The axis we want to be measured on
How independent is the evidence?
A signed record of an AI decision is becoming ordinary. Several teams now produce one, and the mechanisms behind it are converging fast. So the useful question is not whether a system can sign. It is how far the evidence is independent of the party that produced it, and that has degrees.
Seven rungs. Four you can check today, in a browser or one command. Three are open problems, and we name the work of others that says so. We would rather be measured on this axis and be visibly incomplete than claim a novelty that a literature search dislodges.
The ladder
- 01checkableSignedDid the party that made the decision put its name to it?An Ed25519 signature over a canonical record. This is the floor, not a differentiator: most systems in this category now sign. Our issuer key has been signing in production since April 2026 and its rotation history is published.The published key →
- 02checkableIndependently verifiableCan someone check it without software we wrote, and without asking us?Two verifiers, written separately in TypeScript and Python, that must return the same verdict on the same bytes. 54 of 54 published conformance vectors pass on both. The check runs offline against a pinned key. Others publish verifiers too; what is specific here is the published vector set and the requirement that two implementations agree.Run it yourself →
- 03checkableIndependently anchoredCould we quietly remove a record after the fact?Every record enters one public append-only log built on RFC 6962, so a record cannot be withdrawn without breaking a proof someone already holds. The log is anchored at a published size and root, and heads pinned before that anchor are stated not to chain. A defect in the ordering was found and fixed on the day the log opened, and the note about it has never been removed.The live log and its anchor →
- 04checkableAdversarially tested in publicHas anyone outside been paid to break it, and were the failures published?A standing bounty pays for a forged receipt or a hidden removal. Four outside researchers have reported real verifier defects since it opened: a signature-encoding defect, a canonical-number divergence, an ordering comparator and a decoder that accepted bytes that were never signed. All four were fixed and written into a public changelog. We publish the failures because a system whose defects are hidden cannot be assessed.The bounty and what it found →
- 05openOmission-detectableCan you tell that something was never recorded at all?A signature proves that what you are holding is authentic. It says nothing about what is missing. This is the field’s acknowledged limit, not ours alone: Agent Flight Recorder (arXiv 2609.01931) states plainly that within-epoch suppression is undetectable from the log alone, and Audita (arXiv 2608.22160) proves a related impossibility rather than solving it. We do not claim to have solved it, and it is the problem we are working on next.
- 06openCounterparty-attestedDoes anyone other than the operator sign what they saw?While the operator is the only signer, the party producing the evidence is the party being evidenced. Sello (arXiv 2606.04193) states the problem exactly and inverts it: let the receiving service sign what it observed. Its own named open problem is not the cryptography but the incentive, since a counterparty has to agree to sign. That is a commercial question before it is a technical one, and it is the next thing we intend to attempt.
- 07openPhysically enforcedCan a machine refuse to move without a valid grant?Every system we are aware of, ours included, performs the refusal in software running alongside the thing it governs, so a compromised controller can proceed anyway. In a search of the 2026 literature we found no paper or implementation where a secure element gates an enable line directly. That is absence of evidence from a bounded search, not proof that nobody has done it. It is the direction our edge-signer work points, and it is research, not a product.
Why we publish the open rungs
An evidence company that hides the limits of its own evidence is asking for the thing it says you should never give. Rungs five to seven are unsolved here and, as far as we can tell, unsolved generally. Naming them is not modesty. It is the same discipline as publishing the conformance vectors and paying strangers to break the verifier: the claims we make are the ones you can test, and the ones we cannot support we mark.
What this is not
It is not a claim that we invented any single mechanism on this ladder. Pre-execution authorisation, signed refusals, consumable authority and cross-language verifier agreement all have prior art, some of it older than our own work on them. It is not a claim that the open rungs are ours to solve alone. And it is not a certification: Aqta issues signed evidence and audit trails, never certificates.
Start at rung two
The fastest way to test any of this is to stop reading and check a record. It takes about ten seconds, needs no account, and the verifier is not ours to fake.
Check a receiptLast reviewed September 2026 · rungs move only when the evidence does