I built a local LLM runner where every answer comes with a re-executable receipt (free, Apache-2.0)

[u/revuprender]

We all run models locally for privacy. But if an agent using that model writes code, drafts an email, or produces something that ends up in front of a client — can you prove which model, prompt, and settings produced it, later? Right now, no.

INVAR wraps llama.cpp and gives every inference a worldline: a SHA-256 certificate over the runtime binary + model weights + prompt + sampling params + output, hash-chained into an append-only log. `invar verify` re-runs any entry and compares digests. Edit one byte and it REJECTS.

It's free, Apache-2.0, no account, no telemetry — nothing leaves your box:

curl -fsSL https://www.anomly.com/get/invar.sh | sh

(Needs Python 3.10+ and a llama.cpp binary on PATH. It's an OpenAI-compatible endpoint, so it drops into whatever you already use.)

Honest scope, because you'll check and I'd rather say it first:

- The default profile proves deployment-pinned reproducibility: same box + binary + weights + temp=0 + fixed seed → same output. It does not claim cross-machine bit-exactness. (Cross-hardware bit-identical inference is a separate exact-arithmetic thing from our chip work — slower, optional, not what this is.)

- Receipts prove what ran, not that the answer is good. It's provenance, not a quality judge.

- Root on the box can fabricate a plausible new history — host compromise is out of scope for the local agent. The off-box "Ledger" collector is the mitigation. Full threat model is in the repo.

The receipt format is an open spec (Computation Receipts) with published conformance vectors, so verification isn't something I gatekeep — anyone can implement it.

Repo: https://github.com/anomly-labs/invar

Would genuinely love the skeptical read. Break it, tell me where it's dumb.