# Project export: Dhurandhar — AI Agents That Show Receipts This document was generated by HackStack to give an AI agent context about a hackathon project. Sections are labeled with their provenance; content marked as truncated was cut to keep this document small. ## Project metadata - Hackathon: OpenAI Build Week - Tagline: An autonomous software company of 8 AI agents: they bid for work, build via Codex on GPT-5.6 Sol, verify each other with evidence the model can't fake, and settle payment only on proven outcomes. - Devpost: https://devpost.com/software/dhurandhar-ai-agents-that-show-receipts - GitHub: https://github.com/himanshu748/dhurandhar - Demo: https://dhurandhar-asc.onrender.com/ - Video: https://www.youtube.com/embed/FFN0SHpwWFQ?enablejsapi=1&hl=en_US&rel=0&start=&version=3&wmode=transparent - Team: 1 GitHub contributor(s) — himanshu748 (30 commits) ## Devpost submission (written by the team) ### Overview The problem Every AI agent demo shows a transcript and says trust me. A transcript can say anything. I wanted to know: can agents do real software work where every claim is independently verifiable? Not "the agent says it ran tests" — actual exit codes, git-computed hashes, an audit trail you can check yourself. What Dhurandhar is An autonomous software company of 8 agents (Atlas, Forge, Prism, Rivet, Aegis, Sentinel, Shipwright, Chronicle) with a credit economy. I file one objective as the human — that's my last input. Everything after — allocation, implementation, review, testing, release, recovery — is the company, and every step lands in an append-only, hash-chained event journal. The economy has teeth. Atlas locks a 40-credit bounty in escrow before any model runs. Bidding costs 1 credit, so nobody bids for free. In the recorded run, Forge bid 22 (cheapest) but couldn't cite the required container capability — Rivet won at 24 as the lowest eligible bid. Settlement pays only on verified outcomes: 24 to Rivet, 5 to review, 5 to QA, 3 to release, 2 to the record, 1 refunded. 40/40 conserved, provable from the ledger. When a controlled regression fired, everyone who signed off paid liability — 11 credits across 4 agents — the company rolled back, wrote the root cause, and proposed new policy. The approval button is disabled. Only a human ratifies policy. By design. How Codex and GPT-5.6 were used At two levels. Codex built Dhurandhar itself — the /feedback session ID from the primary build thread is in the submission and repo. And Codex is the hands of the company: the implementation agent runs a headless Codex CLI session requesting gpt-5.6-sol in a workspace-write sandbox; the reviewer runs a second Codex session — same model, separate thread, read-only. The writer physically cannot approve; the approver cannot write. Thread IDs, token counts (~695K across both threads), commands and file changes are parsed from Codex's own JSONL stream. Sentinel, the test gate, ignores whatever the model claims it ran and executes its own static-allowlist command with real exit codes and hashed output. Diffs and SHA-256s are computed from Git by the kernel — never taken from the model's word. Challenges GPT-5.6 access failed closed. My release pipeline refused to run when the model catalog showed zero gpt-5.6 entries. Root cause: Codex CLI version — upgrading past 0.144.0 surfaced the gpt-5.6-sol slug. Proving the model claim. Codex's stream never echoes the model name back, so I couldn't verify that field the way I verify everything else. Instead of hiding it, I recorded the requested slug, CLI version and full argv, and documented the limitation in LIVE_EVIDENCE.md. Evidence discipline means naming what you can't prove. Credits kept trying to leak. Escrow, bid fees, settlements and liability across 8 agents had to conserve exactly — so conservation is a kernel invariant, and I kept a failed reviewer-side test command on the record. Evidence you can edit isn't evidence. What I learned Separation of duties enforced by sandbox flags beats separation enforced by prompts. And honesty compounds: the deployed demo is a deterministic read-only replay of the recorded live run (live execution needs the operator's own Codex auth) — disclosed right on the landing page, with one command in the README to reproduce the run on your own Codex. Don't trust my transcript. Check the receipts. ## README (from the GitHub repository) No README available. ## Detected evidence (automated analysis) Indexed codebase: 97 recognized source files, 754 KB. - CSS (language) — detected in the code - FastAPI (technology) — detected in the code - HTML (language) — detected in the code - Python (language) — detected in the code - React (technology) — detected in the code - TypeScript (language) — detected in the code - Docker (technology) — claimed on Devpost, not found in the code - OpenAI (technology) — claimed on Devpost, not found in the code - AI coding agent: Codex — evidence: config files committed to the repository ## Codebase structure (from repository index) ### Files (119 of 119) ``` .dockerignore .env.example .github/workflows/ci.yml .gitignore AGENTS.md agents/constitution.md agents/roles/aegis.md agents/roles/atlas.md agents/roles/chronicle.md agents/roles/forge.md