Who can check an agent record
Whether an agent did what its record says comes down to one test: a party that distrusts the issuer checks the record offline, an observer the agent cannot reach produced it, and the check is held to a public corpus. Five designs face that test here. The rows are classes of design, not products. Every cell links to a corpus, a recorded run or the primary text of a standard, and scripts/vantage-grid-gate.py fails the build when a link goes missing or stops resolving.
The grid
| Design class | Verifiable offline by a party that distrusts the issuer | Produced by an observer the agent cannot reach | Passing a public corpus | Meets all three |
|---|---|---|---|---|
| Self-held signed session record | Signature only. A DSSE signature binds the bytes to a key (DSSE protocol); the issuer holds that key and chose the bytes. | No. The runtime under observation writes and signs it. A second key the runtime mints can re-attest altered content and every signature still verifies (srr-c-3). |
A corpus exists for verifiers of this class: vectors-self-reported-record refuses the records a signature-only check accepts. |
No |
| Vendor dashboard verify button | No. The verdict comes from the issuer's service, and a relying party accepts a verdict only from a Verifier it trusts (RFC 9334, section 7.1). | No. One party holds the record and computes the verdict (RFC 9334, section 7.1). | No. A corpus run invokes a command the reader holds once per vector (verifier contract); a hosted button offers no such command. | No |
| Observability trace | No. The OTLP Span message defines no signature field (trace.proto). |
No. Instrumentation runs inside the code it reports on: "Each signal provides a mechanism for software to describe itself" (OpenTelemetry overview). | No. With no signed field there is nothing for a corpus to refuse (trace.proto). |
No |
| Transparency-log receipt | For registration. A Receipt "is universally verifiable without online access to the TS" (RFC 9943, section 4); the reader trusts the log's key, not the issuer. | No. The log records what the issuer submits: "Transparency does not prevent dishonest or compromised Issuers" (RFC 9943, section 4). | Yes. sigstore-conformance tests Sigstore clients, and vectors-scitt-cose tests the COSE carriage around an agent record. |
No |
| Independent observer with a public corpus | Yes. The verifier is a pinned wheel that installs and replays with no network (air-gap guide); our run of release 0.35.0 replayed with every network route closed. | Yes, and the verifier checks it. A record that claims a below-observed vantage with a commitment key the observed party signs with is refused, and the consumer anchors the observer's key out of band (observed-effect predicate). |
Yes. vectors-observed-effect behaved as declared in our run, and a reader this repository did not write rejected every reject member. |
Yes |
What the last row reports, does not prove, and needs no trust in
| Reports | Does not prove | Needs no trust in |
|---|---|---|
| What changed inside a declared path scope, from the vantage the record names, with the gaps the observer disclosed. | That the observer's key belongs to the observer you think it does. Anchor that key out of band, as you would any signer (observed-effect predicate). | The agent, its operator, the issuer's service, or this repository's hosting: the wheel, the corpora and the signed digest list check offline (release verification). |
Run it yourself
uvx agent-evidence-vectors==0.36.3 --corpus vectors-observed-effect
uvx agent-evidence-vectors==0.36.3 --corpus vectors-self-reported-record
Each prints verdict: every member behaves as MANIFEST.json declares when the reference reader agrees with the corpus. The verifier contract covers scoring your own verifier.