v0.8 — open-source launch candidate Apache-2.0 TCP for AI agents

Agents drift.
Veripoint rewinds.

A protocol layer between your agent and its work: every chunk verified by hard gates before it commits, proven progress kept in a ledger outside the model's memory, and a clean restart when context drifts.

$ pip install veripoint

Python ≥3.10 · zero runtime dependencies · nothing leaves your machine

Read the docs → github.com/feruzkarimovv/veripoint

157 tests guard the ledger hash-chained SQLite MCP-native tools async DAG execution budget caps fail closed

veripoint serve --root .veripoint · session ses_b2d41ed749ad · q3-report

chain: verified

veripoint log — event stream

watching ledger…

sqlite3 .veripoint/veripoint.db — plain SQLite, audit with standard tools live replay · pauses on hover

25/25runs recovered
correct under veripoint

baseline20/25 shipped silently wrong · exit code 0

under veripoint25/25 recovered correct output

the gate0 wrong outputs ever accepted

deterministic micro-benchmark · five silent-defect scenarios × five seeds · scripted agents, so this measures protocol mechanics, not model quality methodology ↗

fig. 02mechanism

The loop a poisoned context can't win.

TCP doesn't trust the wire. Veripoint doesn't trust the model.

Errors that persist in an agent's memory degrade downstream performance by ~39%. So progress lives outside the model, in a ledger it cannot edit, gated by proofs it cannot flatter. Every restart begins from facts, never from history.

the attempt cycle · one slot

verified path rejection & recovery attempt lifecycle

save

Every accepted chunk becomes a checkpoint in a SHA-256 hash-chained SQLite ledger: workspace snapshot, facts, evidence. Tamper-evident, auditable with standard tools, and yours. Not the model's.

verify

Code that runs, tests that pass, numbers that reconcile, files that contain what they claim. Crashes, timeouts, unreadable artifacts: all rejections. Unverifiable work is rejected work.

rewind

Restore the last verified snapshot, quarantine the failed approach as known-bad, brief a fresh agent from compiled clean notes. Mistakes are remembered as lessons, not inherited as truths.

fig. 03evidence

Same agent. Same bug. Two endings.

The bug never left. Only one run noticed.

A scripted agent silently drops refund rows while computing a quarterly report. The baseline ships inflated numbers with a smile; under Veripoint, the same poison is caught at the gate.

baseline.py

$15,850≠$15,420

reproduce offline: make demo 157 tests guard these semantics exit code 0 ≠ correct output

fig. 04console

Every run leaves evidence.

veripoint serve: a dashboard over your own ledger, on localhost.

Zero dependencies. Timeline, gates, spend, click-to-rewind. Below is the real q3-report session, rendered from its actual ledger rows.

agent reliability console

chain: verified 14:02:11

3verified chunks

2rejected chunks

3checkpoints

1rewind

1known-bad

$0.0000est spend

timeline — newest first

#16 checkpoint.createdslot 2 → cp_fad44b7db595 · REPORT.md verified

#15 verification.finishedfiles_exist:ok · reconcile:ok · content:ok · command:ok

#14 chunk.proposedcomputed net=$15,420, refunds applied 4/4

#13 quarantine.updatedreconcile|'all refunds applied' · hit 2

#10 rewind.performedattempt budget → cp_d5691b414766 + clean notes

#9 chunk.rejected[reconcile] failed reconciliation checks ['all refunds applied']

#7 verification.finishedfiles_exist:ok · reconcile:FAIL (2/4 refunds) · content:ok

#6 chunk.proposedcomputed net=$15,850, refunds applied 2/4

#4 checkpoint.createdslot 0 → cp_d5691b414766 · sources fetched

checkpoints — click to rewind

cp_fad44b7db595slot 2 · report · 2 files

cp_021ce1d727b8slot 1 · compute · metrics.json

cp_d5691b414766slot 0 · fetch · revenue.json + refunds.json

quarantine — known-bad

reconcile|failed reconciliation checks ['all refunds applied']×2. Partial refund reads are poison here.

