system design

A chain of custody for AI-written code

Axyvera turns a coding session into a tamper-evident record and a signed, offline-verifiable bundle. Every stage runs locally, and redaction comes before anything is stored.

chain of custodylocal · on your machine
  1. 01

    Capture

    adapter event

    An adapter hooks your Claude Code or Codex session and records what the agent does — labelled adapter-reported, never observed.

  2. 02

    Redact

    before persistence

    Raw prompts, hook payloads, secrets, and transcripts are stripped before anything is written. Redaction happens first, always.

  3. 03

    Canonicalize

    canonical JSON

    Each event is normalised to a deterministic form, so it hashes to the same bytes on every machine.

  4. 04

    Chain

    sha256 link

    The event is appended to a hash chain; its digest folds in the digest before it. One altered byte breaks the chain.

  5. 05

    Seal

    .axy · ed25519

    On export, the chain, its manifest, and an honest coverage claim are signed into one portable bundle.

  6. 06

    Verify

    free · offline

    Anyone checks the bundle with the free verifier — signature, content, and coverage reported separately. No server, ever.

the chaining rule

digest(n) = sha256( digest(n-1) ‖   canonical(event(n)) )

Because each digest folds in the one before it, the chain only verifies if every link agrees. Edit a byte, reorder an event, or truncate the tail and verification fails — loudly.

Ends in a seal

The bundle is signed once and stands on its own. Whoever receives it verifies offline — no trust in the producer required.

No server

There is nothing to phone home to. Capture, sealing, and verification all happen on your machine.

No telemetry

Axyvera does not collect usage data. The only network in the whole product is the one you already use with your agent.

No raw content

Redaction before persistence means prompts and secrets are never written down in the first place.

the parts

Six components, one clear job each

Each unit does one thing, communicates through a defined boundary, and can be reasoned about on its own.

Adapter

captures the session

Records what an agent does within its declared capabilities. Evidence is adapter-reported — the system never claims to have observed what it only received.

depends on: the agent's hooks / exec

Redaction engine

strips before persistence

Runs before any write. Raw prompts, payloads, secrets, and transcripts never reach disk — not the vault, not a log, not us.

depends on: nothing external

Canonical stream

hashes the record

Normalises each event and appends it to a hash chain. Deterministic bytes in, one digest out, chained to the last.

depends on: the redaction output

Bundle signer

seals the evidence

Packs the chain, manifest, and honest coverage into a .axy file and signs it with Ed25519. Self-contained and portable.

depends on: a private signing key

Verifier

checks without trust

Free and license-independent. Reports structure, content, signature, signer trust, and coverage — separately, so nothing is conflated.

depends on: only the bundle

CLI

drives all of it

One local command surface for capture, export, verification, and recovery. No activation server to phone.

depends on: your machine
The trust & privacy modelInside a .axy bundle →