Runback
Open standard

runback.cassette/v1

An open, tamper-evident format for AI agent audit records. Every decision is hash-chained and independently verifiable — no Runback account required to verify. Implement it in any language; verify it with any SHA-256 library.

Purpose

What it solves.

AI agents make decisions that can't be rolled back — loans approved, refunds issued, triage routed. Logs record the outcome. They do not prove the reasoning or detect tampering. The cassette format captures every non-deterministic input the agent touched — context, tools, retrieval — in a hash-chained record sealed at execution. Change one event and verification fails. The record is re-executable: replay the agent against the captured inputs and the output must reproduce.

In software, the commit is the fundamental unit — immutable, attributed, tamper-evident. The cassette is that primitive for AI decisions.

Format

Structure.

A cassette is a JSON document with two top-level fields: manifest (metadata and digests) and events (the ordered event chain). The $schema field identifies the format version.

{
  "$schema": "runback.cassette/v1",
  "manifest": {
    "run_id": "loan-approval-agent-2026-07-01",
    "generated_at": "2026-07-01T09:14:22.000Z",
    "event_count": 6,
    "algorithm": "sha256-chain",
    "content_digest": "3e68cdbbf372df98a4d3c019e2b87f41...",
    "replay": {
      "cassette_digest": "a1b2c3d4e5f6...",
      "entry_count": 6,
      "algorithm": "oracle-stream-sha256"
    },
    "signed": true,
    "signature": {
      "alg": "HMAC-SHA256",
      "value": "9f3a1c..."
    },
    "spec_url": "https://runback.dev/spec",
    "verifier_url": "https://runback.dev/verify"
  },
  "events": [
    {
      "span_id": "span_01",
      "type": "llm",
      "model": "gpt-4o",
      "started_at": "2026-07-01T09:14:20.112Z",
      "_hash": "f4a2d1..."
    }
  ]
}
Events

Event types.

run

Root span — the full agent execution. Contains status, model, started_at, ended_at.

llm

A single model call. Contains messages[], tools, response, token counts, tool_calls.

tool

A tool invocation triggered by an LLM span. Contains input, output, tool_call_id.

Integrity

Verification algorithm.

Any SHA-256 implementation verifies a cassette. There are three required checks and one optional signature check. All four are run by the public verifier at runback.dev/verify.

// For each event in order:
h_0 = ""
h_i = SHA-256( h_{i-1} + canonical( event_i ) )

canonical = JSON.stringify with keys sorted recursively
            event._hash field excluded before hashing

// Three checks
chain:     every event._hash === h_i
digest:    manifest.content_digest === h_n (final hash)
cassette:  manifest.replay.cassette_digest === oracle_stream_digest(events)

// Optional fourth check (if signed)
signature: HMAC-SHA256( signing_key, content_digest + ":" + cassette_digest )
           === manifest.signature.value
✓ Chain

Tampering with any event breaks its hash and all hashes after it. The chain is append-only.

✓ Digest

The manifest.content_digest is the terminal chain hash — a single value covering all events.

✓ Cassette

The oracle-stream digest independently proves the recording IS the agent's exact input stream, not a post-hoc reconstruction.

✓ Signature

Optional HMAC-SHA256 over digest:cassette_digest proves the record came from a holder of the signing key. Future versions will support asymmetric signing for full non-repudiation.

Verify

Verify a cassette.

Browser — no account

Paste a cassette at runback.dev/verify. All four checks run client-side — the cassette never leaves your browser.

CLI / npm
npx @runback/verify cassette.json

Zero dependencies. Runs the full four-check verification locally. Exit 0 = valid.

API
POST https://runback.dev/api/audit/verify
Content-Type: application/json

<cassette JSON>

Returns { valid, checks: { chain, digest, cassette, signature } }

Implement

Use the format.

Receiving a cassette

Verify it at runback.dev/verify or POST to /api/audit/verify. You need no account and no Runback dependency to check integrity.

Producing the format

Implement the SHA-256 chain over your events and emit the manifest structure above. The cassette_digest (oracle-stream) requires the @runback/replay algorithm — reference implementation at github.com/letsRunback.

Regulatory use

The format satisfies EU AI Act Article 12 logging requirements and APRA CPS 230 operational incident documentation. The manifest generated_at and signature provide the chain of custody an auditor needs.

Verify a cassette. Generate one. Build with it.

Verify a cassette →How Runback generates them