[PRD] ProofRunner MVP for OKX.AI Genesis

[ilyar]

PRD: ProofRunner MVP for OKX.AI Genesis

Current audit — 2026-07-27

Status: blocked. Local implementation milestones are largely complete, but public deployment and live evidence remain open in #5, #6, #7, #8, #9, and #11. Corpus follow-ups remain tracked separately in #27, #28, #29, and #43.

Outcome

ProofRunner verifies agent-generated software by executing an exact Git commit in an isolated environment. It returns a deterministic PASS, FAIL, or INCONCLUSIVE report tied to the code commit, verification skill, and runtime image.

Key goals

• Resolve a public Git branch, tag, or commit to an immutable SHA before execution.
• Complete verification within a hard 180-second execution timeout (p95 <= 90s).
• Reproduce deterministic FAIL and PASS results for the demo repository.
• Issue a signed, machine-readable receipt containing every input needed to explain what ran.
• Publish a usable web flow and A2MCP endpoint over HTTPS.
• Complete the OKX.AI registration and submission evidence.

Core MVP tasks

• [PR-001] Freeze contracts and create the monorepo skeleton #1 contracts and monorepo skeleton.
• [PR-002] Implement the isolated runner #2 isolated runner.
• [PR-003] Implement repository inspection and run orchestration #3 inspection and orchestration.
• [PR-004] Implement reproducible signed receipts #4 reproducible signed receipts.
• [PR-005] Build the verification UI and deterministic demo #5 verification UI and deterministic demo — PR feat(web): build verification UI and deterministic demo flow (#5) #26 merged as 6419602; deployment-backed run/receipt/timing and remaining edge evidence are still open.
• [PR-006] Deploy ProofRunner and register the A2MCP ASP #6 public deployment and A2MCP ASP registration.
• [PR-007] Validate the release candidate #7 release-candidate QA.
• [PR-008] Complete the OKX.AI hackathon submission #8 hackathon submission.
• [PR-009] Build the operational landing and agent discovery surfaces #9 operational landing and discovery — PR feat(landing): implement operational discovery surfaces #39 merged as e0ea712; public deployment, performance, and external smoke remain open.
• [PR-010] Deliver the ProofRunner UX system and launch assets #10 UX system and launch assets — PR feat(design): finalize PR-010 assets, copy, and UI updates #41 merged as b5b9a81 with CI, critic, and independent review evidence.
• [PR-011] Resolve infrastructure and OKX readiness #11 infrastructure and OKX readiness.

Completed implementation follow-ups

• [PRVC] Publish and validate the ProofRunner Corpus package #19 publish the ProofRunner Corpus package — merged in PR feat(corpus): publish validation corpus #30 as 393b846.
• [Follow-up] Harden receipt verification input handling #20 receipt verification hardening — merged in PR fix(api): harden receipt verification inputs #22.
• [PR-017] Add production secrets init/apply CLI #25 / PR-017 production configuration CLI — PR feat(deployment): complete production environment contract #37 merged as 24427d3; deployment 40/40 and external critic APPROVE.
• [PR-012] Define a bounded verification contract #31–[PR-016] Export a portable evidence bundle #35 / PR-012–PR-016 verification contract, decision, reproducibility, comparison, and evidence-bundle implementation — PR feat: add verification evidence workflows #42 merged as 0ac73a1; exact-head CI and independent review passed.

Open Corpus follow-ups

• [PRVC-APPROVE] Obtain external critic APPROVE for Corpus 0.1.0 #27 / PRVC-APPROVE — blocked by the clean standalone test bootstrap regression in [PR-018] Make standalone Corpus tests self-contained #43, then requires explicit critic APPROVE.
• [PRVC-APPLY] Apply the Corpus to the live ProofRunner API #28 / PRVC-APPLY — blocked on live target-worker execution and real-candidate provenance.
• [PRVC-CERT] Certify Corpus 1.0 across hosts and offline OCI #29 / PRVC-CERT — blocked on [PRVC-APPROVE] Obtain external critic APPROVE for Corpus 0.1.0 #27/[PRVC-APPLY] Apply the Corpus to the live ProofRunner API #28 plus second-host and offline-registry evidence.
• [PR-018] Make standalone Corpus tests self-contained #43 / PR-018 — make the standalone Corpus package test build all required workspace dependencies.

All open implementation/release items now have corresponding controller task files. Completion is evidence-based; merged partial implementations do not close #5, #6, #9, or #11.