The problem, the solution, the stack

The problem

Every AI agent framework already ships a human-approval interrupt. LangGraph has interrupt, Temporal has signals, OpenAI has needsApproval. They are free, already integrated, and they all produce the same artefact:

approved_by: user_44, 14:22:07

That row is written by the system being audited. It is editable by the party being audited. And it contains no evidence that a human, rather than the agent's own service account, produced it.

Since 2 August 2026, the EU AI Act's obligations bind deployed high-risk systems. Article 12(3)(d) requires "the identification of the natural persons involved in the verification of the results", and Article 14(4) requires that such systems be "effectively overseen by natural persons" who can "interrupt the system". Both bind every high-risk deployer.

Article 14(5) goes further and requires "at least two natural persons" — but read its opening clause: "For high-risk AI systems referred to in point 1(a) of Annex III", which is remote biometric identification. A supplier-payment agent is not that, so 14(5) does not bind this example deployer. We build to it anyway, because it is the strictest oversight bar the Act names and the evidence is identical either way. The scope is set out in full here.

A self-written, self-editable log satisfies neither.

The solution

Proctor binds four things a self-hosted approve button cannot:

1. The decision hash — the witness's liveness proof is cryptographically bound to this decision via the World signal, not to "a human approved something at some point"
2. A liveness proof issued by a party that is not the deployer — World ID
3. A nullifier proving the approver is not the operator — two distinct accounts, checkable by a third party rather than asserted
4. A consensus timestamp on a log with no admin key — a clock the deployer did not choose, on a record nobody can rewrite, including us

Any third party verifies the whole record offline, against Hedera's mirror node and World's own verifier, without trusting Proctor.

Why this stack

• Hedera Consensus Service gives an ordered, tamper-evident log at a fixed sub-cent fee, independently re-derivable through the running hash chain. A contract write costs more, has no better timestamp, and gives up the chain property.
• x402 lets an agent pay for a resource mid-request, over HTTP, with no account and no prior relationship. The gate is a paywall the agent hits, not an integration it planned for.
• World ID proves liveness in seconds on a phone the witness already owns, which is the only reason a human oversight step can be measured in seconds instead of minutes. Selfie Check is the credential we designed for, and World granted the beta flag on 2026-09-09 for the duration of the event, so it is what runs. Exactly what has and has not been demonstrated end to end is stated below.
• Circle makes a sub-dollar payment to a human economically possible at all.

Try it in 60 seconds

No wallet, no API keys, no feature flags. This runs the entire oversight loop:

cd backend
cp .env.example .env          # DATABASE_URL is the only value you must edit
bun install
bun run db:push
bun run seed && bun run demo
bun run doctor                # what is live, and what each gap costs you
bun run acceptance            # exercise every claim against the running service

Unconfigured, this runs the full loop and produces a record that is deliberately NOT independently verifiable — it is signed with a published demo key and never reaches a topic. bun run demo says so in its own closing line, and bun run doctor lists exactly what is missing. The difference between "it ran" and "it produced evidence" is the entire product, so the tooling refuses to blur it.

1. agent proposes: EUR 41200.00 -> Meridian Logistics
2. policy        : ESCALATE (amount_threshold)
3. decision      : cmtmkf18b0000lxw8lqurjc31
   human line    : Release EUR 41,200 to Meridian Logistics?
   signal        : 0x5b068ce449934ca1df15f5f4…
4. dispatched to the rota, 60s deadline running
5. proof         : VERIFIED
   signal matched this decision, and the witness is not the operator
6. APPROVED in 28 ms
7. attestation   : 722 bytes, ind=crypto
   signed by     : 0xB73837E8C34E2897debeAca0898Da23B52a6Eb10

   The agent is released. The evidence is independently verifiable.

And the outcome an auditor actually cares about:

bun run demo refuse

5. witness REFUSED. No proof required: refuse is the default outcome.
6. attestation   : 628 bytes, wid=null, wa=token

   The agent is NOT released.

Verify our live evidence log, without installing anything

bun verify/bin/verify.ts --topic 0.0.10390147

PASS  25 messages, chain intact from genesis.
      No message was inserted, removed, reordered, or altered.

PASS  completeness: issuance numbers dense across 1 issuer(s).
      No decision was withheld from this log.

Two checks, two different claims. The first proves nothing was altered. The second proves nothing was withheld — an operator who never submits a record breaks no hash.

Zero dependencies. node:crypto only. It contacts Hedera's public mirror node and nothing of ours.

Verify it yourself in two minutes

Every row is a link to a file range or a public explorer. Nothing here asks you to take our word.

Live proof

The evidence log is on Hedera testnet

Topic:        0.0.10390147
Memo:         Proctor oversight evidence log
Admin key:    NONE  (immutable and undeletable, by anyone, including us)
Submit key:   ECDSA, operator-held
Creation tx:  0.0.10349667@1788684617.529727573

Per Hedera's documentation: "if no adminKey is specified the topic is immutable."