The shape keeps reappearing: sealed evidence, fail-closed, recomputable by anyone

Sources cited in this piece · the public thread on uber/ADR issue #163, including the tool maintainer's comment quoted verbatim below and our own public reply with freshly measured vectors · the Linux Foundation Decentralized Trust lab Agent-Authority-Conformance and its conformance suite · our own public artifacts: iqa.org/conformance/, iqa.org/sealed-mcp/, iqa.org/attestations/. Other implementations are described by their public, verifiable patterns and deliberately left unnamed — this piece credits shapes, not brands.

Three times in three weeks, the same shape arrived from unrelated directions. Different teams, different languages, different layers of the stack — and underneath all of it, the same three properties, stated in different vocabularies and shipped without any of them knowing about the others. When a shape reappears independently, it is not fashion. It is the problem statement talking.

The first arrival came through a public issue thread on Uber's Agent Reference architecture (#163). A maintainer of an open-source tool that pins MCP tool-contract hashes — Ed25519-signed, with release hashes anchored on a public chain — read our proposal for portable, offline-verifiable attestation and replied that the separation of attestation from verdict is, in their words, “a primitive we already run in production.” Different layer, same spine: the signed record proves what the bytes are; what the bytes mean is deliberately someone else's call.

The second came from the payments side of the agent economy — a team building evidence infrastructure for machine-to-machine payments, whose action references are content addresses: a hash over canonically serialized fields, so the reference is the claim it names and no registry sits between them. Different domain, same instinct: if you want a receipt that outlives the relationship between the parties, derive it from the thing itself.

The third came from a European trust layer for agent commerce. Its public site leads with a sentence we could have written: identity says who an agent is, authorization says what it may do — and the record of what it actually did is sealed the moment the act happens, anchored where anyone can check it, handed to every party in the dispute alike. Their verifier's honest failure mode has a name of its own: an action that cannot be decoded returns for review — never a silent pass.

And the fourth is us. Our conformance records pin the inputs behind hard digest gates — a tampered vector is refused before any scoring happens — seal the artifact with an organ signature, and publish it with two addresses derived from the artifact's own digest. Our attestation vocabulary carries an explicit value for authority could not be determined, precisely so that never reaching a source is never recorded as reaching a bad conclusion. Our verdicts on MCP tool contracts are sealed envelopes, re-verifiable offline by anyone, with the verification procedure itself public.

Why is convergence the honest reading, rather than influence? Because the four teams did not arrive through each other's work: the tool maintainer found us through a public issue thread the week we answered four open questions on the W3C Agent Protocol CG list; the payments team and the commerce layer surfaced through entirely separate channels. And because the shape is not a style that could diffuse — it is a set of constraints that eliminate alternatives. A claim that cannot be recomputed by a stranger is a rumor, so evidence systems drift toward public bytes and public methods. A verifier that guesses fills unknowns with fictions, so honest systems grow an explicit could not determine. A record created on request can be created differently on a second request, so anyone who has watched a dispute begins sealing at the moment of action. Each property is a theorem about what survives adversarial attention, and theorems do not need citations.

The differences matter as much as the overlap, and honesty about them is what keeps this from becoming a bandwagon essay. The other lanes anchor identity in resolvable registries; ours derives names from authorities and leaves the registry empty. Their records are anchored to be permanent; ours carry a 120-second lease because freshness is a property, not an archive format. Their evidence is about conduct — what an agent did; ours is about standing — whether the counterparty may be trusted now. Those are complementary positions, not competing ones, and the boundaries are stated in our specifications in writing. Convergence on a shape is not convergence on a stack; a mechanism is scored on what it claims, and each of the four claims a different thing.

What the four lanes share is bigger than any of the differences, and it is cultural before it is technical: verification you do not have to take anyone's word for. Check it rather than trust it — not as a slogan, but as a design constraint that decides where bytes live, when records are created, and what a verifier is allowed to say when it cannot find out. A month ago this was our odd little obsession; this month it is a shape that keeps reappearing. We would rather be one honest implementation among several converging ones than the only voice shouting — the theorems were never ours anyway. They were waiting in the problem.