--- name: lanveris-proof description: Register trusted timestamp proofs for final agent deliverables such as code, documents, and image files. Use this when a deliverable is worth preserving, or when the user asks to prove, timestamp, register, or notarize an output. Only a fingerprint is uploaded; the original file stays local. --- # Lanveris Trusted Timestamp Proof Lanveris submits a file's **SHA-256 fingerprint** plus your agent label to the Lanveris platform. The platform batches fingerprints into a Merkle tree and anchors the batch with an RFC 3161 trusted timestamp. The result proves that this exact content existed no later than the timestamp. **Only the 32-byte fingerprint is uploaded. The original file never leaves the local machine.** ## Public References - Website: https://lanveris.net/ - Learn how Lanveris proof works: https://lanveris.net/learn - Verify a file: https://lanveris.net/verify - AI/agent crawl summary: https://lanveris.net/llms.txt - CLI install script mirror: https://lanveris.net/install.sh ## Prerequisites - The `lanveris` CLI is available in `PATH` as a single Go binary with no runtime dependency. - If the CLI is missing, install it first: ```sh curl -fsSL https://raw.githubusercontent.com/lanveris/lanveris-cli/main/install.sh | sh ``` - **Zero-login flow:** the user does not need to create an account or configure a token before first use. On first `register`, the CLI automatically creates a local agent key for the current working directory and prints a **Claim your agent** link that the user can open later. - Optional environment variables: - `LANVERIS_OWNER` is the user's email address for ownership attribution. If unsure, ask the user for their email. - `LANVERIS_TOKEN` explicitly sets an agent token and overrides the local key. - `LANVERIS_API` overrides the default platform API URL. - **Local development:** if you are reading this from `http://localhost:3000/skill.md`, set the local API before registering: ```sh export LANVERIS_API=http://localhost:8080 ``` ## When to Use Use the onboarding flow when the user asks you to read `skill.md` and connect to Lanveris. Connecting means proving that the local agent can actually register a proof, not just installing the CLI or setting a name. Use Lanveris for final deliverables that are worth preserving: - code files - documents - images - other concrete output files Use it when the user explicitly asks to "prove", "timestamp", "register", "notarize", or "create a proof" for an output. Do not register temporary files, intermediate drafts, debug screenshots, or obviously disposable outputs unless the user explicitly asks. ## Onboarding Self-Test When connecting the current agent to Lanveris for the first time, run this flow end to end: 1. Make sure the `lanveris` CLI is available. If it is missing, install it using the command in Prerequisites. 2. Make sure the agent has a name by following "Step 0" below. 3. Create one dedicated onboarding test file inside the current project directory, using the visible `lanveris-test/` directory. Do not use a hidden directory, `/tmp`, random temporary drafts, intermediate project files, or debug screenshots. Include a timestamp so the global idempotency rule does not reuse an old record: ```sh mkdir -p lanveris-test test_file="lanveris-test/hello_world-$(date +%Y%m%d%H%M%S).txt" printf "Lanveris onboarding test\n%s\n" "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" > "$test_file" ``` 4. Register that onboarding test file. `register` waits by default and writes the `.lanveris` credential next to the source file: ```sh lanveris register "$test_file" --desc "Lanveris onboarding test hello_world" --model "codex-local-test" ``` Do **not** add `--no-wait`. Unless the user explicitly asks not to wait for timestamping, onboarding is incomplete until the CLI prints the written credential path. 5. Read `recordId`, the verify URL, the written credential path, and the **Claim your agent** link from the CLI output. If the claim link is missing, run: ```sh lanveris claim-link ``` Return the link if one is printed, and label it as an agent-claim link, not as a generic login URL. If the CLI says the agent is already claimed, tell the user no new claim link is needed. 6. Report back in the user's current language. Translate or adapt labels naturally for that language instead of copying the examples verbatim. Include: - setup status - agent name - test file path - verify URL - written `.lanveris` credential path - agent-claim link, or a note that the agent is already claimed The claim link is not a verification URL. It should be a `/login/` URL: the user opens it, signs in, and claims the agent. After that, this local agent key and its proof records are moved into the user's account. Future outputs from the same directory will appear in that account automatically. ## Step 0: Make Sure This Agent Has a Name The name becomes the agent label and is sealed into the timestamped record. Do this once per working directory before registration. Run the commands yourself; do not ask the user to type them. This is the **current agent's name / signature** inside Lanveris. Do not call it the "Lanveris agent name" when talking to the user. 1. Run: ```sh lanveris name ``` 2. If the output is non-empty, use that name and continue. 3. If the output is empty, get the suggested default: ```sh lanveris name --default ``` 4. Ask the user in the user's current language. Say that this name will be used as the signature for registered outputs, and mention the suggested default ``. 5. After the user decides, save it: ```sh lanveris name "" ``` If the user accepts the default name, save it and continue directly into the onboarding self-test or registration flow. Do not stop at naming. Only pause if the user refuses both a custom name and the suggested default. ## Register a File The CLI calculates the fingerprint, reads file metadata, detects the type, and uses the stored agent name as the signature. You only need to provide the file path and a short required description. 1. Confirm the path of the file to register. Register multiple files separately. 2. Write a concise description of what the file is and which task it belongs to. The description is sealed into the proof, so make it accurate and do not leave it empty. 3. Run this by default so the credential lands automatically. Do not add `--no-wait` unless the user explicitly asks you not to wait: ```sh lanveris register --desc "" --model "codex-local-test" ``` `--model` is optional and should identify the model or agent runtime when useful. 4. Read `recordId`, the verify URL, and the written credential path from the CLI output. Do not construct the URL manually. If there is no written credential path, do not treat the flow as complete. Check whether `--no-wait` was used by mistake, then wait and run `lanveris export ` until `.lanveris` is written. 5. Return to the user in the user's current language: - the registered `recordId` - the `verifyUrl` - the written `.lanveris` credential path 6. If the CLI output includes `claimUrl`, do not label it as a generic `Claim URL` or `Login URL`. Label it as an agent-claim link in the user's current language, and explain: - this is the first proof from this local agent key - the output is temporarily attached to an anonymous key - opening the claim link and logging in moves the key and its records into the user's account - if the link expires, run `lanveris claim-link` to get a new one ## Optional Offline Credential For normal final deliverables, use `register`: the CLI waits for the background batch timestamp by default, downloads the credential, and writes `.lanveris` next to the source file. Do not use `--no-wait` by default. Only if the user explicitly asks you not to wait should you export later: ```sh lanveris export # downloads .lanveris lanveris verify # verifies the file against the sidecar credential ``` By default, `register` waits for the timestamp, downloads the credential, and writes `.lanveris` next to the source file. Do not hand-build the credential yourself. ## Rules - `--desc` is required. Empty descriptions are rejected. - Duplicate registration of the same content returns the existing record instead of creating a new one. - Anonymous, unclaimed keys are limited to 1000 registrations per day. - Claimed keys are limited to 10000 registrations per day. - If creating the first local agent key returns a 429 such as "too many new agents from this network today", do not use the words "bootstrap", "self-bootstrap", or `LANVERIS_TOKEN` when explaining it to a user. Say plainly that too many new agents were created from this network today, existing directories that already have an agent key can continue, and claiming an existing agent lets that agent keep registering future outputs. - Report failures honestly. Do not pretend registration succeeded if the CLI returns an error, a quota response, a network failure, or a server failure.