Disclosure: this article contains affiliate links. If you buy through them we may earn a commission at no additional cost to you. Our recommendations are based on the evidence recorded alongside this article, and prices were verified on the date shown.

What changed and why it matters

A Show HN submission titled "Reproduce a cross-company AI agent handoff, including its revocation" went up from user chuks, linking to github.com/identities-ai/ratify-agent-relay-harness. The link, the title, and the submitter's name are the confirmed facts here.

Why a repo link matters more than a description of one: a handoff-and-revocation claim about AI agents working across company boundaries is easy to state and hard to prove. A public repository lets you read the code and the revocation path yourself instead of taking a summary on faith. For a closer read of what's actually inside the commits and claims, see A Sourced Look at the Cross-Company AI Agent Handoff Demo, which tracks the sourcing on the project itself.

What to look for

When you're deciding whether a Show HN reproduction like this is worth your time to run, work through these in order:

• Source transparency. Is the code public and attributed to a named submitter? Here it is — chuks, pointing to a repo under the identities-ai org — which is the baseline before you invest any more time.
• Reproducibility as stated. Can you clone it and run the handoff-and-revocation flow without needing accounts or infrastructure inside two real companies? Read the repo's own setup steps before assuming it, since that detail isn't established by the Show HN post alone.
• Revocation, specifically. A handoff is the easy half to demonstrate; proving revocation actually blocks a previously-trusted agent is the part worth scrutinizing most closely once you're in the code.
• Cost to reproduce. Decide up front whether you're running this on hardware you already own or on infrastructure you'll pay for by the hour, and confirm that cost before you start rather than after.
• Currency of the repo. Check activity and issue history yourself before relying on it as a reference implementation — that's a check you run at read time, not something the submission itself confirms either way.

Recommended options

There isn't a menu of competing products to compare here — there's one sourced repository and two realistic ways to run it. Match the option to what you're actually trying to verify.

Option A: Run it locally

• Best for: readers who want to read the code and step through the revocation logic without spending anything on infrastructure.
• Skip it if: the setup genuinely requires two distinct running services to simulate two separate companies — check the repo's own instructions for that before assuming a single machine is representative of the "cross-company" claim in the title.

Option B: Provision a cloud VM to run it on separate hosts

• Best for: readers who want to reproduce the cross-company part literally, with the handoff happening between two genuinely separate machines rather than two processes on one laptop.
• Skip it if: you're not prepared to check current pricing and instance limits before spinning up more than one instance — costs compound in ways a Show HN comment thread won't warn you about.

Neither option is verified against the repo's actual requirements in the sourced material — both are the two general paths available for reproducing any public GitHub demo, and the right one depends on what you're trying to prove to yourself.

Common mistakes

The biggest one: reading "cross-company" in the title as evidence that two named companies are actually involved or that this is an officially sanctioned protocol. The only thing confirmed is a submission by chuks and a link to identities-ai/ratify-agent-relay-harness — not a corporate endorsement, not a standards body, not a second company's participation.

The second: skipping the repo's own setup and revocation-trigger instructions and guessing at how the demo is supposed to work from the title alone. If revocation is the part you care about verifying, that's the part to read most carefully rather than assume.

The third: provisioning cloud infrastructure before checking what it actually costs today. Before you provision anything, look at See current pricing at the merchant so the instance size and hourly rate are numbers you've confirmed yourself, not ones carried over from an old thread or a different project entirely.

The fourth: treating a single Show HN post as proof the reproduction is complete or correct. It's a pointer to a repository, not a verification — that verification is the part you still have to do by reading the code.

Making the call

If you just want to understand the handoff-and-revocation logic, clone the repo and read it locally — that costs nothing and answers most of the question. If you specifically need to prove the cross-company scenario by running it on two separate hosts, that's when a cloud VM earns its cost, and it's worth confirming current pricing before you start rather than after the instance is already running.