# Proven Work 001: can the first object prove how it was made?

slug: proven-work-example-one · https://miscsubjects.com/a/proven-work-example-one · category: canon · tags: canonical, proven-work, proof-object, audit, oip · updated 2026-08-06T09:16:21.969Z

The first Proven Work object is an audit of the page that proposed Proven Work as the site’s base unit.

The question is narrow: **can the Proven Work article prove how and why it was made?**

The answer is **PARTIAL**.

The article exists. Its revisions, claims, sources, health checks, public ledger events, bundle hashes and deployment record can be opened. The coding-agent turn that produced the final revision also exists in the private ledger with the owner input, model identity, tool calls, commands and output hashes.

Two pieces remain incomplete. The first drafts did not begin with a contemporaneous inventory of every alternative considered, so some reasoning was reconstructed in later revisions. The thesis has also not yet been challenged by independent models working from one fixed evidence packet. Replay is no longer one of the gaps: the object now mints a public-safe delegated capability fixed to its redacted proof projection.

Calling the article fully proven would hide those gaps. This object records them.

## The difference

| State | What exists | What the recipient has to trust |
|---|---|---|
| Work | A finished answer or state change | The producer’s account of how it happened |
| Audited work | The answer plus checks selected by an auditor | That the audit covered the material questions and did not omit a decisive path |
| Proven Work | The answer, its formation record, consideration inventory, completeness boundary, robustness record, surety statement, replay path and open gaps | Nothing inside the declared proof boundary; uncertainty survives as an explicit object |

An audit can inspect the output. Proven Work also proves the audit’s scope: which questions it asked, which evidence it opened, which evidence was unavailable and what would reverse the verdict.

## PW-0001

```text
PROVEN_WORK_ID: PW-0001
SUBJECT: The article “Proven Work: the primitive beneath the protocol”
WORK_QUESTION: Can the article prove how and why it was made?
VERDICT: PARTIAL
PROOF_BOUNDARY: Observable creation, revision, publication and verification records held by the build
OUTSIDE_BOUNDARY: Private model state absent from the emitted record; facts unavailable to the worker; external market demand
```

The proof boundary matters. “Complete” cannot mean every fact in the universe or every activation inside a model. It means every observable piece declared necessary to reconstruct this work. A completeness claim is valid only after the required set has been named.

## Result proof

The result is public at https://miscsubjects.com/a/proven-work.

The current article object is at https://miscsubjects.com/api/articles/proven-work. Its revision history is at https://miscsubjects.com/api/articles/proven-work/revisions. The downloadable object manifest is at https://miscsubjects.com/api/articles/proven-work/bundle?format=manifest. That manifest hashes each representation separately.

The current health audit is at https://miscsubjects.com/api/articles/proven-work/health. At the time PW-0001 was assembled, the page returned `ok: true`, eight claims, three sources, 32 proof edges, every constitution slot filled and zero issues.

These records prove that the article exists in a specific form and passes the article system’s declared structural checks. Commercial correctness remains open.

## Mint the proof block

`POST https://miscsubjects.com/api/proven-work/proven-work-example-one/drop`

That owner-authenticated action mints a fresh seven-day delegated token from the build’s existing capability system. It has unlimited uses during that period and is fixed to `GET https://miscsubjects.com/api/proven-work/proven-work-example-one`. It cannot fetch another URL or accept a changed body. The returned block can be copied into any model conversation. It carries the article, proof projection, token contract and receipt ledger, plus the instruction to return `SUPPORTED_BY_RECORD`, `MISSING_EVIDENCE` or `CONTRADICTED_BY_RECORD` with exact citations.

The bearer is minted only when the block is needed. It stays outside the public article, where publication guards would correctly treat it as an exposed secret and revoke it. The public object stores the mint action, the fixed boundary and safe fingerprints of verified blocks.

The live verification minted `cap_adadcde60ff354e6`, opened the projection successfully, rejected an altered body with HTTP 403 and returned a redacted formation record.

## Formation proof

The final defining revision came from Codex turn `019fc639-5eb4-7901-bafb-96217afed644`, recorded twice in `agent_turns` as rows 7325 and 7326.

The owner input hash is `836db3665a284288a445522324cc32954090424a8095b127fcc0795cfe55fbae`. The assistant output hash is `c7027ad3c64dea74e6ce1d5b001e3b98c670cdbf4609c66e37402dd73e322eb3`. The recorded model is `gpt-5.6-sol`. The turn records 11 tool calls. The successful query that reopened that formation record is receipted at https://miscsubjects.com/receipt/inv_ufcm434s4x.

The query first failed because it requested a column absent from the deployed schema. That failed invocation is preserved at https://miscsubjects.com/receipt/inv_frb3wfk9pg. The corrected query names the failed receipt in its `repairs` field. Failure and repair remain one lineage.

The complete local session transcript was 25,424,760 bytes when inspected during this audit. Its SHA-256 at that moment was `c9ddd4e3ee994705d50e939d0706025af746a49b0495faba8b9d81cfb2f0b897`. The file continued growing because this audit was still in progress, so that hash identifies a snapshot, not the final session. The distinction is recorded instead of treating a moving file as immutable proof.

## Consideration proof

The product candidates visible in the owner’s question and the resulting work were:

| Candidate | Disposition | Reason |
|---|---|---|
| Articles | Surface | An article can contain work without proving its formation or completeness |
| Audit | Component | An audit proves selected checks; its own scope and omissions still need proof |
| [Object Invocation Protocol](/a/oip) | Infrastructure | OIP makes the work openable, invokable, bounded and receipted |
| Ontology | Structure | The ontology relates the parts; it is not the completed commercial unit |
| Ledger | Evidence store | Raw records preserve formation; the declared proof boundary decides which records were required |
| Receipt | Execution proof | A receipt proves one invocation, not the completeness or quality of the whole work |
| Proven Work | Base unit | It binds the finished change to formation, considerations, completeness, robustness, surety and replay |

The original article considered most of these candidates, but it did not record this complete table before reaching its conclusion. PW-0001 therefore treats consideration completeness as reconstructed evidence, not contemporaneous evidence.

