Don't trust the AI.

GRASP keeps the receipt for an AI decision. Three tamper-evident records, chained together: what it decided, what it believed when it decided, and proof of every claim it made.

None of the cryptography is new. GRASP is a recombination of primitives you already trust — hash chains, digital signatures, and public timestamping — assembled so a skeptic can independently confirm or refute the record without trusting us.

We say this openly: the parts are known. The moat is the composition — and that you can break it yourself.

Every AI call goes through one stable interface that routes to whichever provider you choose — or a local open-weight model. By default, calls route through non-Anthropic providers, proven live on more than one machine.

When a provider is rate-limited or briefly unavailable, a sentinel catches the error, records a cooldown, and re-routes to the next provider. You get a successful answer and never see the failover.

Boundary: sovereignty is a property of the substrate — the layer that runs the models. The interactive coding harness itself runs on Anthropic; we don't pretend otherwise. Shipped

A belief recorded under one model reads identically to the same belief recorded under another. A provider-neutral projector strips the model-specific wrapping and returns an identical semantic fingerprint regardless of which model produced the text.

Honestly: this shipped and passes its test suite. We have not yet measured how often it degrades on broad, real-world workloads — so we call it a demonstrated property, not a proven-at-scale guarantee. Shipped

By default, records are signed HMAC-SHA256. When a tenant provisions its own keys, an Ed25519 asymmetric-signing path is selected automatically — signatures anyone can verify against a published public key.

Boundary: this is an available upgrade, not the default — and it is not active on GRASP's own demonstration chain. Provisioned

In the Finance vertical, records are dual-signed with Ed25519 and ML-DSA-65 (the NIST FIPS-204 post-quantum standard). We hold this to be table-stakes — the serious competitors ship the same primitive. We're not going to tell you it's a moat. Provisioned

Across the systems we surveyed, the deterministic verbatim-quote check has no equivalent — that's the specific place we win. The base receipt primitive and the post-quantum signing are parity. Our edge is the four-part recombination: a provider-agnostic inference envelope, a tamper-evident receipt, a separate belief chain, the reasoning bound into the receipt, and a deterministic citation floor on top.

We're specific about this so you can check it. The full competitive breakdown is in the whitepapers (request access below).

From August 2026, the EU AI Act requires tamper-evident logging (Article 12) and imposes high-risk obligations on systems that assess things like creditworthiness (Annex III). Both demand an audit trail of what an AI decided, when, and on what basis. GRASP's witness → sign → anchor chain is a direct technical response.

Boundary: the witness and sign layers are live today; the anchor layer is pilot-proven. We're not implying continuous production anchoring. Shipped Pilot

Juvenal's question is unanswerable as a tower: every guardian strong enough to watch the watchmen is itself a power that needs watching. Cryptographic causation doesn't build a taller tower — it pours a floor under all of them.

The watched leave a trace they cannot rewrite, anchored to a system no single power controls; anyone can check it, because the check is arithmetic and a public anchor, not an authority's say-so; and it binds a human to the decision — who authorised this, on what evidence, when. The watchmen are watched by the record itself, plus everyone's ability to read it.

Verification stops being a privilege of the powerful and becomes a capability of the weakest party in the room — the journalist, the whistleblower, the opposing counsel, the citizen, the historian a century later.

Who watches the watchmen? Everyone does — by witnessing. 'Don't trust it. Witness it.' is that answer, operationalised.

The green checkmarks on this site are a convenience, not the trust root. A web page you don't control can't be the reason you believe a record — so the check doesn't live here, and it doesn't belong to us.

The trust root is fourfold. One: a ~200-line standard-library Python script anyone can read in one sitting — no GRIP runtime, no network, no account: tools/grasp-verify-receipt in the public repo (it lands with the sibling pull request). Two: two independent verifier implementations — JavaScript and Python — that byte-agree on shared vectors, so you never have to trust a single implementation. Three: Bitcoin anchors, checked with the upstream OpenTimestamps client and any block explorer — none of our code involved. Four: the raw public ledger itself.

python3 tools/grasp-verify-receipt SPEC.json RECEIPT.json --root .

It re-hashes the deliverable and every pinned source, re-reads each citation quote at its recorded offsets, and recomputes the tally. Any tampered byte, shifted offset, or missing quote exits 1, loudly. For the Bitcoin leg:

pip install opentimestamps-client && ots verify <proof>.ots

One independent verifier in a thousand readers makes forgery unsafe for all thousand — the forger cannot know which of you will check.

TMIF (A Standard for Claiming Transparency and Falsifiability, draft-laurie-tmif-01 — Laurie et al., IETF Informational draft) is a JSON format in which a system declares, per threat, what it mitigates and how transparently — so an independent evaluator can go and verify. GRASP publishes its claims as a signed TMIF Claimant document: grasp/docs/tmif.md — the document, its RFC 7515 signature (Ed25519), and the verifying key, all in the public repo.

To be precise about the relationship: GRASP is not an implementation of TMIF. GRASP is the engine that produces tamper-evident records; TMIF is a declaration layer above it — and GRASP makes a natural reference Claimant precisely because its artifacts (the signed chain, this site's in-browser verifier, the Bitcoin anchor) are what TMIF directs evaluators to check. One divergence, stated openly: TMIF Claimants self-assert transparency levels. Under GRASP's exogenous-anchor rule a level is only worth what a third party can re-derive, so GRASP under-claims by policy — lower bound 3, with level 4 only where verification is a deterministic re-derivation you can run offline.

See it live: the engine sandbox can render any check you run as a TMIF claim — the "Output as TMIF claim" toggle under the signed decision.