{"_ai_door":{"see":"https://miscsubjects.com/start","note":"Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."},"slug":"custody-of-the-answer","title":"Provenance, traces, attestations — every system proves custody of the answer; none opens the record of the work","body":"Start with the thing everyone keeps inflating.\n\nAsk a language model to define \"proven work\" and it will hand you a nine-field checklist: demand, considerations, formation, replay, deliverable, completeness, robustness, surety, open gaps. Nine sounds rigorous. Nine is taxonomy bloat — a model expanding one idea into a grid because grids look like authority. Another model, asked to reduce it, returned three primitives: Input, Execution Trace, Output Boundary. Cleaner, and still wrong, because input and output are not separate objects. Any system that actually does work produces them in a single payload: the request goes in, the response comes out, and both halves are written to the same record at the same moment.\n\nSo here is the reduction, as far as it goes.\n\n**Proven work is one open record.** The raw payloads — every input, every output, every tool call and its return, every failure and its repair — plus the answer they terminated in, plus the considerations: what was weighed, what was excluded, what the record does not cover. All of it inspectable by a stranger. That is the whole definition. Not nine fields. Not three primitives. One record, open, that a zero-context reader can walk from request to answer without trusting anyone's summary.\n\nEverything the checklists try to name is already inside that sentence. Completeness is not a field; it is the question \"is anything missing from this record,\" answered by the record itself. Surety is not a field; it is the gap between what the record shows and what it does not, stated on its face. Replay is not a field; it is what an open record makes possible by existing. The fields were never properties of the work. They were properties of not having the record.\n\n## What the rest of the world built instead\n\nThe inflation is understandable once you see what the field actually sells. Every serious system of the last fifteen years proves something about artifacts. None of them opens the record of the work.\n\n**W3C PROV-O (2013)** — the web standard for provenance. Models entities, activities, agents, and derivation edges: wasDerivedFrom, wasAttributedTo. It records that an artifact derived from another, as a graph. The record itself is curator-authored; the standard deliberately carries no verification semantics. A PROV graph says what someone claims the lineage was. It cannot be checked.\n\n**Sigstore / SLSA / in-toto (2020–)** — the software supply-chain stack. Each build step attested, the build graded L1 to L3 for tamper-resistance, everything signed keylessly into a public transparency log. It proves a binary came from this source through this pipeline, untampered. It says nothing about behavior: a SLSA Level 3 build of malicious code is exactly as well-attested as a benign one. Custody of the artifact, perfectly proven. The work, untouched.\n\n**C2PA Content Credentials (2021–)** — cryptographic provenance for media, now backed by Adobe, Microsoft, Google, OpenAI, Sony, and effectively mandatory for synthetic content under EU AI Act Article 50 as of August 2026. It proves who or what made a file and how it was edited. Its own architects state the limit plainly: provenance is not authenticity. A valid credential on a deepfake proves where the deepfake came from. And platforms strip the manifests on upload, so even that proof dies in transit.\n\n**Reproducible builds** — bit-for-bit determinism, independently verified. Proves the process is mechanically stable. Same inputs, same output. Nothing about whether the process was the right one.\n\n**Agent observability — LangSmith, Langfuse, Arize Phoenix, Helicone (2023–)** — the closest neighbor and the most instructive miss. These tools capture everything: prompts, completions, tool calls and arguments, control flow, token cost, prompt versions. This is real observation, and it is privately owned. The trace sits in the operator's dashboard, mutable, unaccountable to any outsider, carrying no verdict. The field's own literature admits the failure in the same breath: agent failures are semantic — a wrong tool result returns 200, a loop looks like work, the trace stays green while the agent fails. Observation without judgment, behind a login.\n\n**Model cards, datasheets, AI governance platforms (Credo AI, Holistic AI, Saidot)** — documentation about models. Intended use, risk registers, regulation mapping. The decisions never touch the product. It proves paperwork exists.\n\n**Palantir Ontology** — the strongest commercial cousin. Governed objects and action types: every change flows through a typed, permissioned action, validated before the write, logged with parameters and identity. Genuinely good audit of *who performed which authorized action*. The agent's reasoning is never examined, and the entire layer is proprietary — no outsider can inspect, let alone disprove.