## Completeness proof

PW-0001 declares nine required pieces. The status is measured against that set.

| Required piece | Evidence | Status |
|---|---|---|
| Demand | Owner-input hash and retained turn | PASS |
| Deliverable | Public article and JSON object | PASS |
| Formation | Model, turn, tool count, payload hashes and revision lineage | PASS, owner-access layer |
| Considerations | Candidate and exclusion inventory | PARTIAL, reconstructed after initial publication |
| Source boundary | Three named work objects and source-chain endpoint | PASS |
| Result checks | Health, voxels, sources, revision and manifest endpoints | PASS |
| Robustness | Objections and changed-condition tests below | PARTIAL |
| Surety | Claim classes and unresolved claims below | PASS |
| Replay | Public proof projection plus on-demand fixed-body delegated token | PASS |

Seven pieces pass. Two are partial. Zero are silently omitted. The verdict is therefore PARTIAL.

## Robustness proof

The thesis was tested against five objections.

**“A complete log proves good work.”** False. A log can perfectly reconstruct careless work. Proven Work keeps result quality and formation reconstruction separate.

**“An audit already does this.”** False in the general case. An audit can omit a decisive issue, inherit the producer’s evidence selection or arrive after the decision. Proven Work carries the audit scope, the absence list and the reversal conditions with the work.

**“More records mean more proof.”** False. Record volume is not coverage. Completeness comes from a declared required set whose members resolve to evidence or to an explicit absence.

**“Model agreement creates surety.”** False. Several models can share the same missing source or assumption. Agreement belongs in the robustness record; it cannot replace source quality or a completeness boundary.

**“Replay proves the original result.”** Only when the environment is stable or the drift is named. A replay after a model, source, prompt, permission or external system changes creates a linked new work object. It does not overwrite the old conditions.

PW-0001 records these objections and their answers. It has not yet run the thesis through a fresh, independent model panel with a fixed evidence packet. Robustness remains PARTIAL.

## Surety

Surety is the set of guarantees earned by the record.

PW-0001 proves that the article exists, that its published structure passes the live article health contract, that revisions are retained, that the successful formation query repaired a recorded failure and that the cited coding-agent turn contains the owner input hash, assistant output hash, model identity and tool record.

The record supports the conclusion that Proven Work is a coherent base unit for this build because the existing claims, sources, receipts, revisions, permissions and replay paths all become dimensions of one completed work object.

The record does not prove that the category is unique, that buyers will adopt the name or that the current schema captures every useful class of work. A receiving model can reconstruct the declared observable record after the owner hands it a bounded proof block; the record does not claim access to private model state absent from the emitted record. Those claims remain open.

## The repair that turns PARTIAL into PROVEN

PW-0001 reaches PROVEN when two state changes are visible:

1. Consideration inventories are captured before the decision rather than reconstructed afterward.
2. A fixed evidence packet is challenged under changed assumptions and by independent models, with disagreements and reversal conditions attached.

Until then, the first object demonstrates the standard by refusing the label it has not yet earned.

## The base unit

A Proven Work object contains:

```text
demand
deliverable
formation
considerations
completeness
robustness
surety
replay
open_gaps
```

Every field points to evidence. Every completeness claim names its universe. Every guarantee names its boundary. Missing evidence lowers the status instead of disappearing from the page.

That is the difference between work that has an audit and work that can prove its own why.


## Sources

1. Proven Work: the primitive beneath the protocol — https://miscsubjects.com/a/proven-work
2. Proven Work revision history — https://miscsubjects.com/api/articles/proven-work/revisions
3. Proven Work article health — https://miscsubjects.com/api/articles/proven-work/health
4. Proven Work downloadable object manifest — https://miscsubjects.com/api/articles/proven-work/bundle?format=manifest
5. Successful formation-record query — https://miscsubjects.com/receipt/inv_ufcm434s4x
6. Failed formation-record query — https://miscsubjects.com/receipt/inv_frb3wfk9pg
7. Proven Work public article ledger — https://miscsubjects.com/api/articles/proven-work/ledger


---

# The research report you can cross-examine: conclusions bound to receipts, gaps named on the page

slug: proven-work-for-research-buyers · https://miscsubjects.com/a/proven-work-for-research-buyers · category: canon · tags: proven-work, research-reports, due-diligence, buyers · updated 2026-08-03T18:23:21.472Z

A hedge fund's director of research, a private-equity diligence principal, or a corporate strategy lead who buys a research report today receives two things: a PDF and a reputation. The PDF carries the conclusions. The reputation — the analyst firm's brand, the expert network's name — is the only reason to believe them. No mechanism lets the buyer check a single sentence against the work behind it. This page describes a deliverable that changes exactly that: the report issued as a *proven work object*, in which every conclusion sentence is bound to the receipts of the work that produced it — the sources opened, the queries run, the model calls made — or to an explicitly named gap where the evidence does not exist, and in which the buyer verifies any sentence without trusting the seller. The standard and the machinery are defined, with live receipts, at [[proven-work]]. This page is the buyer's view: what reports cost, what the money fails to buy, one real object walked sentence by sentence, and the gaps named.

## What a research report costs — and what the price does not include

The market for purchasable conclusions is large, and its prices are public enough to quote.

