# Homepage Source: https://www.primust.com/ HTML title: Primust — Governance receipts for every agent run Meta description: Signed, tamper-evident receipts of every AI agent run — mapped to the controls, policies, and frameworks your organization already uses. Works with Claude Code, Cursor, OpenAI, Anthropic, LangGraph, CrewAI, and every major agent framework. § 01 — Proof layer # Governance receipts for every agent run. Signed, tamper-evident, verifiable by anyone. A cryptographic record of every AI agent run — mapped to the controls, policies, and frameworks your organization already uses. Send your auditors and enterprise buyers a verifiable link instead of screenshots and PDFs. Book a demo Verify a sample receipt Instrument AI Agents → Govern Coding Agents → View the Artifact Model → Every agent. Every framework. Every model. The ones you build, the ones you buy, and everything in between — including: Claude Code Cursor LangGraph OpenAI Agents SDK Microsoft Agent Framework Google ADK AWS Strands CrewAI Pydantic AI LlamaIndex AI agent sessions Record tool calls, policy gates, blocked attempts, and run boundaries. Coding-agent changes Bind file edits, bash commands, PR review, and policy outcomes to one artifact. Open verification Use the Apache-2.0 verifier without calling Primust. VPEC · Coding Agent Session signed offline VPEC ID vpec_b135298a...c7bf6 Run ID run_629312ff5174409c Workflow df40d664...17b8b Surface Claude Code Bundle agent_change_review_v2 Proof floor Execution Proof coverage 92% provable Issuer kid_live_2026_01 Credential hash sha256:0c31...9a4f Proof coverage 92% provable · floor: Execution Mathematical 24 % Verified 18 % Execution 50 % Gaps 8 % Recorded 16 Governed 13 Blocked 2 Open gaps 3 Evidence bound Commit root sha256:6fa27160...bc760 Policy sha256:c8cb744d...10960 Timestamp RFC 3161 · digicert_us Verifier key kid_live_2026_01 Checks Presidio ok Gitleaks ok Semgrep high Unit tests pass Diff hash bound Tool boundary gap Run trace 00:00 start Claude Code session 00:05 test npm test passed 00:08 gate semgrep high finding Gaps declared SEM-012 unsafe redirect high G-017 tool visibility open Signature valid Timestamp witnessed Policy pack matched Content commitments only Ed25519 · RFC 3161 · sha256 commitments Full artifact model on Product Start with the governance question you need to answer. Map the obligation, choose the checks, record the run, then hand over a verifier-readable artifact. Governance Mapping Compile obligations into control plans, map controls to evidence, and keep the review boundary explicit. Check Integrations Use built-in checks, policy engines, detectors, SDK/OpenTelemetry paths, API-backed checks, or your own check logic. Runtime Evidence Capture agent sessions, model calls, policy gates, blocked actions, human approvals, and coding-agent changes as they happen. Verified Inference A future assurance path for binding model identity, prompts, retrieval, tools, environment, and outputs. § 02 — What you get ## One evidence layer for _maps, checks, runs, and proof levels._ Primust does not replace your policy engine, detector stack, dashboard, or enforcement layer. It binds what they did into evidence another party can verify later. Governance maps Applicability snapshots compile into obligation and control plans, so each evidence record points back to the governance requirement it supports. Check execution Built-in checks, policy engines, detectors, SDK adapters, OpenTelemetry traces, external services, and custom checks all land in one evidence model. Signed credentials Every governed run becomes a portable VPEC with committed inputs, outputs, controls, proof levels, timestamps, and gaps. Assurance ladder Run evidence is the start. Human review, linked VPECs, deterministic checks, and future verified-inference paths can support stronger claims where the evidence allows. § 03 — How it works ## Map. Wire. Record. Verify. _One artifact model._ At the top level: turn governance requirements into runtime checks, then issue evidence that survives outside the original system. Map the obligation Select the framework, regulation, or internal policy. Primust compiles the applicable obligations and control plan. Choose the checks Install built-ins, policy engines, detectors, SDK adapters, OpenTelemetry, API-backed checks, or custom checks from your own stack. Record the run Agent actions, model calls, policy gates, human approvals, linked VPECs, and check results bind to committed inputs and outputs. Verify the artifact The VPEC declares the proof level, coverage, gaps, plan hashes, timestamps, and the evidence path used. § 04 — Inside the credential ## A VPEC shows _what ran, the proof floor it reached, and where the gaps remain._ The artifact can leave your system and still answer the review question later: what happened, what was proven, and what stayed outside the proof. VPEC · Credential Anatomy signed content-blind VPEC ID vpec_refund_04b7 Workflow refund_agent.review Request order_9F2 · $184 refund Agent support-agent@v4 Proof floor Execution Surface 0.84 Bundle refund_policy_v3 Issuer kid_live_2026_01 Proof coverage 84% provable · floor: Execution Execution 84% Declared gap 16% Run evidence captured 01 Customer asks input committed A buyer asks for a refund after a delayed shipment. 02 Agent checks 3 tool calls The agent calls order lookup, refund policy, and risk-score tools. 