Containment Receipts: Offline-Verifiable Evidence for AI Agent Sandbox Compliance

The distinction between “no violation was observed” and “we have evidence that the entire run was observed” is useful and well operationalized. The explicit coverage checks are highly efficient, adding only fractions of a millisecond to the offline verification time.

The coverage-vs-presence distinction is compelling, but the experimental baseline seems too weak to establish how much CoRe itself contributes. The “presence-only” verifier treats the existence of events as evidence availability, so it predictably fails on scenarios constructed around observation gaps. A stronger comparison would be against a realistic audit pipeline that already tracks collector health, sequence numbers, heartbeats, or known logging gaps. If explicit coverage metadata still produces a meaningful improvement over that baseline, the result would say much more about CoRe’s practical value rather than demonstrating that explicit coverage beats an intentionally coverage-unaware verifier.

Quite similar to many other projects in this sprint. I think the emphasis on offline verifiability is a bit overstated - it's just a cryptographic signature on the verification output, nothing that intrinsticly ties it cryptographically to the compliance status to serve as a proof for example - you still need to trust the verifier, just not to query it online.

The writing was ok overall, but the inclusion of references to specific phases throughout the code and paper was distracting and unnecessary. It's also a tell-tale sign of AI writing.

I think the question this project asks is interesting: did we log an agent run well enough for an investigator to assess it? The project creates signed receipts that summarize what was logged and whether monitoring had gaps. The report also explains an important limitation clearly: a signed, internally consistent account can still be false.

This could be a promising tool for checking whether an evaluation’s logs are complete enough to judge if an agent followed the rules, rather than proving that an agent stayed contained. The next question is whether it remains useful when another team collects the evidence under less controlled conditions. I would test whether it catches gaps that ordinary logging misses, without making legitimate evaluations too difficult to assess. This would help establish whether the extra assurance justifies the effort of producing and checking these receipts.