onepunchforall/aep

AEP, short for Agent Evidence Packet, is a file format built to solve a specific problem in AI agent pipelines. When one AI agent hands its findings off to another, those findings usually arrive as plain text with no way to check where the information came from or whether it has been changed along the way. AEP replaces that unstructured prose with a structured, schema validated, tamper detectable format, with tooling written in Python. Each AEP packet is a directory, using a .aepkg extension, containing JSONL files, meaning one JSON record per line, for sources, spans, claims, relations, events, reviews, and validation runs. A span records the exact quoted location a claim came from, along with a SHA-256 hash of that quote. A root manifest ties everything together with its own SHA-256 state hash, which any compliant validator can independently recompute. If anything in the packet changes after that hash is set, validation fails. Every claim in a packet carries a reliability label, an evidence basis pointing back to a specific quoted span, and reviewer receipts, so a claim can be checked without simply trusting the agent that produced it. The format can generate derived views from the same underlying data: an HTML table, an SVG diagram of the integrity tree, and a Mermaid dependency graph, all tied back to the same root hash. Separate verifier programs written in Python and in Node.js were tested against the same packets and produced identical hashes, showing that two independent implementations agree the data has not been tampered with. AEP is aimed at developers building AI agent systems where verifiable provenance matters more than file size or ease of hand editing. The README reports the format closes 11 documented attack classes and includes over 35 fail closed validation error codes, at the cost of packets being noticeably larger on disk than plain HTML or Markdown. The project is released under the Apache 2.0 license.