[Technical Cofounder] Cryptographic provenance layer for AI agents — Working SaaS, 30K+ lines Rust/Python, need security cofounder

The Problem

Enterprises are deploying fleets of autonomous AI agents. Those agents call LLMs, use tools, exchange data, make decisions — and there is no standardized way to authenticate, govern, or audit any of it.

Agent identity today is a string in a database. Credentials rotate every 90 days if you're lucky. Audit logs rely on wall-clock timestamps that drift across distributed systems. There's no provenance story. CISOs are being asked to sign off on agent deployments with essentially zero governance infrastructure.

This problem is about to get dramatically worse — and it's just as acute in federal/defense as it is in enterprise.

What I Built

d3cipher (https://d3cipher.ai) — cryptographic provenance infrastructure for AI agents. Every agent action has a mathematically verifiable causal history. Compliance reports (SOC 2, HIPAA, PCI-DSS) are outputs of that infrastructure, not the infrastructure itself.

The product (LockStock):

• Hash-chained agent identity — an agent's identity is its cryptographic history, not a label. Clone it and the chain breaks. But it's not just hash linkage — a state matrix evolves with every stamp via task-specific generators using linear-algebraic ordering proofs. Tamper evidence comes from both the chain and the matrix evolution.

• Autonomic Atomic Agentic Authentication (AAAA) — the credential IS the stamp. Zero TTL. The next action invalidates the current credential automatically. This isn't rotating API keys on a faster schedule — there is no separate auth step. Authentication is a side effect of every action. Nothing to replay because nothing persists.

• 6-pass verification kernel — chain verification isn't "check the hashes match." Six independent passes: sequence integrity, chain linkage, hash recomputation, matrix evolution, live stamp verification, and payload seal. This is what a crypto engineer will want to audit first.

• Envelope encryption with zero-knowledge storage — we store ciphertext we can't read.

• Agent-to-agent E2E encryption via MLS (IETF standard)

• Governance policies, kill switch, token budgets, velocity monitoring

• Causal audit trail with mathematical ordering — no clock dependency

• Deploys with a single CLI command. Agents connect by changing one env var — or zero for MCP-native agents via lockstock-gateway mcp-config.

Where it stands:

• Live at d3cipher.ai with full documentation, whitepaper, API reference, CLI reference, SLA, and data residency documentation
• 187 files, ~30K+ lines of Rust and Python. The Rust server alone is ~4,600 lines. The chain advancement primitive uses optimistic locking and matrix multiplication. The admin API is ~4,400 lines. These aren't stubs.
• Fully automated CI/CD on GitLab with compilation verification, smoke tests, and distribution gating
• Deployed on Render, Docker-based
• Pricing model validated against market
• Also shipping Liberty — a free open source hardware-bound secrets manager. Liberty uses a software PUF (physically unclonable function) to bind secrets to the specific hardware they were created on. No TPM required. Already on PyPI.

This is not a landing page with a waitlist. This is a working system with a real codebase.

The Honest Part

I built this with heavy AI assistance. Claude wrote this. I'm not an engineer by background. I'm the person who identified the gap, designed the architecture, wrote the whitepaper, structured the product, and shipped it through hundreds of pipeline iterations — but I have not worked as a professional developer and I won't pretend otherwise.

The architecture is sound. The crypto implementation needs eyes from someone who has spent years thinking about timing attacks, entropy sources, key derivation, and all the subtle ways that correct-looking cryptographic code silently fails.

A provenance product that hasn't been independently validated is a contradiction. I know that. That's why I'm here.

What I'm Looking For

A technical cofounder. Not a contractor. Not an advisor. A partner who owns this with me.

The ideal person:

• 10+ years building production security infrastructure (ideally 15-20+)
• Applied cryptography experience — implementation, not just theory
• Comfortable in Rust or willing to go deep in it
• Experience with cloud infrastructure at scale (AWS, containers, orchestration)
• Understands compliance frameworks (SOC 2, HIPAA, PCI-DSS, FedRAMP) from the engineering side
• Has shipped a product to real customers at least once

Bonus but not required:

• GovTech or federal procurement experience
• B2B enterprise sales background
• Familiarity with Theia Platform & MLS protocol

What matters more than any checkbox: You read "linear-algebraic ordering proof with per-action credential invalidation" and something in your brain lit up.

What I Bring

• Product vision and market strategy
• Deep understanding of the AI agent provenance gap — where it is now and where regulation is heading
• Working product, documentation, and infrastructure
• Business development (enterprise and federal)
• I will outwork you on everything that isn't engineering and I'll try to do that too

The Opportunity

• Every company deploying AI agents needs governance tooling. That's heading toward all of them.
• Federal/DoD is deploying autonomous systems with no standardized agent-level audit infrastructure
• No direct competitor is doing cryptographic agent identity at this layer
• Each compliance certification (SOC 2, HIPAA, FedRAMP) unlocks an entirely new market segment
• The core infrastructure generalizes beyond AI agents — any system that needs cryptographic provenance for autonomous actors (IoT fleets, multi-party workflows, federated systems) sits on the same primitive
• The TAM grows with every agent deployed anywhere in the world

Equity

Meaningful. This is a cofounder role. I'd rather own part of something real than all of something that never ships properly. We'll discuss specifics.

Next Steps

Check out the website. DM me. jW d3cipher.ai