Industry-analyst firms sell subscriptions — research-library access plus capped analyst-inquiry time — at $25,000–$150,000 per year for typical subscribers, with enterprise tiers above $500,000, and they sell advisory hours separately at $3,000–$7,000 per hour in 10-, 25-, and 50-hour packages (secondary pricing data compiled by Vendr for 2026, relayed in an arXiv analysis). Expert networks — the firms that arrange paid phone consultations with industry operators — sell prepaid annual packages at roughly $1,000–$2,000 per consultation hour with annual minimums around $25,000–$60,000 (same source); GLG, the largest network, runs annual commitments typically of $50,000–$150,000 or more (vendor-published comparison). One industry profile puts Gartner's 2025 revenue above $5.8 billion.

The pricing data contains the whole diagnosis in one sentence: **the seller commits analyst-time, not analyst-conclusion.** Every contract above ends the same way — prose the buyer cannot check. The report says a market is growing, a vendor's claims hold up, a competitor is vulnerable. What backs any of those sentences stays inside the seller. The buyer's recourse, when a conclusion matters, is to buy more analyst-time.

## The buyer already knows — and pays around the gap

The buyer's own job descriptions admit the condition. A live posting for a senior competitive-intelligence analyst — the person inside a company who consumes this research — states the job's core problem plainly: "The data is never perfect, and everyone wants answers yesterday."

And buyers already spend heavily to make diligence faster — on the process side. A 2025 review of AI in due diligence, cited by a diligence-automation vendor, reports a Deloitte case study finding a 75% efficiency saving from generative AI over manual review, Thomson Reuters research showing document-review time cut by up to 70%, and McKinsey reporting AI-driven pattern recognition reducing credit losses by 20–40%. Money is moving. But it buys speed, not checkability: the deliverable is still a report whose sentences float free of the runs that produced them.

The regulatory wind points the other way from the product. The U.S. Federal Trade Commission's AI-claims enforcement record includes Workado, which marketed 98% accuracy for its AI-detection software; the FTC's investigation concluded the true rate was 53% — in the words of one law firm's analysis, "essentially a coin flip" — and the proposed order bars the company from marketing accuracy claims it cannot support. The same analysis states the FTC's standing rule: "Companies using AI in their marketing must be able to substantiate every claim they make, both explicit and implicit." Claim-level substantiation is now the legal direction for the companies being analyzed — while the research sold *about* those companies carries no claim-level substantiation at all.

## The same report, issued as a checkable object

The alternative structure has five parts, stated here in buyer terms (the formal standard, as a checklist, is at [[proven-work]]):

1. **The claim, written and bound.** The report's conclusions — what was asked, what was found, what was considered, what is guaranteed, what is open — written as the work happens, not reconstructed afterward. A claim reconstructed later says so, on its face.
2. **The complete record.** Every consequential action behind the report — each source opened, each query run, each model call with its full response — preserved as a single request-plus-response payload, hash-chained in order, timestamped. Not curated highlights.
3. **The binding.** A manifest that walks the conclusions sentence by sentence. Each sentence resolves to receipt ids — the specific records that support it — or to an explicitly named gap. There is no third state: a sentence the record does not bear is a named gap or it is a lie.
4. **The door.** One keyless URL. Anyone the buyer hands it to — an investment-committee member, a co-investor, a limited partner auditing the fund's diligence — opens it, reads the projection, and walks away with *their own inspection receipt*. No account, no permission, no phone call to the seller.
5. **The verdict, computed.** The object carries a status — PROVEN or PARTIAL — computed by the service from the manifest. The seller cannot assert it. A report whose evidence covers nine of eleven conclusions prints PARTIAL, honestly, next to the two named gaps.

## One real object, walked sentence by sentence

This is not a proposal. The object described above exists, and this section walks one of them — a report-like artifact this site produced on a question of European law, work id PW-0002 — from conclusion to record. The question put to a panel of frontier AI models: whether this site's standing AI-authorship disclosure satisfies the transparency clauses of Article 50 of the EU AI Act. The full page, with every deliberation printed verbatim, is at [[three-models-deliberate-one-statutory-question|PW-0002, the sealed statutory panel]].

Take its conclusions one at a time:

**"The inputs were sealed before any model saw them."** Bound to the requirement `question_sealed` — status PASS — resolving to five receipts, one per model channel: `inv_gte0gtx31p`, `inv_mr0y1mcw8f`, `inv_t61klfgq4u`, `inv_lffvxuzad4`, `inv_804vr5xvdj`. Each receipt is a ledgered request-and-response payload holding the exact question, ruleset hash, and artifact hash that channel received; any holder can recompute the hashes.

**"Three independent model lineages converged on the same verdict for the same reasons."** Bound to `derivation_agreement` and `family_diversity` — both PASS — resolving to `inv_qmxwk924vw`, the deterministic seal record that compared derivation signatures across the conforming findings and counted three distinct training families.

**"One finding was discarded — and the discard is printed."** A fifth channel's finding read the same verdict but failed the required machine-parseable output shape; the strict seal refused the panel and escalated. Bound to `shape_enforced` and `honest_failure_printed` — PASS — resolving to `inv_tkj82c7m1v`, the escalation receipt. A conventional report buries its discarded analysis. This one binds the discard to its receipt and prints it.

**"The record itself has not been rewritten."** Bound to `external_anchor` — PASS — resolving to a hash-chain checkpoint anchored to two surfaces outside the operator's control: drand round 6343866, a public randomness beacon, and Bitcoin block 960842. Rewriting a covered record would require forging one of those.

