# Trust. Proof. Work.

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Carlos Cosme](https://cerebralvalley.ai/u/DoomLordKazaak)
- **GitHub:** https://github.com/carlosfcosme/trust-proof-work
- **Demo video:** https://www.youtube.com/watch?v=LXloegum4Rc
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/230

**The problem (lead with the number).** We ran our five-check audit on 10 real agent skills — the kind an agent loads before it touches money or credentials. 2 of the 10 came back flagged Caution. That is not an estimate: every verdict in the set is a reproducible audit, its findings pinned to file and line, evidence files included. And today, nothing stops an agent from hiring an agent that runs them. The agent economy has payment rails and identity profiles. It has no trust infrastructure: no proof an agent is who it claims, no proof its tools are safe, no proof it delivered before it gets paid.

**What we built.** Trust. Proof. Work. — three layers, one product:

- **Trust.** An agent's platform identity — verified through our verifier interface (the stand-in verifier is the active rail today; the Moltbook adapter sits behind the same interface, its developer approval still pending) — is bound by a signed credential to a durable `did:web` identity. From identity evidence, reputation, and delivery history, a deterministic policy engine assigns a transaction authority tier (T0–T5). Bounded authority, earned — not asserted.
- **Proof.** Before an agent is trusted, its skills pass a five-check audit. A deterministic scanner gathers evidence; Muse Spark interrogates it, and every claim the model makes must cite file and line — uncited claims are rejected by the system. The verdict is issued as a verifiable credential. A flagged skill visibly lowers the agent's tier, and with it, the money it may move.
- **Work.** The proving workload is a real content-studio pipeline (built before the event, self-hosted): agents commission jobs, the studio delivers, delivery proof (QC verdicts + output hashes) is issued as a credential, and sandbox escrow settles automatically — only on verified delivery, exactly once, inside the policy envelope.

Models reason; deterministic code rules. Verdicts, tiers, and money movement are never model output.

**Why the numbers are the submission.** We measured the machine instead of describing it. Against a 20-fixture adversarial gauntlet (verdicts locked in advance, audit rig frozen), the baseline verdict mapper missed: a credential-exfiltration fixture scored Safe; silent self-update was invisible to the mapper. We published those findings, named the rule fixes, and re-ran — the re-run is in the verified results table below. The policy core's safety invariants (no settlement without a valid delivery credential; no approval above tier authority; a flagged verdict caps authority) are encoded and tested against the tier specification. A full demo cycle's model spend was measured in tokens, not adjectives: 3 API calls, 4,440 tokens — the deterministic layers make no model calls at all.

**What was built during the event.** The Trust handshake (platform verification → DID binding → tier assignment), credential issuance for verdicts and deliveries, the deterministic policy engine and the Muse Spark council, sandbox escrow with verified-delivery settlement, the studio integration — and the demo: identity verified on the stand-in rail, a skill flagged live, a tier dropping on screen, work delivered and settled in the sandbox ledger, and an over-reach rejected inside authority, with no human in the loop.

**Prior work, disclosed.** The five-check audit methodology and harness, its verified 10-skill dataset, the content studio pipeline, and the adversarial gauntlet (prep-week evaluation of the existing audit rig).

**Where it goes.** Every agent marketplace hits the same wall: strangers cannot safely pay strangers. Trust. Proof. Work. is that wall's removal — portable, verifiable trust records. And verification is cheap because deterministic layers do the ruling: the full demo job→settle cycle cost 3 model calls and 4,440 tokens.

**Trust (identity → authority).** A ControllerLinkageCredential binds an agent's platform profile to its `did:web` identity (24-hour validity; the identity token is stored only as a SHA-256 fingerprint, and the credential records which verification rail performed the check — see Honesty labels). A deterministic policy engine computes the agent's tier from ten evidence inputs (E1–E10: platform verification, owner verification, reputation band, account age, DID control, linkage validity, worst audit verdict, verified deliveries, disputes, owner freeze) and nothing else:

| Tier | Authority (demo envelope) |
|---|---|
| T0 Unverified | Browse only. May not post, accept, or move value. Cap $0. |
| T1 Identified | Accept/post jobs ≤ $25 (posting escrow pre-funded only). Daily cap $50. |
| T2 Audited | Jobs ≤ $100. Daily cap $300. Requires every presented skill Safe. |
| T3 Proven deliverer | Jobs ≤ $500. Daily cap $2,000. Subcontract ≤ $100. |
| T4 Established | Jobs ≤ $2,500. Daily cap $10,000. Subcontract ≤ $500. |
| T5 Institutional | Owner-granted only, never computed. |

Verdict effects are hard rules, not scores: any presented skill at **Caution caps the agent at T1** while the Caution stands; any **Do-Not-Install freezes value movement at T0** and stays on the agent's public scorecard permanently. An owner freeze forces T0 immediately and holds all pending settlements.

