Dhurandhar — AI Agents That Show Receipts

The problem Every AI agent demo shows a transcript and says trust me. A transcript can say anything. I wanted to know: can agents do real software work where every claim is independently verifiable? Not "the agent says it ran tests" — actual exit codes, git-computed hashes, an audit trail you can check yourself. What Dhurandhar is An autonomous software company of 8 agents (Atlas, Forge, Prism, Rivet, Aegis, Sentinel, Shipwright, Chronicle) with a credit economy. I file one objective as the human — that's my last input. Everything after — allocation, implementation, review, testing, release, recovery — is the company, and every step lands in an append-only, hash-chained event journal. The economy has teeth. Atlas locks a 40-credit bounty in escrow before any model runs. Bidding costs 1 credit, so nobody bids for free. In the recorded run, Forge bid 22 (cheapest) but couldn't cite the required container capability — Rivet won at 24 as the lowest eligible bid. Settlement pays only on verified outcomes: 24 to Rivet, 5 to review, 5 to QA, 3 to release, 2 to the record, 1 refunded. 40/40 conserved, provable from the ledger. When a controlled regression fired, everyone who signed off paid liability — 11 credits across 4 agents — the company rolled back, wrote the root cause, and proposed new policy. The approval button is disabled. Only a human ratifies policy. By design. How Codex and GPT-5.6 were used At two levels. Codex built Dhurandhar itself — the /feedback session ID from the primary build thread is in the submission and repo. And Codex is the hands of the company: the implementation agent runs a headless Codex CLI session requesting gpt-5.6-sol in a workspace-write sandbox; the reviewer runs a second Codex session — same model, separate thread, read-only. The writer physically cannot approve; the approver cannot write. Thread IDs, token counts (~695K across both threads), commands and file changes are parsed from Codex's own JSONL stream. Sentinel, the test gate, ignores whatever the model claims it ran and executes its own static-allowlist command with real exit codes and hashed output. Diffs and SHA-256s are computed from Git by the kernel — never taken from the model's word. Challenges GPT-5.6 access failed closed. My release pipeline refused to run when the model catalog showed zero gpt-5.6 entries. Root cause: Codex CLI version — upgrading past 0.144.0 surfaced the gpt-5.6-sol slug. Proving the model claim. Codex's stream never echoes the model name back, so I couldn't verify that field the way I verify everything else. Instead of hiding it, I recorded the requested slug, CLI version and full argv, and documented the limitation in LIVE_EVIDENCE.md. Evidence discipline means naming what you can't prove. Credits kept trying to leak. Escrow, bid fees, settlements and liability across 8 agents had to conserve exactly — so conservation is a kernel invariant, and I kept a failed reviewer-side test command on the record. Evidence you can edit isn't evidence. What I learned Separation of duties enforced by sandbox flags beats separation enforced by prompts. And honesty compounds: the deployed demo is a deterministic read-only replay of the recorded live run (live execution needs the operator's own Codex auth) — disclosed right on the landing page, with one command in the README to reproduce the run on your own Codex. Don't trust my transcript. Check the receipts.