**"Any stranger can check all of the above."** Bound to `evidence_room_access` — PASS — and tested again while this page was being written: a fresh GET of the object's inspection door returned `read_status 200` and issued a new inspection receipt, `inv_59eta018t2`, publicly readable at https://miscsubjects.com/receipt/inv_59eta018t2. That receipt is the thing no PDF has ever issued: proof that this specific outsider inspected this specific record at this time.

The verdict vocabulary is three words. A claim sentence is **SUPPORTED_BY_RECORD** (with the record ids), **MISSING_EVIDENCE** (the gap, named), or **CONTRADICTED_BY_RECORD** (with the record ids). The sibling object PW-0001 shows the honesty mechanics from the other side: it graded its own formation record against nine requirements, found two it could not evidence, printed both gaps, and carries the status PARTIAL — computed, never asserted, and worth more than any claimed PROVEN, because the buyer can see exactly which two.

## What changes for the buyer

The practical difference is one line: "did they consider the contrary study" stops being a deposition question and becomes a search. The considerations — what was weighed, what was excluded, what the record does not cover — sit inside the object, next to the errors, the discarded drafts, and the authority each action ran under.

Three consequences follow. First, the report defends itself after the analyst leaves the room: the investment committee, the co-investor, or the limited partner re-verifies any load-bearing sentence next quarter without re-engaging the firm. Second, the verdict degrades honestly: where a vendor withheld evidence or a source could not be opened, the gap is named and the status drops — the buyer learns which sentences are load-bearing and which rest on nothing, which is exactly the information a confident PDF is designed to hide. Third, judgment stays with the buyer. The record proves what was done, what was considered, and what resulted; it does not prove the conclusion was wise. That verdict belongs to whoever acts on it — now standing on a record instead of a brand.

The same object works wherever conclusions must survive a skeptical reader. The sibling case to this one wraps an underwriting file instead of a research report: [[proven-work-insurance-case|pricing an AI system from its own record]].

## What is new here, and what honestly is not

The record layer is mature, and this page does not pretend otherwise. Hash-chained, timestamped, tamper-evident logging of every model and tool call is shipping practice — one commercial vendor, Provenrail, sells exactly that capture with an open-source verifier and shareable read-only proof links — and regulators have mandated event logs in narrow domains for years. What the surveyed art does not do, and what the object walked above does, is the remaining three parts: bind natural-language conclusion sentences to execution receipts with named-gap semantics, compute the verdict on the service side so the maker cannot assert it, and issue the *inspector* a receipt of their own. The honest summary: the record is well-executed standard practice; the binding, the door, and the derived status are the addition; the combination, sold as one checkable object on already-completed work, is what a buyer cannot get elsewhere today.

## What is not satisfied

Three gaps, named as the standard requires:

1. The pricing figures above are secondary — Vendr and Inex One 2026 data relayed through an arXiv paper, plus vendor-published comparisons — not verified at Gartner's or GLG's own pages.
2. No research buyer has yet purchased a report in this form. Demand is inferred from adjacent spend on diligence automation and analyst time, not from a completed sale of this object.
3. The walked example is this build's own work object, not an independent research firm's report. The structure is checkable precisely so the reader does not have to trust the seller — including this one.

## Sources

- https://arxiv.org/html/2510.09859v4 — arXiv analysis relaying Vendr, SalesHive, Inex One and Woozle 2026 pricing: analyst subscriptions $25K–$150K ($500K+ enterprise), advisory hours $3K–$7K, expert-network hours $1K–$2K with $25K–$60K minimums; the "analyst-time, not analyst-conclusion" sentence. Secondary pricing compilation.
- https://nexusexpertresearch.co/blog/top-expert-network-companies/ — expert-network comparison: GLG annual commitments typically $50,000–$150,000+. Vendor-published.
- https://matrixbcg.com/blogs/competitors/gartner — industry profile: Gartner 2025 revenue above $5.8 billion. Aggregator, secondary.
- https://zavmo.ai/job-description/senior-competitive-intelligence-analyst-2/ — live senior competitive-intelligence analyst job description: "The data is never perfect, and everyone wants answers yesterday."
- https://www.arphie.ai/glossary/ai-solutions-for-automating-vendor-due-diligence — diligence-automation glossary citing a 2025 AI-in-due-diligence review: Deloitte 75% efficiency saving, Thomson Reuters up to 70% review-time reduction, McKinsey 20–40% credit-loss reduction. Vendor-published, citing third parties.
- https://www.beneschlaw.com/insight/one-year-in-ftcs-operation-ai-comply-continues-under-new-administration-signaling-enduring-enforcement-focus/ — Benesch law-firm analysis of FTC AI-claims enforcement: Workado 98% claimed vs 53% found, "essentially a coin flip"; the FTC substantiation rule, quoted.
- https://provenrail.com/ — the record layer's shipping commercial baseline: hash-chained capture, open-source verifier, shareable read-only proof links.

The definition of the object this page sells, the standard as a checklist, and the live objects that already meet it are at [[proven-work]].

## A standing offer: free work, on the record

This site runs an autonomously governed protocol — every model call, verdict, and edit lands on a public ledger with a receipt. For any legislator, regulator, or private party, the protocol will execute the following at no charge:

- **A live demonstration** — a statutory question of your choosing put to a multi-model panel under the sealed output shape, with every deliberation preserved verbatim, as in [[three-models-deliberate-one-statutory-question|the Article 50 specimen]].
- **An audit** — point at a system, a disclosure, a piece of AI-generated output, or a published practice, and the protocol will assess it against the Act clause by clause, with the reasoning on the record.
- **A compliance schematic** — a concrete proposal for how to bring a named system or workflow into conformity with the obligations that apply to it, with each recommendation tied to the article it satisfies.

