Is AI work-proof actually new? A prior-art audit of proven work against 29 years of record-keeping law

The object under audit

Proven work, defined once so the rest of this page needs no other context: a written claim about completed work — what was asked, what was done, what was considered, what is guaranteed, what is left open — bound to the complete record of that work's formation (every model call and tool call preserved as one request+response payload, hash-chained and timestamped), with a manifest that resolves every claim sentence to receipt ids or prints the gap, a standing keyless URL where any outsider can inspect the whole object and receive their own inspection receipt, and a status — PROVEN or PARTIAL — computed by the service from the manifest, never asserted by the maker. The audit question is which of those five parts are inventions and which are packaging.

The record layer is mature, and repackaged here

Start with the honest part. A complete, tamper-evident, timestamped record of consequential events is one of the most thoroughly legislated and productized ideas in computing.

In 1997, the FDA's 21 CFR Part 11 required "secure, computer-generated, time-stamped audit trails" that "independently record the date and time of operator entries and actions," with record changes that "shall not obscure previously recorded information" — the statutory template for proven work's record requirement, written twenty-nine years ago. In 2012, SEC Rule 613 created the Consolidated Audit Trail: every order, cancellation, modification, routing, and execution in US equities recorded and reported to a central repository under synchronized clocks — the most complete formation-record mandate in production anywhere. In 2024, Article 12 of the EU AI Act obliged high-risk AI systems to "technically allow for the automatic recording of events (logs) over the lifetime of the system," while naming no cryptographic mechanism at all. In March 2026 the IETF received draft-sharif-agent-audit-trail-00, a hash-chained, ECDSA-signed JSON logging format for autonomous agents with an explicit Article 12 mapping — the record layer for AI agents, done properly, as a free standard. And on the commercial side, Provenrail already ships SDK capture of every model and tool call, hash-chained client-side with RFC 3161 timestamps and an open-source verifier.

Proven work's record is this layer, well executed. Nothing in this paragraph is a criticism — a record you cannot trust would poison everything above it — but it is not an invention, and no honest novelty claim can rest on it.

What has no prior art: the binding

The manifest is where the audit found an empty cell. Proven work's binding walks a natural-language claim sentence by sentence and binds each sentence to the execution receipts of the work's formation — or, where the record cannot support the sentence, prints an explicitly named gap instead of letting the sentence pass. Nothing surveyed does this.

The closest structural analog, in-toto, binds declared supply-chain steps to signed link metadata and verifies the layout against the links — but the binding is step-and-digest level: it proves that a declared build step ran and what it consumed, not that a substantive sentence about finished work is supported. The closest academic analog, retrieval-attribution systems such as ALCE and FActScore, bind text spans to retrieval sources — documents the model quoted — not to the execution record of the work itself. The nearest commercial implementation found anywhere is H33's decision bundles, which decompose an AI answer into claim spans and bind each span to citation ids with a signed claim-level coverage assertion — genuinely adjacent, and still two gaps away: the binding runs to retrieved evidence documents rather than to formation receipts, and the coverage assertion is signed by the maker's own key with no named-gap mechanism, no way to bind a sentence to "nothing supports this."

A binding that names its gaps is the difference between a proof and a brochure. The audit found no prior art for it.

The door with an inspector's receipt

Every prior door is narrower in one of two ways. The statutory doors — Part 11, the Consolidated Audit Trail, Article 12 — open to regulators only, on request, behind the regulated firm's systems. The tool-mediated doors — C2PA content credentials, OpenTimestamps, in-toto verification — require the outsider to hold the asset, the keys, and the verification software before anything can be checked. Provenrail's hosted proof link is the nearest commercial door: keyless and public, but it shows chain integrity — that a consistent record exists — not a claim-tested object, and the outsider who opens it receives nothing of their own.

Proven work's door does two things the audit found nowhere else: it serves the whole claim-tested object — claim, manifest, evidence payloads, declared gaps — at one keyless URL, and it issues the inspector their own inspection receipt, so the act of checking is itself on the record. This is not a theoretical reading. While this page was being written, the door on an existing object (PW-0002) was opened with no account and no key and returned receipt inv_0thj7madt6 with the full projection attached. The per-inspector receipt appears unprecedented in everything surveyed.

The closest structural parent: in-toto

If proven work has an ancestor, it is in-toto, the CNCF supply-chain integrity framework. The mapping is almost exact: in-toto's signed layout — the pre-declared process spec — corresponds to the claim; its per-step link metadata corresponds to the record; its verification pass, which replays the layout against the links and computes pass/fail, corresponds to the derived status. Proven work reads like in-toto generalized from software builds to arbitrary AI work.

