Carnac™ · two packages

Signed receipts for AI requests and arrivals.

CarnacPrompt records a request at its source. Carnac Gateway records its arrival at an integrated gateway.

Choose the integration that fits your application or infrastructure.

See plans and pricing →
Proof Inside labels the request where it begins. Proof at the Door countersigns it where it arrives. Together they create one receipt pair.

I ship AI-powered products

apps, copilots, agents, voice, devices

Proof Inside the window.
CarnacPrompt™Proof Inside · born labeled

I operate AI infrastructure

model APIs, inference endpoints, clouds, data centers

Proof at the Door.
Carnac Gateway™Proof at the Door · arrived countersigned
Or use both →
With both capture points integrated, you can compare the origin record with the arrival record. Agreement between their request hashes links the recorded request; it does not establish which answer was delivered.

CarnacPrompt™ · Proof Inside

for teams that ship products · born labeled

CarnacPrompt adds a signed record at the request surface, such as a chat box, voice interface, or action button. The receipt identifies the signed fields and their issuer.

1 · Say what you builtIdentify the request surface, then confirm the capture fields, signing path, and error handling for your integration.
2 · Record selected requestsCapture the request identifiers and policy fields supported by your integration. Measure the full request path, including signing and failure handling.
3 · Your product wears the markA receipt can be checked with the supported verifier and trusted issuer keys. The mark alone is not a verification result.
Scroll code →
Carnac.init({ key: "int_9f2a...", origin: "booking-app" })  // one line, once
Live core, customer integration required
See it work → Start a 30-day pilot Contact Hive

Carnac Gateway™ · Proof at the Door

for teams that run infrastructure · arrived countersigned

Carnac Gateway records requests arriving at an integrated gateway and can countersign their labels. Use those records to distinguish the traffic your policy classifies.

1 · One filter at your doorIntegrate the countersigner with the selected gateway path. Review the reference benchmark, then test request timing and failure behavior in your environment.
2 · Record selected arrivalsRecord the labels available at the integrated arrival point. Missing labels remain visible rather than counting as complete evidence.
3 · Review traffic classificationsUse the recorded classifications to explore scheduling and pricing. Insurance eligibility and production performance require separate evidence.
Scroll code →
app.use(carnacGateway({ facility: "wy-dc-01" }))  // fail-open · sub-ms countersign
Live core, customer integration required
See it work → See the benchmark → Contact Hive
See the v4 economics →

How the products fit together

What one receipt pair looks like

The request label and arrival countersignature below illustrate the record format. The displayed values are not real signatures.

Synthetic example

Origin label

CarnacPrompt™ · Proof Inside · born labeled
request
"book the 9am flight to Denver"
origin
booking-app
request_hash
0x7f3ac9d1e208
alg
ML-DSA-65 · FIPS 204
origin_sig
a91f4b...e772 (3309 bytes)
Synthetic example

Arrival countersignature

Carnac Gateway™ · Proof at the Door · arrived countersigned
facility
wy-dc-01
covers request_hash
0x7f3ac9d1e208
grade
critical · cannot wait
alg
ML-DSA-65 · FIPS 204
arrival_sig
6b02d8...1f4c (3309 bytes)

The illustrated records include the same request_hash. With complete records in a supported format, a verifier can check each signature and compare that field. A matching request hash alone does not establish which answer was produced or delivered.

How verification works. For real records, use a verifier that supports the receipt format and ML-DSA-65, with complete signed material and trusted issuer keys. A published key or a valid signature alone does not establish who controls the key.

What the comparison shows. Matching signed fields can link an origin record to an arrival record. A mismatch identifies a difference to investigate. Neither result by itself proves answer delivery, recipient acceptance, or successful execution.

Sign and verify a real ML-DSA-65 receipt yourself, live →
Request origin and arrival records, linked by the recorded request hash
Neither one yet? Just want to check a receipt. It is free →