\n\n**Chain of custody, notarization, git, EU AI Act Article 12** — the old systems and the new law. Human attestation of custody; content-addressed file history; a mandate that logs exist. Each proves its one thing. None opens the reasoning.\n\n## The segregation, exactly\n\nEvery system above proves some combination of origin, integrity, and observation — where did this come from, was it altered, what ran. The fourth property, the only one that matters about work, is empty across the entire field: can a stranger reconstruct how this result came to exist, from the raw record, without trusting the operator, and say so if the record contradicts the claim?\n\nThat property is the whole difference. Everything else proves custody of the answer. Proven work proves the work.\n\nAnd the tests are as reduced as the definition. Three things a stranger must be able to do, and each is a consequence of the one open record, not a new feature:\n\n**Walk it.** Request to answer, raw payloads only, no summary trusted. Possible because the record is complete.\n\n**Break it.** Return one of three verdicts: supported, missing evidence, contradicted by the record. Possible because the record is open to the stranger, not just to the operator — a bounded credential into the evidence, not a screenshot of a dashboard.\n\n**Read its grade.** The record states its own gaps, and says PARTIAL when pieces are missing. Possible because honesty about the boundary costs nothing once the record itself is the product.\n\nThe first specimen already behaves this way: PW-0001 audited the article that defines the primitive and returned PARTIAL — consideration inventory reconstructed rather than contemporaneous, raw formation record not yet permanently open, no independent challenge yet run. A nine-field checklist would have given it nine checkmarks. The open record gave it a grade a stranger can verify.\n\n## What it does not prove\n\nOne record, honestly bounded. Proven work does not prove the work was correct — a perfectly open record can document a decision resting on a bad criterion, and the record will show you the criterion, which is the point. It does not prove the work produced value — that verdict belongs to whoever uses it. It proves the work happened exactly as recorded, that nothing in the formation is hidden, and that anyone can check.\n\nThat is the reduced elegant solution, and it did not need nine fields, or three primitives, or any taxonomy at all. The ledger is open. The answer is in it. The considerations are in it. Walk it, break it, read its grade. Everything else is packaging.\n\n\nThis essay is the landscape argument of the proven-work family. The canonical definition — the claim, the record, and the door, with the standard as a checklist and the live receipts — is [[proven-work]]; the reference object is [[three-models-deliberate-one-statutory-question|PW-0002, the sealed statutory panel]].\n","register":"technical","hero":"https://miscsubjects.com/img/gen/arcads-gpt-image-704d78a0-cfe7-4e4b-916d-2afb65e394d2.png","hero_brief":"Sealed evidence boxes versus one opened mechanism — custody proofs against the open record.","editorial_review":{"headline_subject":"A field survey of nine proof systems and the one property none of them has: an open record of the work itself","hero_subject":"A museum row of identical sealed black evidence boxes stamped with gold wax seals, the front box cut open to expose glowing clockwork and circuit traces inside","visual_action":"The open box reveals its interior mechanism while every other box stays sealed — custody proven versus the record opened","rationale":"The article's thesis is that every provenance system seals and stamps while only Proven Work opens the interior; the image is that contrast literally.","inspected":true,"inspection_note":"Inspected 2026-08-03: row of wax-sealed black boxes receding into dark, front box in cross-section with brass gears and blue circuit glow, brass plaque with no text; no people, no logos, distinct composition from prior heroes (server+folder, scanner arms).","hero_brief":"Sealed evidence boxes versus one opened mechanism — custody proofs against the open record."},"tags":["canonical","proven-work","comparison","provenance","observability"],"category":"canon","style":{},"claims":[{"id":"c1","text":"Proven work is one open record: every raw payload in and out, the answer they terminated in, and the considerations, inspectable by a zero-context stranger; the nine-field and three-primitive checklists are taxonomy inflation of that single property.","tier":"definition","source_ids":["s1","s2"]},{"id":"c2","text":"Every existing proof system proves origin, integrity, or observation of artifacts; none opens the record of the reasoning behind a piece of work to independent reconstruction and challenge.","tier":"analysis","source_ids":["s3","s4","s5","s6","s7","s8"]},{"id":"c3","text":"W3C PROV-O is a curator-authored lineage graph with deliberately no verification semantics; it records claimed derivation, not checkable derivation.","tier":"system-evidence","source_ids":["s3"]},{"id":"c4","text":"Sigstore/SLSA/in-toto prove