03 Policy gates 2 gates passed Delay verified, amount below threshold, no fraud hold. 04 Outcome signed result Refund approved. Raw customer text stays outside the credential. Control evidence order.lookup executed refund_policy_v3 passed risk_hold_v2 passed approval.tool executed settlement gap Credential summary Committed request, tool inputs, tool outputs Controls refund_policy_v3, risk_hold_v2 Surface 84% provable Gap payment settlement is downstream Signature valid Timestamp witnessed Raw text not present Verifier offline Ed25519 · RFC 3161 · poseidon2 commitments verify offline What ran The refund agent invoked order lookup, refund policy, risk scoring, and an approval tool. The VPEC records the tool calls and committed inputs/outputs. What proof level was reached The workflow reached Execution proof for the declared tools and policy gates, without exposing raw customer text. Where the gaps remain The payment processor settlement happens downstream, so the credential records that boundary instead of pretending the whole refund lifecycle was proven. The verifier is open source. The format is portable. Review does not depend on a Primust dashboard being available when someone needs the evidence later. § 05 — AI Agents ## Instrument agent runs. _Verify the credential later._ Agent runtimes move faster than their review paths. After `primust init`, a Python startup hook records governed sessions while they happen and auto-activates in the path before the governed session starts — wrapping whichever supported framework you've imported (OpenAI Agents, LangGraph, CrewAI, LlamaIndex, DSPy, Haystack, LiteLLM, MCP, Bedrock, Strands, Google ADK, MSAF, Pydantic AI, Semantic Kernel, AG2, OTel). Every tool call, every policy gate, every blocked attempt lands in the VPEC — with no change to supported agent code. pipeline.py pip install primust · primust init # one-time setup $ pip install primust $ primust init # resolves key, detects 16 frameworks, wires hook   # your existing agent code — no imports, no wrapping, no changes import langgraph # or crewai, openai_agents, llamaindex, … graph. invoke (input_data) # every tool call, every gate is captured   # a signed, portable, offline-verifiable VPEC is emitted at the session boundary. OpenAI Agents SDK auto-detected on import LangGraph auto-detected on import Google ADK auto-detected on import Microsoft Agent Framework auto-detected on import Pydantic AI auto-detected on import Semantic Kernel auto-detected on import OpenTelemetry fallback — works with anything Custom @record_check decorator Full AI Agents spec → § 06 — Coding Agents ## Record coding-agent changes. _Make the session reviewable._ Install Primust before the session: when an agent edits files, runs commands, or opens a PR, the VPEC records what it touched, which policies gated the change, and exactly what was blocked. Without the hook, the git commit is only a diff. primust-hook is a Go binary. Per-invocation. Zero permanent state on developer machines. IT-deployable. Same governance applies whether the agent is running locally or in CI. Claude Code primust-hook · claude-code hooks + MCP bridge When primust-hook is installed, every tool call, file edit, and bash command is wrapped in a VPEC. IT-deployable. Cursor primust-hook · cursor background agents + composer hooks When primust-hook and the Cursor extension are installed, Composer edits, background-agent runs, and terminal commands emit VPECs. Example coding-agent VPEC PR #4721 needs review signed Claude Code can write the patch. Primust makes the review trail travel with the patch. The VPEC is the review handoff for one coding-agent PR: which files changed, which review tools scanned the exact diff, what they found, and why the merge gate stayed closed. 1 Agent patch Claude Code edits auth/session.ts and routes/oauth.ts, then opens PR #4721. 2 files changed 2 Required review CI runs npm test. Semgrep and Gitleaks scan the exact diff the agent produced. 3 checks run 3 Finding raised Semgrep flags an unsafe redirect in the changed auth code. The PR cannot auto-merge. 1 high finding 4 Signed proof Primust binds the agent run, diff hash, scanner versions, rule packs, and finding into one VPEC. signed VPEC Bound evidence Session sess_cc_92ab1 Diff commit poseidon2:c41a...d8e3 Scanner pack semgrep@1.69 · gitleaks@8.18 Command log npm test · exit 0 PR status merge blocked Issued 2026-04-07 20:36 UTC Reviewer receipt Not auto-approved. The patch is not just logged. The required code-review checks are bound to the exact agent diff, and the finding keeps the PR blocked. Changed auth/session.ts and routes/oauth.ts Reviewed by npm test, Semgrep, Gitleaks Finding unsafe redirect in changed auth code Result PR #4721 remains blocked Agent run Claude Code session id Diff hash exact patch reviewed Rule packs scanner versions bound Signature offline verification Gap ledger SEM-012 unsafe redirect high G-017 tool visibility boundary declared signature valid timestamp witnessed diff hash matched policy pack matched VPEC binds the agent session, diff hash, review checks, scanner rule packs, findings, and merge status. Ed25519 · RFC 3161 · poseidon2 Install primust-hook → Cursor extension → Full Coding Agents spec → § 07 — Who it is for ## The same credential answers different questions for _engineering, security, and compliance._ Engineering Add evidence to existing governed workflows without rebuilding them. Keep your frameworks, rule engines, and internal checks. Security Show that controls and policy gates actually ran without exposing the underlying content or trusting an agent-authored log stream. Compliance Hand another party a portable artifact they can verify independently instead of walking them through screenshots and self-attested records. § 08 — Honesty ## The product works because the claims are _narrow, explicit, and defensible._ Sufficiency Primust does not decide whether your declared controls are sufficient for a specific regulation, policy, or review standard. Completeness Primust does not claim the instrumented surface is the entire workflow. Anything outside the declared surface remains outside the credential. Correctness Primust proves that a scanner or check ran. It does not prove that the scanner was sufficient, complete, or substantively correct. Content quality Primust does not inspect the governed content itself. It records commitments and execution evidence around the workflow. This is not disclaimer language. It is the boundary that makes the evidence credible. ## Verify a sample._Then decide if you want to issue your own._ Start with the hosted verifier or go directly to the sandbox. The product decision should come after you have seen the artifact and its limits clearly. Verify a sample VPEC Get sandbox key