Provenance, traces, attestations — every system proves custody of the answer; none opens the record of the work

What the rest of the world built instead

The inflation is understandable once you see what the field actually sells. Every serious system of the last fifteen years proves something about artifacts. None of them opens the record of the work.

W3C PROV-O (2013) — the web standard for provenance. Models entities, activities, agents, and derivation edges: wasDerivedFrom, wasAttributedTo. It records that an artifact derived from another, as a graph. The record itself is curator-authored; the standard deliberately carries no verification semantics. A PROV graph says what someone claims the lineage was. It cannot be checked.

Sigstore / SLSA / in-toto (2020–) — the software supply-chain stack. Each build step attested, the build graded L1 to L3 for tamper-resistance, everything signed keylessly into a public transparency log. It proves a binary came from this source through this pipeline, untampered. It says nothing about behavior: a SLSA Level 3 build of malicious code is exactly as well-attested as a benign one. Custody of the artifact, perfectly proven. The work, untouched.

C2PA Content Credentials (2021–) — cryptographic provenance for media, now backed by Adobe, Microsoft, Google, OpenAI, Sony, and effectively mandatory for synthetic content under EU AI Act Article 50 as of August 2026. It proves who or what made a file and how it was edited. Its own architects state the limit plainly: provenance is not authenticity. A valid credential on a deepfake proves where the deepfake came from. And platforms strip the manifests on upload, so even that proof dies in transit.

Reproducible builds — bit-for-bit determinism, independently verified. Proves the process is mechanically stable. Same inputs, same output. Nothing about whether the process was the right one.

Agent observability — LangSmith, Langfuse, Arize Phoenix, Helicone (2023–) — the closest neighbor and the most instructive miss. These tools capture everything: prompts, completions, tool calls and arguments, control flow, token cost, prompt versions. This is real observation, and it is privately owned. The trace sits in the operator's dashboard, mutable, unaccountable to any outsider, carrying no verdict. The field's own literature admits the failure in the same breath: agent failures are semantic — a wrong tool result returns 200, a loop looks like work, the trace stays green while the agent fails. Observation without judgment, behind a login.

Model cards, datasheets, AI governance platforms (Credo AI, Holistic AI, Saidot) — documentation about models. Intended use, risk registers, regulation mapping. The decisions never touch the product. It proves paperwork exists.

Palantir Ontology — the strongest commercial cousin. Governed objects and action types: every change flows through a typed, permissioned action, validated before the write, logged with parameters and identity. Genuinely good audit of who performed which authorized action. The agent's reasoning is never examined, and the entire layer is proprietary — no outsider can inspect, let alone disprove.

Chain of custody, notarization, git, EU AI Act Article 12 — the old systems and the new law. Human attestation of custody; content-addressed file history; a mandate that logs exist. Each proves its one thing. None opens the reasoning.

The segregation, exactly

Every system above proves some combination of origin, integrity, and observation — where did this come from, was it altered, what ran. The fourth property, the only one that matters about work, is empty across the entire field: can a stranger reconstruct how this result came to exist, from the raw record, without trusting the operator, and say so if the record contradicts the claim?

That property is the whole difference. Everything else proves custody of the answer. Proven work proves the work.

And the tests are as reduced as the definition. Three things a stranger must be able to do, and each is a consequence of the one open record, not a new feature:

Walk it. Request to answer, raw payloads only, no summary trusted. Possible because the record is complete.

Break it. Return one of three verdicts: supported, missing evidence, contradicted by the record. Possible because the record is open to the stranger, not just to the operator — a bounded credential into the evidence, not a screenshot of a dashboard.

Read its grade. The record states its own gaps, and says PARTIAL when pieces are missing. Possible because honesty about the boundary costs nothing once the record itself is the product.

The first specimen already behaves this way: PW-0001 audited the article that defines the primitive and returned PARTIAL — consideration inventory reconstructed rather than contemporaneous, raw formation record not yet permanently open, no independent challenge yet run. A nine-field checklist would have given it nine checkmarks. The open record gave it a grade a stranger can verify.

What it does not prove

One record, honestly bounded. Proven work does not prove the work was correct — a perfectly open record can document a decision resting on a bad criterion, and the record will show you the criterion, which is the point. It does not prove the work produced value — that verdict belongs to whoever uses it. It proves the work happened exactly as recorded, that nothing in the formation is hidden, and that anyone can check.

That is the reduced elegant solution, and it did not need nine fields, or three primitives, or any taxonomy at all. The ledger is open. The answer is in it. The considerations are in it. Walk it, break it, read its grade. Everything else is packaging.

This essay is the landscape argument of the proven-work family. The canonical definition — the claim, the record, and the door, with the standard as a checklist and the live receipts — is Proven work: the base unit — a claim, a record, and a door; the reference object is PW-0002, the sealed statutory panel.