**Proof (audit → credential).** A deterministic scanner gathers evidence across five checks (permissions, network, code, data, updates). Muse Spark interrogates the evidence; an AuditVerdictCredential (30-day validity, bound to the audited package's SHA-256) records the verdict — Safe / Caution / Do-Not-Install — and its findings. Findings are schema-required to carry `{ruleId, severity, citation{file, line}, summary}`: credential issuance refuses any finding without a file-and-line citation, so an uncited model claim cannot become a finding, in the demo or anywhere else. A rules-version bump triggers re-audit offers, never silent verdict changes.

**Work (delivery → settlement).** A DeliveryCredential records each output's format, language, aspect, and SHA-256, plus the QC verdict and a single-use settlement nonce. Escrow settles only against a valid, unconsumed delivery credential whose hashes match the delivered files — exactly once per job. A negotiation council (risk, value, and compliance seats) may approve, reject, or counter **inside** the policy envelope; the policy engine vetoes any council ruling that violates the tier rules, and the veto is final.

**Division of authority.** Models reason; deterministic layers decide. Muse Spark serves the interrogator and the council seats — advisory roles. The scanner, verdict mapping, tier computation, QC, and escrow are deterministic code. No verdict, tier, or movement of money is ever model output.

- **Frozen machinery, layered fixes.** The audit rig is byte-identical to its 2026-10-21 frozen record (`audit_skill.py` sha256 `d5c687d9003feedb2608a2b9d119f6089186eb28d1f80fb7d1e728b816542545`). Every gauntlet fix lives in a rule layer *over* the frozen output — the rig was never edited, so the baseline failure record reproduces exactly and the improvement is attributable to the fixes alone.
- **Citation enforcement at issuance.** It is not a prompt instruction; it is a schema invariant enforced by the credential issuer.
- **Invariants I1–I6** (tier specification §7): no settlement without a valid unconsumed delivery credential; no approval above tier authority; Caution caps authority at T1; Do-Not-Install zeroes it; at most one settlement per job; owner freeze halts all approvals and settlements. The invariant test suite passes 7/7 test groups.
- **Single-use settlement nonces.** Re-presentation of a consumed delivery credential is rejected as forgery; hash-tampered credentials fail signature verification. Both cases are exercised in the demo.
- **Verifiable credentials.** Credentials follow the W3C Verifiable Credentials data model shape and are verified against the issuer before anything acts on them (demo build: HMAC-SHA256 demo-grade signatures — see Honesty labels); evidence is pointed to by hash, not embedded; history is append-only — corrections are new credentials, never edits.
- **Real workload, real outputs.** The demo job produces 9 media renditions (EN / ES / JA × 16:9 / 9:16 / 1:1), each QC-checked (count, dimensions, hash recompute, distinctness) before its hash enters the delivery credential.

| Measurement | Result |
|---|---|
| Golden corpus gate (10 real skills) | **8 Safe / 2 Caution / 0 Do-Not-Install** — exact match to locked ground truth |
| Gauntlet v1, frozen baseline (2026-10-21 record) | Reproduced exactly: **13/20 exact, burns caught 3/6** |
| Gauntlet v1, with rule-fix layer | **20/20 exact, burns 6/6, clean false positives 0/8** |
| Gauntlet v2, with rule-fix layer | **10/10 exact** |
| Policy invariants I1–I6 | **7/7 test groups pass** |
| Full demo run | **14/14 checks pass** |
| Council (demo, live Meta API key) | All 3 seats served by **Muse Spark 1.3** (Standard tier); risk seat dissented with reasons; decision approved 2–1 |
| Demo model spend | **3 API calls, 4,440 tokens** (deterministic layers: 0 calls) |
| Frozen rig integrity | `audit_skill.py` sha256 `d5c687d9003feedb2608a2b9d119f6089186eb28d1f80fb7d1e728b816542545` — byte-identical to the 2026-10-21 record |

Demo denials exercised in the verified run: an over-authority job ($400 against a $25 effective cap) denied under I2; a forged delivery credential denied under I1; a double settlement of the same job denied under I5; a planted citation-less claim refused by both the interrogator and credential issuance.

--- Honesty labels ---

- **Identity rail.** Identity verification currently runs on a **stand-in verifier behind the same adapter interface** the production Moltbook verifier will use (the Moltbook side is a stub today), while the Moltbook developer application is pending. Every linkage credential records which rail verified it (`stand-in-verifier` vs `moltbook-verify-identity`), and the scorecard labels the rail. The distinction is never blurred.
- **Credential signatures.** Credential signatures are **HMAC demo-grade** (issuer key held in the local state store), not production DID-key signatures. The credential format, verification flow, and failure behavior are the production design; the signing primitive is the demo substitution.
- **Demo media.** The demo's media renditions are **locally rendered** by the studio pipeline on the build machine — real files, real QC, real hashes; they are not pulled from a hosted production service.
- **Escrow.** Escrow is a **demonstrated ledger, not a live payments rail**: settlement moves sandbox units in an append-only ledger that records every settle and every denial with its reason. No real money moves.

## More from Meta Global AI Developer Hackathon

- [Gabriella Baris](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/227)
- [100 millions Nigerians speak pidgin English](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/228)
- [ConduitAI](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/229)
- [shivam](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/231)
- [Rackham](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/232)
- [f2j](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/233)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/230. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt