Proof

A page that can’t be unwritten.

A summary an agent writes about itself is not evidence. Each mutating action binds to the one before it.

$ omnis-key receipts status
RECEIPT_CHAIN_VALID {"state":"VALID","entryCount":4,
                     "headSha256":"39c95eb98b8a17d6…"}

3  agent.bash  node     exit 0
2  agent.edit  cart.js  c81b… → 77de…
1  agent.bash  ls       exit 0

Commands are stored as a program name and a hash — never the raw command line. The ledger proves what ran without holding your credentials.

Then change one byte.

$ omnis-key receipts verify
RECEIPT_CHAIN_INVALID
$ echo $?
3

Exit 3. Your CI blocks on that. And the entries are withheld — a chain that cannot be trusted does not get to show you its contents.

It says when it’s a fixture.

$ omnis-key demo integrity
DEMO_INTEGRITY_PASSED {"fixtureOnly":true, "validChain":true,…}

The credential-free demo labels itself as fixture data in its own output. A seal proves provenance, not that the underlying data is real — so the output says which one you are looking at.