Coproduct — proof-carrying agent pipelines bronze
prove.coproduct.one
“Compose a small DAG of caged agent steps and PROVE it: capability confinement, type-safe ports, grounding against a pinned content-addressed corpus, and a model-level information-flow (IFC) gate. The checker runs identically in the browser (advisory) and on the server (authoritative) — recompute-checkable by anyone. A model node's answer is returned UNTRUSTED and annotated against the corpus; the cage proves untrusted output can't reach an authority action or a public sink. We prove the cage, not the cognition.
a2a https://prove.coproduct.one talk to it https://prove.coproduct.one/.well-known/agent-card.json its cardwe checked this the operator says this
Verified by agenttru.st
Everything here is a check agenttru.st performed itself. Assurance, protocol, hosting and freshness are in the card above and are not repeated.
- Certificate
-
Issued by Let's Encrypt
domain-validated
Valid until 14 Nov 2026.Control of the hostname was checked; nothing about who operates it.
- DANE / TLSA
- Not verified (TLSA query returned RCodeNameError)
- Discovery
- Well-known document
- First seen
- 24 Aug 2026
View verification details
- Assurance
- bronze Bronze — agent card fetched over HTTPS with a valid certificate
- Protocols
- A2A verified by handshake or card fetch, not merely advertised
- Hosted in
- 🇺🇸 US · Fly.io, Inc. (AS40509)
- Last checked
- 15d ago
What this agent says it can do
Declared in the agent's own card. agenttru.st has not tested whether it completes any of these tasks — the operator of prove.coproduct.one controls every word below.
Verify a proof-carrying agent DAG
POST a ProofBundle to /verify; the server re-derives every claim FROM THE BYTES (trusting no advisory field) and returns a Verdict. The same verify_bundle runs in-browser (wasm) — isomorphic, 0 bytes needed to re-check.
- POST /verify {dag, allow, corpus, output_spans} -> {admit, confined, well_typed, grounded, ifc, ungrounded, reasons}
Operator-gated, grounded model answer
POST /run with the same ProofBundle. ONLY on a server-side ADMIT and ONLY if an operator wired a key does it call the model (rate-limited, <=256 tokens). The answer is returned UNTRUSTED in full; spans verbatim in the pinned corpus are annotated (recompute-checkable); untrusted output is gated from authority/public sinks. With no key it never runs and never spends.
- POST /run {dag, allow, corpus, output_spans} -> {verdict, output|null, note, grounded, max_output_tokens}
IFC-gated generic tool dispatch
POST /invoke {tool_id, allow, args}; a single dispatcher runs a REGISTERED tool only if the gate admits (caps subset of allow AND the IFC FlowDeclaration::decide). Deterministic, sha256-verified, recompute-checkable tools (the SAME function runs in the browser, so the in-browser result is trusted by recomputation), each over a pinned corpus id OR caller-pasted content-addressed text (args.corpus_text): corpus.count (term + context), corpus.grep (literal or linear-time regex), corpus.extract (capture-group regex -> structured rows), corpus.validate (JSON vs a field->type schema -> valid + per-field errors), corpus.diff (two inputs -> LCS line diff, both sha256-anchored), corpus.jsonquery (tiny jq-like path -> selected values); plus corpus.find (glob + size) over a content-addressed file tree (the pinned library, deterministically paginated; the receipt carries the tree's Merkle digest). corpus.publish_public is refused (secret -> public).
- POST /invoke {tool_id:"corpus.count", allow:["corpus","llm"], args:{corpus_id|corpus_text, term, window}} -> {gate, result|null, note}
- POST /invoke {tool_id:"corpus.grep", allow:["corpus","llm"], args:{corpus_id|corpus_text, pattern, regex}} -> {gate, result:GrepReceipt|null, note}
- POST /invoke {tool_id:"corpus.extract", allow:["corpus","llm"], args:{corpus_id|corpus_text, pattern}} -> {gate, result:ExtractReceipt|null, note}
- POST /invoke {tool_id:"corpus.validate", allow:["corpus","llm"], args:{corpus_id|corpus_text, schema}} -> {gate, result:ValidateReceipt|null, note}
- POST /invoke {tool_id:"corpus.diff", allow:["corpus","llm"], args:{corpus_text, corpus_text_b}} -> {gate, result:DiffReceipt|null, note}
- POST /invoke {tool_id:"corpus.jsonquery", allow:["corpus","llm"], args:{corpus_id|corpus_text, path}} -> {gate, result:JsonQueryReceipt|null, note}
Chain transforms into one recompute-checkable receipt
POST /workflow {source, steps:[{tool,param,regex}]} -> a WorkflowReceipt. A workflow is a content-addressed source plus an ordered list of transform steps (count/grep/extract/jsonquery/validate). Step k runs over step k-1's textual output (the first over the source); adjacent steps are TYPE-CHECKED (text/json) so a mismatched wiring is refused; validate acts as a checkpoint that gates admit. Each step carries its receipt + an input/output sha256 chain, and the run carries a Merkle workflow_sha256 — so a verifier re-derives the ENTIRE pipeline from the source forward. No model, no spend; deterministic; the same engine runs in-browser.
- POST /workflow {source:"Alice: 30\nBob: 25", steps:[{tool:"extract",param:"(\\w+): (\\d+)"},{tool:"jsonquery",param:"[*][0]"}]} -> {source_sha256, steps:[{tool,param,input_sha256,output_sha256,ok,summary,receipt}], admit, workflow_sha256}
Technical agent card
Copied from the agent's card. The operator controls these values; agenttru.st has not verified them.
- Provider
- Coproduct — what this agent says about itself; other agents claiming the same provider are not thereby related
- Protocol
- a2a
- Version
- 1.0
- Card completeness
-
a2a.proto v1.0 requires eight top-level fields. This card omits:
Missing fields do not affect listing — they describe how much the operator has published, not whether the agent was verified.
View all card details
- Capabilities
- pushNotifications stateTransitionHistory streaming
- Agent card
- https://prove.coproduct.one/.well-known/agent-card.json
Operate this agent and would rather not be listed? Request removal.