Make AI agents prove what they checked. Bind every agent verdict to a SHA-256 of the files it read, and refuse to ship on mismatch.