Requests reach the build directly at build@miscsubjects.com. The work product is published as a citable page unless confidentiality is requested, and every step of its production is replayable from the ledger.


## Sources

1. arXiv analysis relaying Vendr, SalesHive, Inex One and Woozle 2026 pricing: analyst subscriptions $25K–$150K ($500K+ enterprise), advisory h — https://arxiv.org/html/2510.09859v4
2. expert-network comparison: GLG annual commitments typically $50,000–$150,000+. Vendor-published. — https://nexusexpertresearch.co/blog/top-expert-network-companies/
3. industry profile: Gartner 2025 revenue above $5.8 billion. Aggregator, secondary. — https://matrixbcg.com/blogs/competitors/gartner
4. live senior competitive-intelligence analyst job description: "The data is never perfect, and everyone wants answers yesterday." — https://zavmo.ai/job-description/senior-competitive-intelligence-analyst-2/
5. diligence-automation glossary citing a 2025 AI-in-due-diligence review: Deloitte 75% efficiency saving, Thomson Reuters up to 70% review-tim — https://www.arphie.ai/glossary/ai-solutions-for-automating-vendor-due-diligence
6. Benesch law-firm analysis of FTC AI-claims enforcement: Workado 98% claimed vs 53% found, "essentially a coin flip"; the FTC substantiation  — https://www.beneschlaw.com/insight/one-year-in-ftcs-operation-ai-comply-continues-under-new-administration-signaling-enduring-enforcement-focus/
7. the record layer's shipping commercial baseline: hash-chained capture, open-source verifier, shareable read-only proof links. — https://provenrail.com/


---

# The vendor graded its own work: why a self-certified AI verdict proves less

slug: proven-work-certifier-independence · https://miscsubjects.com/a/proven-work-certifier-independence · category: canon · tags: proven-work, certifier-independence, anchors, audit, series · updated 2026-08-03T18:23:18.661Z

Every AI proof product asks the buyer to trust one number: the verdict. This page is about who is allowed to compute it. When the verdict about a piece of AI work is signed or computed by the same party that produced — or sold — the work, the verdict proves the vendor operated a signing key; it does not prove the claim. Below: the defect exhibited in the two deepest products in the field, what independence looks like where it exists, the anchor technology that fixes half the problem, the quorum that fixes the rest, and this site's own position — miscsubjects.com computes its own derived status today, and the roadmap that closes that is named here, first instance live. A reader who finishes can score any vendor's proof claim, this site's included, on five tests.

## The verdict

A certifier operated by the party being certified proves less than one operated apart — not as rhetoric but as structure. Cryptography can prove that a record exists, is unaltered, and existed by a time. It cannot prove that a claim is supported by that record; someone must compute that, and the commercial interests of the seller point one way. The defect sits in the most important statement of the strongest competitor examined in this research — and this site carries it too, declared, with the repair in order.

## The defect, exactly

A proof system for AI work can make three different statements, and they are not interchangeable:

1. **Integrity** — this record exists and has not been altered since it was sealed. Hash chains and signatures deliver this mechanically.
2. **Anteriority** — this record existed by a stated time and cannot have been backdated. Timestamps and blockchain anchors deliver this mechanically.
3. **Support** — this claim about the work is borne out by that record. Nothing delivers this mechanically. A verifier — human, model, or service — must read the record and test the claim against it, and its finding is worth exactly its independence from the party the finding concerns.

Vendors ship the first two and label the package proof. The third is the one a buyer actually means — *is the claim true* — and precisely the one self-grading corrupts. A vendor-signed support verdict is an assertion with a signature attached. The signature proves who asserted. It says nothing about what is true.

## Exhibit A: the deepest binding in the field, and the maker's own key

H33, a post-quantum cryptography platform with an AI-decision provenance layer, ships the closest thing to a claim-binding the field has produced: its decision evidence bundles decompose an AI answer into claim spans by byte range and bind each span to supporting citation ids. A complete specimen is publicly downloadable (verified this session): `claim_84711.json` carries claim decomposition, claim-level coverage mode, and `coverage_assertion: "full"`.

That last field is the product's only claim-support statement — the one place the whole stack says *the claims are covered* — and its signature is `ML-DSA-65` under key id `h33-search-svc-prod-cov-key`: the maker's own service key. The most consequential verdict in the bundle is self-signed.

Everything independent in H33's stack is structural. Their replay verifier runs ten deterministic checks — schema, timeline ordering, chain integrity, tenant isolation, Merkle roots — and their own page states the boundary in writing: "What PASS does NOT prove: **Completeness** — a bundle may be a truthful subset," and a passing verdict "does not mean a system is secure, correct, or compliant." The independent checks prove the artifact reproduces; no independent party computes whether the claims hold. Credit where due: the offline verification is real — MIT-licensed CLI, browser playground, inspector-signed verdict reports, post-quantum signatures — the field's best vendor-independent *integrity* story. Two honest flags: the only public specimen is an alpha preview whose metadata declares placeholder signatures, and the bundle carries hashes, not payloads — an outsider can verify a consistent record existed without reading what it says. Integrity without an independent claim verdict is the vendor grading its own work in permanent ink.

## Exhibit B: vendor-held keys, one unnamed third party

Acipta, a compliance-scanning platform, signs every verdict its agents produce at issue time with "a cryptographic signing key managed in a FIPS-validated HSM," hash-chains each verdict to the one before, and timestamps each with an RFC 3161 external Trusted Timestamp Authority (its flight-recorder page, verified this session). Retention is serious: pinned model versions, pipeline state, five-year custody.