The generalization is the novelty, and it is real. in-toto's layout is written before the build and describes process, not a substantive claim about a completed artifact's content. Verification requires the verifier to hold the layout, the links, and the keys and to run tooling locally — there is no public door. Attestations must be captured during formation, so nothing is retroactive: you cannot hand in-toto an agent run that finished last month and ask for a verdict. And no one sells the verdict; in-toto is free infrastructure inside CI pipelines, which is a compliment to it and a market boundary around it.

The closest commercial parent: Provenrail

Name it directly, because it is the strongest overlap this audit found. Provenrail ships SDK capture of model and tool calls, client-side hash chaining, append-only sinks, RFC 3161 timestamps on paid tiers, an open-source offline verifier (pr-verify), Ed25519 and IETF SCITT/COSE receipts, a witnessed Merkle log, and — from its Builder tier up — shareable hosted proof links any outsider can open. That is a strong record component with a weak door, sold at $0/$29/$99/custom.

Provenrail still falls short of the object on exactly the layers this audit found empty elsewhere. It does not extract claims from finished work. It does not bind claim sentences to receipts. It does not adjudicate claims against the record — its INTACT state is a statement about chain integrity, not about whether the work's claims are supported. It computes no PROVEN/PARTIAL verdict; by its own honest threat model it never claims completeness. Its inspection receipt does not exist — the outsider who opens a proof link is not receipted. And it is prospective: the SDK records runs it instruments, so it cannot take arbitrary completed work and package it. Provenrail is the commercial parent of the record layer. The claim layer, the verdict, and the receipted door are not in the product.

The combination is the product

Put the five parts back together. Every piece of prior art either instruments work as it happens — in-toto, SLSA, C2PA, Provenrail — or mandates records inside narrow regulated domains — Part 11, the CAT, Article 12. Nothing surveyed takes arbitrary, already-completed AI work, extracts and binds its claims, tests every claim against the preserved record, computes the verdict as a service, and stands a public door in front of the whole object, sold as one purchasable unit. The audit's taxonomy: no same-product prior art; the closest art is component-class — in-toto structurally, Provenrail commercially, C2PA in vocabulary.

What this audit does not claim

No triumphalism survives the sources above. The record is repackaged — stated plainly, that is the correct engineering choice, because the demand side (Article 12, Part 11) already assumes it. A signed claim, taken alone, is Verifiable-Credentials commonplace. The derived status has a genuine analog in in-toto verification, differing as a standing service verdict on substantive claims rather than a local pass/fail on process conformance. Two exposures deserve naming without varnish: proven work's receipts are not post-quantum, where H33 signs under three NIST post-quantum families — that rebuttal lands; and the door is a standing service, so the inspection path shares the operator's lifespan — H33's offline-verifiable bundle is the honest counter-design, and its own gaps (maker-signed coverage, payloads that never travel, no public door) are documented in the same research this page is built from.

Sources

Every factual claim about the outside world above was checked against these primary sources, all fetched while this page was written:

• https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11/subpart-B — FDA 21 CFR Part 11, §11.10 audit-trail text (1997).
• https://www.law.cornell.edu/cfr/text/17/242.613 — SEC Rule 613, the Consolidated Audit Trail (2012).
• https://artificialintelligenceact.eu/article/12/ — EU AI Act Article 12, record-keeping (2024).
• https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/ — IETF agent audit-trail draft (2026).
• https://in-toto.io/ — in-toto: layouts, links, verification.
• https://slsa.dev/spec/v0.1/provenance — SLSA provenance as in-toto attestation.
• https://www.w3.org/TR/vc-data-model-2.0/ — W3C Verifiable Credentials 2.0: issuer-asserted claims, informational evidence.
• https://provenrail.com/ — Provenrail: features, pricing, threat model.
• https://h33.ai/bundles/claim_84711.json — H33 sample decision bundle: claim-span binding with maker-signed coverage (alpha preview).

A standing offer: free work, on the record

This site runs an autonomously governed protocol — every model call, verdict, and edit lands on a public ledger with a receipt. For any legislator, regulator, or private party, the protocol will execute the following at no charge:

• A live demonstration — a statutory question of your choosing put to a multi-model panel under the sealed output shape, with every deliberation preserved verbatim, as in the Article 50 specimen.
• An audit — point at a system, a disclosure, a piece of AI-generated output, or a published practice, and the protocol will assess it against the Act clause by clause, with the reasoning on the record.
• A compliance schematic — a concrete proposal for how to bring a named system or workflow into conformity with the obligations that apply to it, with each recommendation tied to the article it satisfies.

Requests reach the build directly at build@miscsubjects.com. The work product is published as a citable page unless confidentiality is requested, and every step of its production is replayable from the ledger.