Agents now act in the world: they send the email, approve the refund, remediate the vulnerability,
place the order, and hand work to other agents. Once an action has consequences, a claim is not
enough — and neither is a trust score.
"Don't trust, verify" is an old slogan with a narrow meaning: verify the code, or the coins.
We mean something harder: verify conduct — what an agent did, for whom, under what authority,
and what it left out — after the fact, by parties who were not there and hold no relationship
with the operator.
Evidence gains weight through independently checkable properties: content binding, signer authentication, an external existence deadline, sequence continuity, declared and tested coverage, identity and authority binding, and corroboration. None substitutes for another. Accountability begins when a relying party applies a consequence.
Every scheme in this space ships levels: SLSA levels, attestation tiers, E0–E4 grades, maturity models. Levels imply that a higher rung includes the lower ones. Evidence does not work that way. A record can have a hardware-attested runtime and no proof it was ever registered anywhere; strong continuity under a pseudonymous key and no idea who holds the key; a witnessed history that is complete over what was written and silent about what was never written. These are orthogonal properties. Rounding them into one number is how every "trusted" badge ends up lying. A verifier should report each property with one of five results — established, failed, not present, not checked, inconclusive — and stop there.
Accountability systems that actually work — double-entry bookkeeping, two flight recorders, replication in science — rest on the other party's record, add sampling to check the computation, and add a shared log last. The agent-evidence field has been building in the opposite order: attestation of the machine first, transparency logs second, and almost nobody asking the party on the other side of the exchange to keep its own signed half. But a producer's log, however well witnessed, proves only integrity of what the producer chose to write. Coverage is a property of the counterparty's record, not of the log. A requester who sealed its own request and holds the provider's signed reply can prove an omission by arithmetic; no witness can. We build the requester's half first and treat the log as what it is: the neutral part, not the truthful part.
A producer should publish facts anyone can recompute (continuity unbroken since checkpoint C; 214 exchanges with you, none missing on either side; twin agreed 41 times, contradicted 0, inconclusive 2) and refuse to publish a rating. Scores need a scorer, and a scorer is the central party the architecture set out not to have. Yet a property without its denominator, boundary, and audience is a score wearing technical language, so every aggregate must name them. And none of it matters until a requiring party — a gateway, a change-control system, an auditor, an insurer, a counterparty bearing liability — changes a decision when evidence is absent, late, or invalid. Evidence quality and accountability are different things; only the second has teeth.
Evidence gains weight through independently checkable properties: content binding, signer authentication, an external existence deadline, sequence continuity, declared and tested coverage, identity and authority binding, and corroboration. None substitutes for another. Accountability begins when a relying party applies a consequence.
Each is a good instrument for one property. The gap is a portable evidence object that carries several of them, keeps them separate, and can be checked offline by a party the producer never met.
In Mesh-LLM — inference on strangers' machines, discovered over relays, no operator — every served exchange is sealed at the moment of serving into the node's own append-only log; 32-byte checkpoints go to a witness the node does not run; a requester can seal its own half and the provider's reply cites it; any node can ask any other for its history and get an artifact, a signed refusal, or a recorded absence; a mesh record can cite a foreign hardware attestation by digest and is graded by that record's own verifier — never rounded up. Sampled twin requests and a one-token referee are proposed for settling content disputes by recomputation.
The limits are as real as the mechanisms and are stated in the case study: one witness today, and we operate it; fixed-seed inference is not deterministic across hardware, so 'inconclusive' is a common and honest verdict; a self-held key does not prevent one person holding two; a proposal is not deployment evidence until a community uses it. None of this is proof of general accountability or of interoperability with anyone's protocol; it is one running instance of the map.
An inclusion proof answers "is this record in the committed sequence"; a range proof answers "was anything hidden between these committed positions"; neither answers "was every eligible action committed." The honest statements are bounded: range complete through checkpoint C; captured under boundary B and rule R; reconciled against observations O during interval T.
A perfectly witnessed record of a false thing is a perfectly witnessed false thing. A producer writes any internal timestamp it likes; an external receipt proves only that the commitment existed no later than the service's time under a clock policy the verifier accepts.
Where an action is replayable — inference at fixed seed, deterministic transforms, account derivations — a second party recomputing it is evidence about the computation that no signature or attestation can give. It arrives with a floor: numerical noise makes "inconclusive" a first-class result, and two colluding recomputers prove nothing.
Identity and authority need an external binding with a validity interval and a policy for later-discovered compromise. The defensible claim is evidence against later denial under stated assumptions, not absolute non-repudiation. A key carried in the bundle is enough to run the mathematics; it is not a trust anchor because the bundle carried it.
Digest-only commitments still leak log size, cadence, relationships, and — for low-entropy values — the values themselves. Evidence should reduce dependence on the producer, not build a surveillance substrate: minimal disclosure, ordinary authorization, and a retention policy that says what later verification will lose.
That a valid signature proves a person or organization authored anything; that a witnessed record is true; that an internal timestamp proves when an action occurred; that registration proves continuity; that a range proof proves every event was captured; that a self-held key identifies a unique owner; that fixed-seed inference is deterministic everywhere; that a producer-operated witness is independent; that digest-only commitments reveal nothing; that a retained bundle is therefore discoverable; or that evidence changes behavior without a party prepared to require it.
Standardize a stable evidence reference for an agent Task and publish its projection, exclusion set, and cross-implementation vectors. Build the requester's half everywhere before building anything hardware-shaped that isn't already built. Keep local inclusion, external registration, and continuity as three results. Make capture obligations explicit. Get a second, unrelated witness operator. Test the privacy and abuse cases. And recruit one requiring party that changes a real decision when the evidence is missing.
The aim is not to make an agent 'trusted.' It is to make consequential claims inspectable, expose the evidence that is missing, and leave the deciding to the party who bears the risk.