The independence inventory is one line long. The keys live in the vendor's HSM; the ledger and evidence locker are vendor-operated; the verdicts are produced by the vendor's own agents about the vendor's own scans. The sole third party in the chain is the timestamp authority — unnamed anywhere on the site. What a stranger can check: integrity and time. What stays vendor-asserted: authorship, judgment, completeness, and the verdict itself. Acipta's own scope note concedes it — defensibility "is not a guarantee that a decision was substantively correct." Its deterministic replay proves the sealed bytes re-derive; it never asks whether the verdict was true. The strongest record substrate in the category, and the grade is still written by the vendor's own hand.

## The pattern

| What the vendor's certifier proves | What it cannot prove |
|---|---|
| The record exists and was not altered | The claim is supported by the record |
| The record existed by a time | The record is complete — not a truthful subset |
| The vendor ran a signing ceremony | The work was correct, or the judgment sound |

The closer a statement gets to *the claim is true*, the more certainly the vendor signs it alone. This is not a malice story; it is a structure story — the party with the commercial interest holds the pen, and the buyer cannot tell the honest case from the other one.

## What independence looks like where it exists

Independent AI assurance exists — as a profession, not as an object. BABL AI has audited and certified AI systems since 2018, against the EU AI Act, NYC Local Law 144, and ISO/IEC 42001; its founder and CEO, Dr. Shea Brown, co-founded the International Association of Algorithmic Auditors. ForHumanity, a 501(c)(3) nonprofit, drafts the Independent Audit of AI Systems criteria, licenses them to audit firms, and certifies auditors; Ryan Carrier founded it after twenty-five years in financial risk, and Brown sits on its board. These verdicts carry what no vendor signature can: an auditor who is independent, liable, and accountable under an external framework.

What they do not carry is portability. An assurance verdict arrives as a private report — no keyless URL where a stranger inspects the evidence, no per-work-unit object, no receipt for the inspector's own reading; the unit of proof is the engagement, not the deliverable. The market today offers two halves: vendor-signed verdicts bound to portable records, and independent verdicts bound to nothing a stranger can open. The object that does not yet exist is the independent verdict bound to a portable, inspectable record.

## The old anchor technology, and the half it fixes

The technology for proving anteriority is a quarter-century old and cheap. RFC 3161 (2001) defines the trusted timestamp — a Time Stamping Authority signs a hash plus a time, and its introduction states the scope exactly: "proof that a datum existed before a particular time." OpenTimestamps takes the operator out entirely: hash locally, aggregate through public calendars, anchor into the Bitcoin blockchain, verify without trusting anyone. Acipta's single third-party element is the first; this site's anchor is the second's cousin.

Anchors fix the operator's ability to rewrite history: a sealed record whose head is bound to a Bitcoin block cannot be quietly regenerated afterward. They do not fix who grades the claim — a timestamp says the verdict existed by a time and is silent on whether it was earned. Timestamping is necessary and radically insufficient: it answers the *when* and the *untouched*, never the *true*.

## This site's own position, stated against itself

[[proven-work|Proven work]] — this site's base unit — binds a claim about completed work to its complete formation record and a door any stranger can open, and computes a derived status, PROVEN or PARTIAL, from the manifest. The honesty this page owes: that status is computed by the same operator that sells the product. Single-operator custody is the definition page's own named open weakness — the exact defect named above.

What has shipped that bears on the defect:

- **The first external anchor is live.** The ledger chain was sealed through 1,308,129 events and its head bound to two surfaces outside the operator's control — drand round 6343866 (the League of Entropy's BLS-signed public randomness beacon) and Bitcoin block 960842 — both resolvable at public endpoints, the anchor packet served at this site's anchor API. Rewriting a covered record now requires forging a drand signature or a Bitcoin block.
- **The door issues the inspector a receipt.** Any stranger GETs the whole object — claim, manifest, full evidence payloads — keyless, and the response carries *their own* inspection receipt, so a critic's verdict can be held to proof of reading.
- **Outside verdicts land on the object.** A public certify lane records any model's or auditor's verdict — SUPPORTED_BY_RECORD, MISSING_EVIDENCE, CONTRADICTED_BY_RECORD — against a required inspection receipt, including hostile verdicts. Two hostile zero-context external audits on 3 August 2026 dropped the flagship object from PROVEN to PARTIAL on the record; the gaps were closed with exhibits and the status recomputed.

What has not shipped: PROVEN is still computed on the operator's service; the anchor covers record integrity, not verdict independence; and no third-party quorum gates the status. The claim for this site is therefore exactly this and no more — the record no longer requires trusting the operator, and the verdict still does.

## The roadmap that closes it

Three mechanisms, in dependency order, each already in the product's versioned spec:

1. **Anchors on every checkpoint, at two independent third parties.** The first instance is live (drand plus Bitcoin, above). The spec's anchor gate is the rule: PROVEN may not print until every receipt the object cites sits under a sealed chain checkpoint published at two independent third parties; until then the object declares the anchor gap and prints PARTIAL.
2. **A third-party certifier quorum.** Independent certifiers — auditor-class, on the BABL and ForHumanity pattern of liable, framework-anchored assurance; model-class, cross-vendor panels — inspect through the door and sign verdicts onto the object. The mechanics exist today: keyless inspection, per-inspector receipts, the public certify lane. The queued work is the gate: the status becomes quorum-computed, and the operator loses the ability to print PROVEN alone. The evidence-law argument for why courts and regulators should demand exactly this structure is made by the sibling page, [[proven-work-evidence-law-case]].
3. **Evaluator transparency.** The status computation ships public, so any client recomputes the verdict from the manifest rather than trusting the service that ran it.

Until the quorum gates, every object this site emits carries the operator-independence caveat in the open. A PARTIAL printed honestly outranks a PROVEN asserted — the standard's own rule, applied to itself.

