The human typed 2,578 characters. The model wrote 119,483. Who made it?

I built a tool that records how AI-assisted work is actually produced, and anchored the proof to Bitcoin. Here is the record for the session that built the tool.

The receipt — verify it yourself proofofprocess.ai/v/bac396056f98571f097661346e3b5852f5de2f28c43296ea6f8e36293cab8531

That page is a permanent, independently checkable record of the working session that produced this tool. It is anchored in Bitcoin block 962,320. You do not have to trust me or my servers to verify it — the proof checks against block headers.

Here is what it says about that session:

human turns          30
model turns         216
tool calls          346
revision cycles      29   (97% of human turns)
unattended inputs     0
human input       2,578 characters typed
model output    119,483 characters generated
active time         192 min across 51 hours

Look at the last two lines. The human typed 2,578 characters. The model produced 119,483 — about forty-six times more. By character count this is overwhelmingly machine-generated.

Now look at the revision rate. 97% of that person's turns were corrections or redirections of something the model had just produced. Almost nothing was accepted as it came out.

So: did a human make this? “Yes” is misleading. “No” is misleading. Both answers are useless, and that is the entire problem I wanted to solve.

The thing nobody can currently prove

Every AI provenance conversation I have seen collapses into a boolean: was this AI-generated, yes or no? Detection tools chase it and fail. Disclosure policies demand it and get guesses. C2PA — the actual standard, with real adoption — requires you to declare a digitalSourceType on every asset, and that declaration is entirely self-reported. Nothing checks it. Nothing can.

Meanwhile the interesting question is not answerable as a boolean at all. Somebody who types “write me a novel” and ships the output is 100% human-originated and contributed nothing. Somebody who typed 2,578 characters across 30 turns and rejected 97% of what came back contributed a great deal. The difference is the shape of the collaboration, and until now there was no way to evidence it.

So the tool does not produce a badge. It produces a measured profile, signs it, and anchors it. Interpretation is left to whoever is weighing the evidence — a publisher, an examiner, a client, a court.

What it establishes — and what it does not

I want to be precise here, because this space is full of overclaiming, and an evidence product that overclaims is worthless.

Established

A record with exactly this content existed at that block time.

It has not changed since.

The collaboration figures are bound into the signature, so they cannot be adjusted afterwards without breaking verification.

Not established

Authorship. The operator holds the signing key, so a determined person could fabricate a transcript offline and sign it. Unforgeable after signing, not before.

That a session is an asset. One session can produce several files of very different character.

Closing the first gap needs a second signer who is not the author — a publisher, employer, or escrow — countersigning the record. That is built, and it is the difference between “Self Attested” and “Platform Observed” on the verify page.

Short version: it proves process, not authorship. That is a smaller claim than this category usually makes, and it is the one that survives someone motivated to argue the other side.

How it works

It is a Claude Code plugin. Hooks capture events as they happen — prompts, tool calls, permission decisions, delegation, compaction — into an append-only hash-chained log. Only hashes are stored, never content, so the log is safe to sync, back up, or hand to an auditor without disclosing your prompts, code, or output.

A few details that turned out to matter:

The capture path is zero-dependency. Node builtins only, no crypto library, no network. It has to be, because it runs on every tool call.
The transcript is a tree, not a chain. Parallel tool calls produce sibling entries sharing one parent. My first implementation walked a single parent path and confidently reported healthy sessions as tampered with.
Absent evidence is not negative evidence. An unmined anchor, a missing library, an undisclosed log — all report as skipped, never failed. Getting that wrong tells someone their sound record is broken.
Signing is ML-DSA-65 (FIPS 204), post-quantum. These are meant to be evidence for decades. Anchoring costs about 26 satoshis, a fraction of a cent, so anchoring everything is affordable.

Verification ships as a separate, dependency-free package that the plugin itself imports, so an auditor runs the same code path that produced the record and needs neither Claude Code nor an account.

Honest status

It works end to end and it is public. It also has no users. I built it, tested it on itself, and I am posting this because the next useful thing is not another feature — it is someone telling me why they would not use it.

I am particularly interested in hearing from anyone with an actual AI-disclosure obligation — a publisher, a university, an agency with a contract clause. You have the problem this exists for, and I would rather hear your objections than guess at them.

/plugin marketplace add SmartLedgerTechnology/claude-attest
/plugin install claude-attest@smartledger

The free tier does the full capture, signing and tamper-evidence locally, with no account and nothing leaving your machine. Anchoring is the paid part.

Not ready to install?

Leave an address and I’ll write once, when there is something worth trying — independent witnessing, or capture adapters beyond Claude Code. No drip sequence, no tracking pixels, never shared. Ask at support@proofofprocess.ai and it is deleted.