Pick a step
What you will have at the end: a signed receipt or record made on your own machine, a check that passes on it, and the same check failing once you change something. That is the core idea: anyone can tell when a signed record has been altered.
Software mode means the receipts are real but no chip vouches for them. Every tutorial here runs that way, so you need no special hardware or cloud account. The signatures are genuine, but nothing proves where the code ran. That proof needs confidential-computing hardware (see the terms, in plain English).
A signed record of exactly which model file you have, and who may release the key that decrypts it. You install the reference SDK (the official code library) from source, sign the record as the model builder and as the party holding the model (the custodian), check it, and see the key that decrypts the model released only when the checks pass. Stand-in software replaces the hardware, so you need no GPU or cloud account.
A signed ID card for an agent. You sign a small agent configuration and check what it says it uses, then watch the check fail when the record is edited or the agent's instructions (its prompt) change. No AI model runs, and no hardware report is produced.
A gatekeeper between an agent and its tools. You run it in development mode, watch it refuse a call to a sensitive tool (an HTTP 403 "forbidden" reply) before the call reaches the tool, and check the signed TRACE receipt it writes. Without confidential-computing hardware, the check reports partially_verified: the signature holds, but no chip vouches for where it ran.
Rules for one agent handing work to another. You build a chain of two hand-offs and check it, then see it rejected when it starts from someone untrusted or when an agent passes on more permission than it was given. It needs no network, hardware or second running agent.
The receipt format itself. You sign a record, check it, then change one field and watch the check fail. It uses made-up example data and software signing, with no agent, registry or hardware report.
The tests that show whether a tool reads TRACE receipts correctly. You install agentrust-trace-tests, make a basic (Level 0) sample record, and run trace-tests verify on it. The sample passes Level 0. Levels 1 and 2 fail, as expected, because they also need a hardware report and an entry in a public log, which a sample does not have.
Check real hardware evidence first
This is the hardware proof the tutorials leave out. In your browser, check a genuine signed report from an Intel TDX processor on a Google Cloud confidential virtual machine, including the part that names the key that signed a TRACE receipt. Nothing is uploaded.