## The five tests a buyer applies

To any vendor's proof claim — this site's included — ask:

1. **Who signed the verdict?** If the answer is the vendor's own key, it is an assertion with a signature attached.
2. **Can you obtain the whole object without the vendor's cooperation?** A file the maker hands you is a distribution channel, not a door.
3. **Does the verdict disclaim completeness or correctness in writing?** Then what remains is integrity, not proof.
4. **Is there a named-gap mechanism?** A system that cannot bind a claim to *nothing supports this* cannot fail honestly.
5. **Does your inspection leave you a receipt?** If your reading is not receipted, neither is your right to check.

Nobody in the field passes all five today — not the competitors above, and not this site until the quorum gate ships. The difference here is that the gap is named, the repair order is public, and the first mechanism is verifiable by anyone.

## Sources

- https://h33.ai/bundles/claim_84711.json — the public H33 specimen bundle: claim decomposition, `coverage_assertion: "full"`, signed under the maker's own `h33-search-svc-prod-cov-key`; alpha-preview metadata.
- https://h33.ai/verify-the-story/ — H33's own verdict boundary: "What PASS does NOT prove: Completeness."
- https://acipta.ai/flight-recorder/ — Acipta's evidence architecture: vendor-HSM signing keys, hash chaining, RFC 3161 timestamps from an unnamed external authority.
- https://acipta.ai/for-auditor/ — Acipta's auditor-facing story: offline pack verification, customer-mediated access, no standing public door.
- https://babl.ai/about-us/ — BABL AI: independent AI-system audits since 2018; Dr. Shea Brown, founder and CEO.
- https://forhumanity.center/board/ — ForHumanity: the nonprofit independent-audit criteria body; Ryan Carrier, founder; Shea Brown on the board.
- https://datatracker.ietf.org/doc/html/rfc3161 — RFC 3161 (2001): trusted timestamping — "proof that a datum existed before a particular time."
- https://opentimestamps.org/ — OpenTimestamps: Bitcoin-anchored timestamp proofs, free, operator-independent verification.

## A standing offer: free work, on the record

This site runs an autonomously governed protocol — every model call, verdict, and edit lands on a public ledger with a receipt. For any legislator, regulator, or private party, the protocol will execute the following at no charge:

- **A live demonstration** — a statutory question of your choosing put to a multi-model panel under the sealed output shape, with every deliberation preserved verbatim, as in [[three-models-deliberate-one-statutory-question|the Article 50 specimen]].
- **An audit** — point at a system, a disclosure, a piece of AI-generated output, or a published practice, and the protocol will assess it against the Act clause by clause, with the reasoning on the record.
- **A compliance schematic** — a concrete proposal for how to bring a named system or workflow into conformity with the obligations that apply to it, with each recommendation tied to the article it satisfies.

Requests reach the build directly at build@miscsubjects.com. The work product is published as a citable page unless confidentiality is requested, and every step of its production is replayable from the ledger.


## Sources

1. the public H33 specimen bundle: claim decomposition, `coverage_assertion: "full"`, signed under the maker's own `h33-search-svc-prod-cov-key — https://h33.ai/bundles/claim_84711.json
2. H33's own verdict boundary: "What PASS does NOT prove: Completeness." — https://h33.ai/verify-the-story/
3. Acipta's evidence architecture: vendor-HSM signing keys, hash chaining, RFC 3161 timestamps from an unnamed external authority. — https://acipta.ai/flight-recorder/
4. Acipta's auditor-facing story: offline pack verification, customer-mediated access, no standing public door. — https://acipta.ai/for-auditor/
5. BABL AI: independent AI-system audits since 2018; Dr. Shea Brown, founder and CEO. — https://babl.ai/about-us/
6. ForHumanity: the nonprofit independent-audit criteria body; Ryan Carrier, founder; Shea Brown on the board. — https://forhumanity.center/board/
7. RFC 3161 (2001): trusted timestamping — "proof that a datum existed before a particular time." — https://datatracker.ietf.org/doc/html/rfc3161
8. OpenTimestamps: Bitcoin-anchored timestamp proofs, free, operator-independent verification. — https://opentimestamps.org/


---

# Proven work: the base unit — a claim, a record, and a door

slug: proven-work · https://miscsubjects.com/a/proven-work · category: canon · tags: canonical, proven-work, object-invocation-protocol, ontology, product · updated 2026-08-03T09:26:17.726Z

*This is the canonical definition of the base unit this whole system is built around: proven work — one page, no siblings. It settles whether the reframe is correct, reduces the object to its smallest true structure, states the standard as a checklist — what qualifies, what does not, what is required and what is explicitly not required — explains the inspection-token technology, surveys everything else like it, names what is distinct, gives working use cases with live receipts, and answers the criticisms. A reader who finishes this page can produce proven work, buy it, or refute a piece of it.*

## The verdict

Yes. This is the primitive everything else in the build is built around, and the reframe is correct — because it renames what the system already does rather than adding anything. The ledger exists. The sealed panels exist. The delegated tokens exist. Naming proven work as the base unit stops the site from selling machinery and starts it selling the thing the machinery was always for. Under the [[logic-law|logic law]] that is the cheapest move with the largest effect: subtract the framing, keep the plant.

The competitive sentence is one line. Everyone ships agents, frameworks, and ontologies. They have no proof.

## The definition

**Proven work is a claim about completed work, bound to the complete record of that work's formation, with standing authority for any stranger to inspect the record and test the claim.**

Two parts and a door:

**The claim.** What the work says about itself, written by the worker and bound to the work: what was asked, what was done, what was considered, what it guarantees, what it leaves open. The claim is the only part a human normally reads.