agents/roles/prism.md agents/roles/rivet.md agents/roles/sentinel.md agents/roles/shipwright.md backend/.gitignore backend/app/__init__.py backend/app/api/__init__.py backend/app/api/routes.py backend/app/core/__init__.py backend/app/core/config.py backend/app/main.py backend/app/models/__init__.py backend/app/models/domain.py backend/app/services/__init__.py backend/app/services/company.py backend/app/services/event_store.py backend/app/services/orchestrator.py backend/app/services/runtime.py backend/Dockerfile backend/pyproject.toml backend/requirements-dev.txt backend/requirements.txt backend/tests/conftest.py backend/tests/test_api.py backend/tests/test_company.py backend/tests/test_event_store.py backend/tests/test_orchestrator_evidence.py backend/tests/test_policy_gate.py backend/tests/test_runtime.py benchmarks/README.md benchmarks/replay-ordering.json docker-compose.yml docker-entrypoint.sh Dockerfile docs/ARCHITECTURE.md docs/CLEAN_MACHINE_AUDIT.md docs/FIDELITY_LEDGER.md docs/LIVE_EVIDENCE.md docs/RELEASE_NOTES.md docs/SUBMISSION.md docs/submissions/buildweek.md docs/submissions/namastedev.md docs/VIDEO_SHOT_LIST.md docs/VISUAL_SPEC.md frontend/index.html frontend/package.json frontend/src/api.test.ts frontend/src/api.ts frontend/src/App.test.tsx frontend/src/App.tsx frontend/src/components/AnimatedNumber.tsx frontend/src/components/CopyableValue.test.tsx frontend/src/components/CopyableValue.tsx frontend/src/components/EvidenceInspector.test.tsx frontend/src/components/EvidenceInspector.tsx frontend/src/components/LedgerPanel.tsx frontend/src/components/NewObjectiveDialog.tsx frontend/src/components/OperatorAccessDialog.tsx frontend/src/components/ProvenanceBadge.test.tsx frontend/src/components/ProvenanceBadge.tsx frontend/src/components/RecoveryFlow.tsx frontend/src/components/RoleMark.tsx frontend/src/components/RunHeader.tsx frontend/src/components/SecondaryView.tsx frontend/src/components/Sidebar.tsx frontend/src/components/StatusMark.tsx frontend/src/components/Timeline.tsx frontend/src/components/Topbar.tsx frontend/src/data/demo.ts frontend/src/data/roster.ts frontend/src/hooks/useReducedMotion.ts frontend/src/hooks/useReplay.ts frontend/src/LandingPage.test.tsx frontend/src/LandingPage.tsx frontend/src/lib/gsap.ts frontend/src/lib/motion.ts frontend/src/lib/replay.test.ts frontend/src/lib/replay.ts frontend/src/main.tsx frontend/src/styles.css frontend/src/test/setup.ts frontend/src/types.ts frontend/src/vite-env.d.ts frontend/tsconfig.app.json frontend/tsconfig.json frontend/tsconfig.node.json frontend/vite.config.ts LICENSE Makefile output/evidence/codex-live-run-2026-07-15.jsonl output/evidence/codex-live-run-2026-07-16-gpt-5.6-sol.jsonl README.md render.yaml scripts/check_submission.py video/capture-manifest.json video/package.json video/README.md video/scripts/capture.mjs video/src/components/CaptionTrack.tsx video/src/components/EndCard.tsx video/src/components/EvidenceShot.tsx video/src/components/SceneChrome.tsx video/src/components/TitleCard.tsx video/src/DhurandharDemo.tsx video/src/index.ts video/src/Root.tsx video/src/scenes.ts video/src/styles.css video/tsconfig.json ``` ### Dependencies - backend/pyproject.toml: fastapi@==0.128.0, pydantic@==2.12.5, uvicorn[standard]@>=0.35,<1 - backend/requirements.txt: fastapi@==0.128.0, pydantic@==2.12.5, uvicorn[standard]@>=0.35,<1 - frontend/package.json: @fontsource/jetbrains-mono@^5.2.8, @testing-library/jest-dom@6.9.1, @testing-library/react@16.3.2, @types/node@26.1.1, @types/react@19.2.17, @types/react-dom@19.2.3, @vitejs/plugin-react@6.0.3, gsap@^3.15.0, jsdom@29.1.1, lucide-react@1.24.0, react@19.2.7, react-dom@19.2.7, typescript@7.0.2, vite@8.1.4, vitest@4.1.10 - video/package.json: @remotion/cli@4.0.490, @remotion/media@4.0.490, @types/node@22.10.2, @types/react@18.3.12, @types/react-dom@18.3.1, playwright@1.57.0, react@18.3.1, react-dom@18.3.1, remotion@4.0.490, typescript@5.7.2 ### Recent commits (newest first) - docs: add hackathon submission drafts - docs: finalize submission media - docs: align recording guide with verified playback - fix: keep landing content visible without animation - feat: polish judge landing and add demo video source - Merge pull request #6 from himanshu748/agent/finalize-dhurandhar - Close public claim verification checklist - Merge pull request #5 from himanshu748/agent/finalize-dhurandhar - Record verified public release evidence - Seal public replay mode fail closed - Add judge landing and harden evidence provenance - Merge pull request #4 from himanshu748/agent/finalize-dhurandhar - docs: add final evidence video guide - Merge remote-tracking branch 'origin/main' into agent/finalize-dhurandhar - docs: record verified Render deployment - fix: use Dockerfile command on Render - deploy: pin validated Render blueprint - docs: record Codex collaboration session - docs: record final gpt-5.6-sol evidence - Merge pull request #3 from himanshu748/agent/finalize-dhurandhar ## Key source files (fetched from GitHub, selected and truncated for size) Source contents could not be fetched from GitHub right now. [98 more indexed source files omitted to keep this export small. The full file list is in the Codebase structure section above.]