# Veripoint BRIEFING — q3-report GOAL: Produce the Q3 net-revenue report… ## VERIFIED PROGRESS - [step 0] fetch sources — revenue.json, refunds.json | files: 2 - [step 1] compute totals — net=$15,420 reconciled | data: {net, gross} ## KEY FACTS (asserted by verified chunks) - total_net = 15420 (step 1) ## KNOWN-BAD APPROACHES (do NOT repeat) - reconcile|'all refunds applied' — failed 2x. Reason: stale cursor drops rows ## YOUR TASK (attempt 3)

Click a checkpoint to rewind.History is never rewritten: restoring files and logging the event is all a rewind does.
Facts are verified-only.Key facts enter the ledger only through accepted chunks, and are invalidated when you rewind past them.
Briefings compile from accepted history.Verified progress, known-bad approaches, prior failure reasons. Raw transcripts never return.
Spend is on the record.Every attempt's tokens are priced (rejected attempts included), with hard caps that refuse further work.

audit with standard tools

$ sqlite3 .veripoint/veripoint.db ".tables"
events    chunks     verdicts   checkpoints
sessions  artifacts  quarantines facts

$ veripoint doctor
hash-chain OK · 31 events recomputed
integrity_check ok · blobs present

No cloud, no daemon, no telemetry. Snapshots are plain tar.gz you can open with tar.

fig. 05position

What the protocol layer adds.

Good tools exist. None of them own these semantics.

Durability, orchestration, observation: solved problems. Whether work was correct before it commits is not, and Veripoint composes cleanly with the tools that do those jobs.

Capability	Framework checkpointing¹	Durable execution²	CI evals³	Veripoint
Verify work before accepting it	✕replays state as-is	◐retries on crashes, not wrong answers	✕observes after the fact	✓hard gates · fail closed
Roll back poisoned progress automatically	✕history travels forward	✕crash-safe ≠ mistake-safe	✕alerts don't roll back	✓rewind to last verified save
Restarts briefed from distilled facts	✕raw transcript replay	✕out of scope	✕	✓clean-notes compiler
Framework-neutral across agents	◐in-framework state	◐workflow-coupled	✓	✓one method: propose()
Spend bounded mid-run	✕	◐timeouts, not budgets	✕	✓token + USD caps fail closed
Tamper-evident audit history	✕	◐durable, not verifiable	✕	✓SHA-256 chain + veripoint doctor

¹ In-framework checkpoint/replay (e.g. LangGraph checkpointer) · ² Durable workflow execution (e.g. Temporal, DBOS) · ³ Evals and monitors in CI pipelines
Fair fight: durable execution composes with Veripoint: exactly-once side effects AND only-verified commits.

fig. 06limits

Stated plainly.

What Veripoint will not pretend to do.

Not an orchestrator.Your stack keeps doing orchestration; Veripoint owns truth. It wraps agent loops; it doesn't replace them.

Not safety theater.Only provable properties pass gates. If work can't be checked, it's rejected, never graded on vibes.

Not self-weakening.Gates are operator-authored in a job file the agent cannot edit. Acceptance criteria can't be quietly relaxed mid-run.

Not cloud-required.Ledger, snapshots and gates run fully offline. There is no phone-home to disable, because there is none.

Not a model-quality fix.Veripoint catches silent defects; it can't make a weak model smart. Garbage in gets rejected out. Loudly.

Not silently wrong.If verification can't be satisfied within budget, the session ends FAILED with evidence. Never a plausible wrong answer.

POSIX-first in v1 (Windows via WSL) Python ≥3.10 zero runtime dependencies snapshots are plain tar.gz

fig. 07terms

Free where it matters.

Free isn't a tier here. It's the license.

The engine is Apache-2.0 and stays free. Local-first by construction, the core product can't be paywalled away from you.

Open source

$0forever · Apache-2.0

The full protocol, not a teaser tier. Everything on this page ships in the repo today.

Engine, CLI, and the local dashboard
All gates, drivers & gate packs
Hash-chained SQLite ledger · snapshot time machine
MCP server for Claude Code / Cursor

Get started Star on GitHub ↗

Cloud Sync

plannedprivate beta · no date promised

Read-only shared audit views and team visibility. Your ledger never leaves your machine until you run veripoint share — cloud is additive, opt-in, and revocable.

Shareable verified audit links
Team dashboards & alerting
Opt-in managed ledger storage

Watch releases ↗

Local is free forever: no account, no telemetry, nothing leaves your machine.

Running fleets of long-horizon agents? Open a discussion: VPC control plane, custom verifiers, policy review.

Make hour three as trustworthy as minute one.

Clone it, break your agent on purpose, watch the gate catch it. Ten minutes, fully offline.

See it catch a poisoned run ↑ Read the docs