Agents That Show Their Work

Knowledge Bank · Shelf: Verification & Proof

A system that asks to be trusted has told you nothing. A system that hands you a record you can check yourself has told you something you can test. This piece is about the second kind — how an automated system's work becomes something a second party can audit instead of merely believe.

We draw on two house papers, both staged in our corpus: "Guardian Mesh: Handshake-Shaped Invocation Control for AI Agents" (16 October 2026) and "Conduit: A Managed MCP Connector Marketplace for AI Agents" (16 October 2026). They describe two systems in different states of maturity. We keep those states separate and exact, because the whole point of a verifiable record is that it does not flatter itself.

Guardian Mesh: judgment before execution

Guardian Mesh is a pre-execution judgment layer for AI agents. A caller presents an action; the mesh evaluates it against deterministic policy before it runs; the decision is sealed into a cryptographic proof that can be verified offline. The architecture separates sight across five stages: Sentinel (protocol-firewall validation), Gatekeeper (handshake-session authentication), Witness (signs the verdict digest; sees hashed proof only), Arbiter (policy decision), and Vault (seals and persists the audit trail; exports no raw keys). No stage both observes and enforces, and the signer never sees behaviour.

Three governing laws hold this together. No component has a complete picture. The enforcement path is deterministic — no probabilistic component, no language model, same input, same output. And the owner's closed-path rule, "Doctrine 0," says things may flow only in a specified handshake shape: a handshake that cannot happen in the specified shape cannot happen at all, so an undesired invocation is unrepresentable rather than merely denied.

A boundary crossing carries two independent confirmations: an HMAC-SHA256 handshake session with a 300-second TTL, and the request envelope's ML-DSA-65 (FIPS 204) signature verified against the key bound to the session at handshake. A missing or non-verifying signature is refused before the policy stage is reached. Fail-closed is the documented default — no answer from the daemon means BLOCK, and undecided means BLOCK.

The unit of trust is a sealed envelope: payload, CRC32C digest, ML-DSA-65 signature, timestamp, nonce. The daemon exposes exactly three calls — Evaluate (a verdict of ALLOW, BLOCK, THROTTLE, or ESCALATE, plus a signed audit proof), VerifyProof, and Health.

What the releases actually show

Two releases are on record. v0.3.0 (14 October 2026) passed 47 of 47 tests on a fresh checkout; wire-level proofs came in at 9 of 9 against the branch build and 9 of 9 again against the deployed daemon — valid signature passes; garbage signature, wrong key, tampered payload all refused; keyless handshake refused. v0.4.0 (15 October 2026) passed 58 of 58 tests, with wire proofs at 16 of 16 against both the release build and the deployed daemon, including a counted 115-request burst in which exactly 100 requests were allowed and exactly 15 rejected at the specified rate limit.

Both releases passed the release gate with findings. The findings are published in the record, not smoothed over. That matters more than the pass counts.

Alongside the gate runs sits a discipline of named checks. The gate files requirements into the mesh as spec inputs — 47 on file — under one rule: a capability becomes a requirement only after it is behaviour-proven here. Valid verifies, tampered fails, silence blocks.

Conduit: receipts a buyer can check

Conduit is a managed marketplace of MCP connectors, through which AI agents obtain data and services on their owners' behalf inside owner-set spending policies. Its first connector serves SEC EDGAR filings and fundamentals.

Every purchase produces a signed receipt the buyer can look up independently. The receipt token is itself the credential, so a second party can check what was bought without asking the seller's server to vouch for it.

Its release protocol runs through a machine scan; deep review of every lead; the full test suite in a clean environment (177 of 177 at the final gate run in the paper's period); regression tests that must fail on the pre-fix code and pass on the fixed code; page-level proof of served pages; a customer-journey proof on the deployed system; and attacker-view probes against the deployed server, not a local build. In the recorded customer-journey run, a fresh free key made a company-facts call returning revenue of $416,161,000,000, matching EDGAR's record.

The limits, stated plainly

Guardian Mesh. The signing key is generated per boot today, so a proof verifies only against the instance that issued it; persistent key storage is specified, not built. There is no audit read path — the audit trail is appended to a hash-chained log, but no shipped surface lets a second party inspect it; the read call is not built. THROTTLE and ESCALATE exist in the protocol, but no code path emits them as policy verdicts yet. The Health endpoint's firewall counters are constants, not measured values — a known gate finding, recorded openly. The 47 gate-filed spec inputs are requirements, not proven capabilities; release-evidence certification among them is spec-first, unbuilt. Multi-node consensus, trusted-execution attestation, external anchoring of the audit chain, and the planned Lean 4 formal verification are designed, not built. Transport between callers and the daemon is plaintext gRPC today, with TLS termination a deployment-side concern. Performance is unmeasured — no latency figure exists in the records.

Conduit. No live customer payment has been processed: the complete payment cycle is proven in Stripe test mode from server-side records, and live cutover has not happened. The batch described is a release candidate in soak, with findings still open in its record.

General. "Show your work" is a property of records, not of intentions. Where a read path or a persistent key is missing, the audit a second party can perform today is narrower than the design's promise — and the pieces say so.