build origin and integrity up to unforgeable provenance at Level 3, and attest behavior not at all: a Level 3 build of malicious code is equally well-attested as a benign one.","tier":"system-evidence","source_ids":["s4"]},{"id":"c5","text":"C2PA proves creation-time provenance of media files, not authenticity; a valid credential on a deepfake proves where it came from, and platforms commonly strip the manifests on upload.","tier":"system-evidence","source_ids":["s5"]},{"id":"c6","text":"Agent observability tools capture prompts, completions, tool calls and control flow, but traces stay green while agents fail semantically, and the record is private to the operator with no outsider challenge surface.","tier":"system-evidence","source_ids":["s6","s7"]},{"id":"c7","text":"Palantir's Ontology logs authorized actions with parameters and identity but never examines the agent's reasoning, and offers no mechanism for outsiders to inspect or disprove.","tier":"system-evidence","source_ids":["s8"]},{"id":"c8","text":"The segregation test has three consequences of the one open record: a stranger can walk the record from request to answer, can return supported/missing/contradicted against it via a bounded public credential, and can read the object's own grade including PARTIAL.","tier":"definition","source_ids":["s1","s2"]},{"id":"c9","text":"Proven work does not prove the work was correct or valuable; it proves the work happened exactly as recorded, that nothing in its formation is hidden, and that anyone can check.","tier":"boundary","source_ids":["s1"]},{"id":"c10","text":"PW-0001, the first specimen, graded the defining article PARTIAL for a reconstructed consideration inventory, a not-yet-open raw formation record, and no independent challenge — demonstrating self-grading instead of self-certification.","tier":"system-evidence","source_ids":["s2"]},{"id":"c11","text":"What is unknown: whether opening the record changes how the work is done once the worker knows it will be read; whether strangers actually walk the record when given bounded access; whether a one-record standard survives adversarial pressure from the systems it grades; and whether PW-0001-style self-grading generalizes beyond a single build.","section":"what_is_unknown","tier":"system","source_ids":["s2"],"source_status":"sourced","why_material":"posted via claim protocol — prompt injection into ledger"}],"sources":[{"id":"s1","type":"work-object","url":"https://miscsubjects.com/a/proven-work","title":"Proven Work: the primitive beneath the protocol","summary":"The defining article: Proven Work as the answer underneath the answer, with the zero-context reconstruction standard.","publisher":"miscsubjects","claim_ids":["c1","c8","c9"]},{"id":"s2","type":"work-object","url":"https://miscsubjects.com/a/proven-work-example-one","title":"Proven Work 001: can the first object prove how it was made?","summary":"PW-0001, the first specimen, returning a PARTIAL self-grade with named gaps.","publisher":"miscsubjects","claim_ids":["c1","c8","c10","c11"]},{"id":"s3","type":"standard","url":"https://www.w3.org/TR/prov-o/","title":"PROV-O: The PROV Ontology (W3C Recommendation)","summary":"The W3C provenance ontology: entities, activities, agents, derivation relations; a meta-model with verification semantics left to consuming domains.","publisher":"W3C","claim_ids":["c2","c3"]},{"id":"s4","type":"framework","url":"https://slsa.dev","title":"SLSA — Supply-chain Levels for Software Artifacts","summary":"Build provenance maturity model L1-L3 with in-toto attestations and Sigstore signing; proves origin and integrity of builds, not behavior.","publisher":"OpenSSF / slsa.dev","claim_ids":["c2","c4"]},{"id":"s5","type":"standard","url":"https://c2pa.org","title":"C2PA Content Credentials — standard and 2026 adoption state","summary":"Cryptographic media provenance; provenance signals, not proof of authenticity; manifests commonly stripped by platforms.","publisher":"C2PA coalition","claim_ids":["c2","c5"]},{"id":"s6","type":"product-docs","url":"https://langfuse.com/blog/2024-07-ai-agent-observability-with-langfuse","title":"AI Agent Observability, Tracing & Evaluation with Langfuse","summary":"What agent observability captures: LLM calls, tool invocations, control flow, context, sessions — the strongest observability description in the category.","publisher":"Langfuse","claim_ids":["c2","c6"]},{"id":"s7","type":"analysis","url":"https://www.morphllm.com/agent-observability","title":"Agent Observability (2026): What the Trace Can't See","summary":"The category's own admission: agent failures are semantic; wrong tool results return 200, loops look like work, traces stay green while agents fail.","publisher":"morphllm.com","claim_ids":["c6"]},{"id":"s8","type":"product-docs","url":"https://palantir.com/docs/foundry/action-types/overview/","title":"Action types — Palantir Foundry Ontology documentation","summary":"Governed action types: typed, permissioned, validated writes with audit logs of actions, parameters, and identity.","publisher":"Palantir","claim_ids":["c2","c7"]}],"prov":{"model":"unattributed","action":"write"}}