The axis we want to be measured on

How independent is the evidence?

A signed record of an AI decision is becoming ordinary. So the useful question is not whether a system can sign. It is how far the evidence is independent of the party that produced it, and that has degrees.

7

rungs

4

you can check today, in a browser or one command

3

are open problems, and we name the work of others that says so

The ladder

1. 01

   Signed

   checkable

   Did the party that made the decision put its name to it?

   An Ed25519 signature over a canonical record. This is the floor, not a differentiator: most systems in this category now sign. Our issuer key has been signing in production since April 2026 and its rotation history is published.

   The published key →
2. 02

   Independently verifiable

   checkable

   Can someone check it offline, without asking us?

   Two verifiers we wrote separately, in TypeScript and Python, that must return the same verdict on the same bytes. Every published conformance vector passes on both. The check runs offline against a pinned key. Others publish verifiers too; what is specific here is the published vector set and the requirement that two implementations agree. Both are ours, so the next test is an implementation written independently from the published specification.

   Run it yourself →
3. 03

   Independently anchored

   checkable

   Could we quietly remove a record after the fact?

   Every record enters one public append-only log built on RFC 6962, so a record cannot be withdrawn without breaking a proof someone already holds. The log is anchored at a published size and root, and heads pinned before that anchor are stated not to chain. A defect in the ordering was found and fixed on the day the log opened, and the note about it has never been removed.

   The live log and its anchor →
4. 04

   Adversarially tested in public

   checkable

   Has anyone outside tried to break it, and were the failures published?

   A public forgery bounty ran from 27 August to 12 September 2026. Four defects found by people outside the company, each fixed and covered by a published test: a 32-bit cursor in proof verification, key ordering outside ASCII, the policy_applied comparator, and a decoder that accepted bytes that were never signed. Our own sweeps found others, including a canonical-number divergence and a signature-encoding leniency. All were fixed and written into a public changelog. The bounty is closed and offers no reward.

   The bounty and what it found →
5. 05

   Omission-detectable

   open

   Can you tell that something was never recorded at all?

   A signature proves that what you are holding is authentic. It says nothing about what is missing. This is the field’s acknowledged limit, not ours alone: Agent Flight Recorder (arXiv 2609.01931) states plainly that within-epoch suppression is undetectable from the log alone, and Audita (arXiv 2608.22160) proves a related impossibility rather than solving it. Omission is the problem we are working on next.

6. 06

   Counterparty-attested

   open

   Does anyone other than the operator sign what they saw?

   While the operator is the only signer, the party producing the evidence is the party being evidenced. Sello (arXiv 2606.04193) states the problem exactly and inverts it: let the receiving service sign what it observed. Its own named open problem is not the cryptography but the incentive, since a counterparty has to agree to sign. That is a commercial question before it is a technical one.

7. 07

   Physically enforced

   open

   Can a machine refuse to move without a valid grant?

   Every system we are aware of, ours included, performs the refusal in software running alongside the thing it governs, so a compromised controller can proceed anyway. In a search of the 2026 literature we found no paper or implementation where a secure element gates an enable line directly. That is absence of evidence from a bounded search, not proof that nobody has done it. It is the direction our edge-signer work points, and it is research, not a product.

What this is not

It is not a claim that we invented any single mechanism on this ladder. Pre-execution authorisation, signed refusals, consumable authority and cross-language verifier agreement all have prior art, some of it older than our own work on them. It is not a claim that the open rungs are ours to solve alone. And it is not a certification: Aqta issues signed evidence and audit trails, never certificates.

Last reviewed September 2026 · rungs move only when the evidence does