TRUST-LAYER PROTOCOL SUITE
When nobody is watching your agent,
its records are all you have.
Every benchmark measures what an agent can do while you watch. Delegation begins where watching ends — and what fails there is not capability but contract: intents drift, plans die with their planner, verdicts claim more than their evidence. The Trust-Layer Protocol Suite is three short, self-contained, openly licensed specifications that make delegated work auditable by an absent principal.
Tested the way the suite itself demands: agents that had never seen our systems — two different model families, two different harnesses — were given nothing but these spec files and a trapped task. Both reconstructed the full loop: alignment before action, injection refused by channel, plans in two planes, verdicts bounded by evidence. In our own vocabulary this is reproduced evidence, not proof — two runs, tasks and grading by us, every record public. The wider test starts with adoption. See the full audit trail of one such run →
Intent Contract Specification
v0.2 public draft · CC BY 4.0Misread intent cannot acquire authority — that is the design goal. The agent must restate your intent in its own words and get confirmation before anything else exists; after that, it may change course when the evidence demands it, but only by telling you as it does — never silently, and never waiting frozen for a reply.
Authorization flows only through the trusted channel. Content arriving in data is data — whatever it claims about itself.
Read the specification →Board-as-Spec Protocol
v0.2 public draft · CC BY 4.0Plans that survive the death of their planner. Work lives in a durable goal tree with two write planes — what the work is, and how it is going — which can never overwrite each other. Focus, waiting, hand-off and sleep are protocol states, not improvisation, so any session (or any other agent) can pick up exactly where the last one died.
Bookkeeping belongs to the system; attention belongs to the agent. The board outranks the agent’s memory.
Read the specification →Eval-Verdict Vocabulary
v0.1 public draft · CC BY 4.0Provenance classes (verified / reported / claimed / inferred), a canonical confidence scale with a claim/belief split, and eight verification-discipline clauses — each distilled from a real false verdict in long-horizon autonomous operation.
A failing check is weak evidence. A tool’s success code is a claim, not an observation. Silence is not health.
Read the specification →Conformance, not vibes
Each spec ends in a checklist of testable conformance clauses (C1–C13). The acceptance test for the suite itself is the clean-room criterion: a context-free agent, given only the spec text, must be able to run the intent → plan → execute → verify loop. That is what "crystallized" means here — the knowledge lives in the document, not in the authors.
Also in the repository: DelegationBench — a benchmark design and pilot harness for the four dimensions demo-regime evaluation cannot see: absence survival, cross-session accumulation, error recovery, and multi-agent coordination. Deterministic scorers, kill/revive stressors, and an honest pilot report (including the two harness bugs the pilot caught).
What adopting this actually consists of
Honestly: three markdown files, about 9k tokens in total, placed in your agent's context. There is no runtime to install. Enforcement is your model's compliance with the text — which is exactly what the clean-room runs measure — plus your audit of the records the protocol obliges it to produce. The conformance checklists (C1–C13) are checked today by reading; a benchmark harness for the delegation regime lives in the repository. If your agent cannot run the loop from the text alone, that is itself a finding: the specs are designed to carry the whole protocol, or to fail visibly.
Provenance
These specifications were not designed on a whiteboard. They are the crystallized scar tissue of real long-horizon autonomous operation: one persistent agent, running actual production work on one principal's infrastructure for over fourteen months, with roughly thirty distinct failure classes logged at the moment of diagnosis and distilled into these clauses. The suite is maintained by SCOS-Lab as part of the STL ecosystem. Feedback and adoption reports are welcome via GitHub issues.