the box. These are SealRun's.
SealRun proves
- Integrity — the files and journal you check today are bit-for-bit the ones that were sealed.
- Order & completeness* — journal entries happened in this sequence, chained one to the next.
- Existence by a point in time — once anchored, that exact journal head existed no later than that block.
- Approval — the manifest and the anchor carry signatures from the keys that approved them.
SealRun does not prove
- Truthfulness — a sealed journal faithfully proves what was recorded, not that the recorded claims were true.
- That the AI behaved well — it proves what ran and what was logged; judging the work is still on you.
- Safety on its own — verification is one layer. Sandboxing, permissions, and review still matter.
- Mainnet readiness — real-money anchoring stays gated until independent review is done.
* One known residual, documented in the repo: without an external checkpoint or anchor, a journal cache cut back to an older, internally-valid prefix can't be detected locally. Anchoring — or comparing against a checkpoint you trust — is what closes that gap.
Try it
Free, open source, runs on your machine
SealRun is free while it's in research preview — the goal right now is independent testing, not sales. It runs locally with zero third-party dependencies; the only network step is the optional anchor.
$ git clone https://github.com/RobGanon/bsv-ai-security.git
Then follow the README in the repo for the step-by-step walkthrough — including the full anchor signing ceremony, written so independent testers can run it themselves and check every step. Launch flow v2 is merged and covered by the project's own functional and adversarial test suite; your own testing on a real machine is exactly what's wanted next.
Status & review
Read this before you rely on it
Research preview — not yet independently reviewed
SealRun works today and has been dogfooded end-to-end on real sessions — sealed, verified, and anchored on testnet — but no independent human review has been completed yet, and mainnet (real-money) anchoring is deliberately gated until that review happens, or the maintainer consciously decides otherwise.
Use it now for testing, self-attestation, and low-stakes records. Don't treat it as strong evidence for anything that matters until the review lands.
Want to help close that gap? Independent reviewers and testers are actively wanted. The review request, scope, and step-by-step tester instructions live in Issue #4 on GitHub — helpers who approve are credited in the repo, under the name or handle they choose.
Questions
The short answers
Do I need Bitcoin or BSV to use SealRun?
No. Verification, launching, and journaling are entirely local and need no cryptocurrency at all. BSV only enters at the optional anchoring step — and by default that's testnet, which uses free test coins, not real money.
How is this different from a normal log file?
A normal log can be edited after the fact and the edit is invisible. SealRun's journal chains every entry to the one before it with a cryptographic hash, so an edit breaks the chain and shows up the moment anyone verifies it. And unlike a plain log, SealRun also checks the session before it runs — a log only tells you what already happened.
Can the AI forge its own approval or anchor?
That's exactly what the signing ceremony is designed to prevent. The AI prepares an unsigned anchor transaction; a human reviews the decoded transaction — payload, destination, fee, chain position — and approves it outside the AI's reach. The key lives behind that human gate, and a tampered transaction is refused before signing. Tamper tests of that flow have been run and passed on testnet.
Is SealRun part of something bigger?
It's the security module of a planned three-part platform built on one verification foundation: AI Identity, AI Security (SealRun), and AI Power Management (aispm — a kill switch for AI that goes bad). The build order is deliberate: finish and independently review the verification foundation first, then identity, then power management. SealRun is the piece that exists today.
What does it cost?
Nothing, for now. It's kept free to encourage independent testing and use. If it later earns money, the plan is to keep the end-user BSV cost of anchoring as low as possible — but that's a decision for after it works and has been reviewed, not before.