proofpack

Local-first pilot evidence: criteria, evidence, risks, attachments, agent proposals and a customer-safe handover. The proceed, hold or stop call stays with a human.

A pilot succeeds or fails on whether the evidence supports the criteria the customer agreed to. That trail usually lives in a chat thread, a slide and someone's memory. proofpack keeps it as a record. Each pilot has a charter, criteria with metric, baseline and threshold, evidence items tied to criteria, risks, decisions, a checklist and attachments verified by SHA-256. pilot.check reports criterion coverage, stale evidence and outstanding handover actions. Every record carries a visibility flag. The customer export includes only what was marked customer-visible.

The review boundary is the part I care about. An agent session can propose that a criterion is met, tied to the exact inputs it reviewed. The proposal goes stale the moment those inputs change. Recording a criterion review or a proceed, hold or stop decision is a separate operation that an agent session cannot call. This is not authenticated sign-off. It is a deliberate, locally asserted human action, kept apart from what the agent did.

Quick start

Node 23 or newer.

npm ci
node agent/cli.mjs commands                                   # 16 operations with input schemas
node agent/cli.mjs record schema                              # allowed fields per section
node agent/cli.mjs init --workspace /absolute/path/pilots     # explicit; never created implicitly
node agent/cli.mjs setup --workspace /absolute/path/pilots    # prints an MCP server config
node agent/cli.mjs ui --workspace /absolute/path/pilots       # optional review UI on loopback

Operations take JSON on --input file.json or stdin and answer { ok, data | error }. Mutations carry the library revision and are rejected when stale. --output never overwrites a file. skills/proofpack-workflow/SKILL.md is the version an agent reads.

npm test runs 50 tests.

What it produces

• A library.json of isolated pilots, written atomically, with archives kept.
• pilot.export in four formats: a customer HTML handover with a strict CSP and no scripts, an evidence manifest with attachment hashes, a deckforge readout deck (version 1 JSON, customer-visible records only, fails loudly if text will not fit), and a private backup you have to acknowledge.
• Recovery backups before any restore replaces a pilot.

In the suite

proofpack is one of two tools in fieldpack. The deckforge export is the seam between them: evidence goes in here, the readout deck gets measured over there.

More from ong6

Forges make things, packs bundle them.

• groundplane — fails the build when an agent asserts a fact its tools never produced
• jobforge — grades the interview plan you say out loud, not the code you submit
• skillsmith — makes an agent skill from your repo, then proves it beats no skill
• deckforge — agent-first presentation studio with a measured preflight
• fieldpack — deckforge and proofpack as one local-first suite
• skillpack — the Claude Code and Codex skills used across all of these
• uipack — React and SVG figure components behind the diagrams on junxiong.dev