RefTrail – Zero-trust verification and clean-room specs for AI agents

RefTrail is a method and toolset that makes a coding agent's completion report checkable: each requirement gets a source and measurable acceptance criterion, the criteria are frozen with a SHA-256 digest before product code is written, and a coverage catalog records status, evidence and the limits of that evidence. Its tools require Node.js 22.16 or newer and no further packages, and a worked example rebuild of GNU uniq reports 100% functional coverage with 1/1 mandatory checks passed, with recorded output comparisons matching GNU uniq byte for byte (16 of 16 under Linux with version 9.4 for revision 1; for revision 2, 16 of 16 under Windows with version 8.32 and 16 of 16 under Linux with version 9.4). The project states that it organizes what you are allowed to observe rather than analyzing products, that the digest proves criteria did not change but not that they preceded the code, and that its legal notes are general information, not legal advice.