arXiv:2609.35659v2 Announce Type: replace-cross Abstract: AI agents run shell commands, edit repositories, send email and move money with their operators' credentials, yet the record of what they did is usually a log the agent, or whoever runs it, can edit. We present Tracekit (open source, MIT, version 1.4.1), which turns each agent run into evidence a third party can check offline. A signer that the agent cannot reach outside dev mode decides every tool call against its own policy before it runs, and signs the call, decision and result as Ed25519 records in a per-run hash chain inside an RFC 6962 Merkle tree whose checkpoints independent witnesses can cosign. A run exports as one .tkb bundle that two independent verifiers (Python, and TypeScript, also as a browser page) check against keys the verifier pins, reporting integrity and assurance separately. Disagreements between capture layers become signed records. Tracekit also records the person's request and what the model said before each call, holds calls that break a limit the request stated, compares what was asked, said and done, and finds which input caused an action by replay. Of 21 experiments: a signed log alone detects 6 of 8 tamper classes and a witness the other two; every insider attack in two suites is caught; the signer round trip is 0.45 ms median; no acknowledged record was lost in 60 kill -9 rounds; reconciliation flags 12 of 12 seeded discrepancies; the verifiers reject all 33 forgeries. Policy rules are a tripwire, not the boundary: they stop 570 of 570 harmful calls in our corpus but 211 of 420 (50.2%) written blind to them; the protection is a signer and credentials the agent cannot reach. On a held-out pool, a failed test claimed as passing is found in 86% of sessions with 5 false findings in 1,812 honest calls, and replay names the planted cause in 6 of 6 confirmed harmful runs with a 7B model.