VSO releases VAP Browser Recorder: an experimental Chrome extension

Implemented capabilities

• Select and save — Import text selected by the user on a page, review the content and explicitly confirm storage. This is manual observation, not automatic collection of an entire conversation.
• Sign locally — SHA-256 event hashes, Ed25519 signatures, record ordering and an RFC 6962-style Merkle root support integrity checks on recorded data.
• Export and verify — Export text and signatures as JSON and check them in the extension or the included Node.js verifier. A separately retained checkpoint allows comparison of the key fingerprint and the full-pack digest.

Installation and use

1. Extract the ZIP on a desktop computer with Chrome. The declared target is Chrome 137 or later; the minimum version has not been tested on a real browser.
2. Open chrome://extensions, enable Developer mode, choose “Load unpacked” and select the extension directory containing manifest.json.
3. Select text on an ordinary HTTP/HTTPS page and import it through the extension icon. Review the preview before saving.
4. Export the JSON and checkpoint from the vault. Keep the checkpoint in a separate trusted location and explicitly select it when verifying.

No API key or npm installation is needed to use the extension. Its UI and bundled guide are in Japanese. There are no service-specific capture adapters; current ChatGPT, Claude and Gemini interfaces have not been tested. Input fields, iframe selections and restricted Chrome pages are outside scope.

Storage and privacy

The prototype extension makes no external transmissions and does not sync accounts. It stores selected text, the site origin and local device time. URL paths, query strings and page titles are not recorded. Its only permissions are activeTab and scripting. Text is stored in plaintext both locally and in exported JSON; there is no automatic anonymization. Review sensitive information before saving. Limits: 32 KiB per capture, 500 records per vault and 4 MiB per file.

What verification does—and what remains unestablished

Verification checks the submitted records for signature, hash, ordering and count consistency. It does not prove that an AI provider generated the text, that the content is true, that all conversation activity was captured or that the timestamps are trustworthy. Wholesale replacement of records and keys cannot be detected without comparison to a checkpoint or other commitment retained through a separately trusted channel. A checkpoint is not an external timestamp or an independent anchor.

External anchoring is not implemented. The prototype uses its own vap-browser-observation/0.1.0 format and makes no claim of VAP v1.2 Draft 3 or OAP conformance, certification, or a standard Evidence Pack format. It is a different contract from the existing vap-interop-demo/0.2.0 interoperability demo.

Tests and package contents

Fifteen automated tests passed on Node.js v24.22.1, covering modified text, timestamps and signatures, omitted or reordered records, key substitution, JSON parsing and Merkle calculations. DOM capture was tested with mocks, not in an actual Chrome session. These results are not an independent audit. The ZIP includes source code, a setup guide, tests, synthetic examples and a verifier.

Test report and unverified items (Japanese) · 15-test execution transcript

Further development

After real-browser validation, development will consider external anchoring, key management, retention controls and comparison with provider-side signed records. These are future items, not features of this distribution. Send evaluation results and suggestions to technical@veritaschain.org.

Specification and implementation references

VAP specification and experimental interoperability demo (fixed reference version) · Chrome: Load an unpacked extension