What is Plexus™ by Subnet345
Show your agents’ recorded actions. Verify it yourself.
Plexus is the tamper-evident record substrate for AI agents. It attributes actions and records them by construction, allowing your team to recompute verification independently.
§ 01 The wedge
Independently verifiable
Recompute the digests yourself, inside your own environment.
Plexus records each event into an unbroken cryptographic hash chain. Your team walks the chain and recomputes digests directly within your perimeter, so an in-place modification is detectable when the record is re-derived and verified.
§ 02 Feature
Access is the gate. Plexus is the record.
A gate cannot tell an examiner what an agent did once permitted through. Plexus provides the layer underneath: what the agent did, which policy rules fired against the recorded actions, and whether the chain remains intact. Plexus has gates of its own, off until you set them, and their refusals go on the same record.
§ 03 Feature
Attribution by construction
Plexus attributes each recorded action to the executing agent runtime, the identity it ran under, and the exact timestamp of execution. Unattributed actions are recorded as gaps, never dropped; every correction carries its own audit trail.
§ 04 Feature
Works across your AI stack
Claude Code, OpenAI Codex, Google Antigravity, and custom runtimes normalize into a single attribution record.
Plexus does not replace your team's existing agent frameworks. It sits underneath them.
§ 05 The evidence, concretely
The records an auditor actually asks for. Not a description of them.
These are records from a running Plexus fleet, sanitized for publication: the agent name, author, repository, commit identifier and subject line are placeholders. The body digest and the other fields are as recorded. The verifier run beside them is an example from an installed deployment: localhost:3100 is that deployment's own address. In your environment you run the same check against your own install; there is no public copy of this record to verify from here.
A single recorded action
The atomic unit Plexus records: who acted, how it was attributed, and the content digest, populated at ingest.
{
"id": 92,
"repo": "example-org/example-repo",
"commit_sha": "2675eb3632064144999e4e79d9f3cfbe90759168",
"occurred_at": "2026-07-13T18:01:52Z",
"agent_attribution": "research-agent",
"attribution_method": "co_authored_by",
"runtime_class": "claude_code",
"author_email": "research-agent@example.invalid",
"subject": "[withheld]",
"body_digest": "046b76bd8f710dc187e4f9e78a28ac38cc15d2291902d442f6fccaa173a1fc54",
"signed": 0,
"parent_count": 1,
"files_changed": 3,
"bytes_delta": 1420
}Verify it yourself
$ curl -s http://localhost:3100/api/v1/plexus/public/audit/anchor-verify?day=2026-08-25 | jq
{
"found": true,
"schema_version": 2,
"mode": "chain",
"match": true,
"tamper_detected": false,
"anchor_day": "2026-08-25"
}match: true with tamper_detected: false means the recomputed chain digest agrees with the committed anchor for that day: no in-place alteration to that day's records. Protection against a wholesale rewrite depends on the external anchor you configure. A mismatch is a tamper signal. How recompute works →
Retention, operator-set
Event rows persist indefinitely, which covers the multi-year windows that evidentiary standards such as SEC Rule 17a-4 require.
External integrity anchor
For wholesale-rewrite protection, the chain commits at daily rollover to an S3 Object Lock bucket you configure, so a substitute chain cannot match a digest already committed outside the store. Until configured, the chain is anchored internally only.