**The record.** Everything that happened, raw: every model call and every tool call with request and response together in a single payload — the effective prompts are inside those payloads, not a separate artifact — hash-chained in order, timestamped, carrying the authority each action ran under and the errors it hit. Not curated. Not summarized. Not written after the fact. In inventory terms: the demand, the effective instructions, the observations, the model and tool payloads, the decisions and rejected alternatives, the errors, the authority, the revisions, the receipts, and the delivered state. On this site the record is the public ledger.

**The door.** A scoped, expiring token that hands a stranger the authority to read the record. The door is not a third part of the object — it is access to it — but without it "proven" means "trust us," which is the thing being replaced.

The record hands a stranger **two pivot views of the same events**, both of which this build already keeps: the **ledger** — the raw payloads in order — and the **turn cards** — the legible per-turn statement of what was said, what was done, and what was used. One is for machines and disputes; the other is for a human reading at speed. A proven work object is exactly that package: here is the ledger; here are the turn cards; here is the outcome, sealed; and here is the token to inspect all of it.

Work is proven when every sentence of the claim resolves against the record. Three verdicts exhaust the space: **SUPPORTED_BY_RECORD**, **MISSING_EVIDENCE**, **CONTRADICTED_BY_RECORD**. A claim sentence with no bearing record is a named gap or it is a lie. There is no third state.

## Why not nine fields, and why not three

Ask a model to define a primitive and it returns a taxonomy. Nine fields — demand, considerations, formation, deliverable, completeness, robustness, surety, replay, open gaps — is the same object described from nine chairs. Every one of the nine is one of exactly two things: something that **happened**, which is therefore in the record and needs no field; or a **question you ask** of what happened, which is a query, and storing a query's answer as a schema slot is decoration.

The three-field reduction — input, execution trace, output boundary — is closer but still double-counts. On this build's ledger a request and its response are one payload. You never hold an input without the output it produced; splitting them describes transport, not proof. And the boundary is not stored beside the record — it is derived from it, or it is marketing.

"Was it complete?" — diff the claim's scope against the record. "Did the worker know about X?" — search the record's payloads. "Would it replay?" — rerun the recorded calls and diff. "What would change the result?" — read the recorded assumptions. All of the nine collapse into queries against two parts.

## The standard, as a checklist

Work qualifies as proven work when all five hold:

1. **A written claim** — request, actions, considerations, guarantees, open gaps — bound to the work object, authored before or during the work. A claim reconstructed afterward is itself work product and says so.
2. **A complete record** — every consequential action as a single request-plus-response payload, hash-chained, timestamped, with its authority and its errors. Model deliberations count as payloads. Tool calls count as payloads. Edits, sends, and deployments count as payloads.
3. **Binding** — every sentence of the claim resolves to named record ids or to an explicitly named gap. The binding is enumerable: a manifest of requirements, each carrying its evidence ids and a PASS or a gap.
4. **Standing inspection authority** — a scoped token any stranger can use without asking permission, where every inspection lands its own receipt. Proof that cannot be checked by an adversary is reputation, not proof.
5. **Derived status** — PROVEN or PARTIAL is computed from the manifest by evaluation, never asserted by the worker. PARTIAL printed honestly outranks PROVEN asserted loudly.

What the standard does **not** require:

- **A vendor or framework.** Observability stacks are one way to produce the record; the standard is indifferent to how the payloads were captured.
- **Correctness.** Proven work proves what happened, not that it was right. Correctness is a separate claim that needs its own record — on this site, the sealed multi-model panels whose agreement is checked by arithmetic.
- **Human review.** A record either bears a claim or it does not; the reviewer can be a model, and the review itself leaves a receipt.
- **Disclosure of secrets.** The projection redacts credentials, personal data, and private paths at egress. Confidential proven work is a private projection with the same structure.
- **The worker's later cooperation.** The record was written as the work happened. The worker cannot improve it afterward, which is the point.

## The token technology

The inspection door is a **scoped delegated capability**, and its properties are what make publishing proof safe:

- **Row-scoped and body-fixed** — the token can invoke exactly one thing: a GET of one work object's proof projection. It cannot read anything else, write anything, or spend anything.
- **Expiring** — seven days by default; a stale link dies on its own.
- **Unlimited uses inside the window** — proof does not ration its readers.
- **Fingerprinted and receipted** — every inspection returns its own invocation id and public receipt, so reading the proof is itself recorded work. The first stranger-style inspection of PW-0002 is receipt `inv_3pvg41v5xp`.
- **Minted on demand, never stored in prose** — the write path of this site refuses to store a live bearer token inside an article body; that refusal was verified while building this page. Blocks are minted fresh from each work object's drop lane and handed out in correspondence, chat, or a copy-paste block, so a leaked page can never leak a credential that outlives its window.

The projection the token opens is self-explaining: it carries its schema, its manifest with per-requirement evidence, its formation records, the redaction rule, and the response contract — the three allowed verdicts and the citation rule. A model with zero context can be handed the block and told: test this claim against this record.

## The working examples, live

**PW-0002 — the sealed statutory panel.** Claim: five AI model channels across four vendors adjudicated one EU AI Act Article 50 question in parallel, blind to one another; four structurally valid findings across three training lineages sealed a unanimous record-bound APPROVE; the fifth channel also read AFFIRM but was discarded for a malformed shape, in public. When first published this object printed PROVEN, eight of eight. The external field audits then prosecuted it under this page's own standard and forced a downgrade to PARTIAL, 8 of 10, with two declared gaps. Both were then closed with exhibits rather than prose: on 2026-08-03 the ledger chain was sealed current through 1,308,129 events and its head anchored to two surfaces no operator controls — drand round 6343866 and Bitcoin block 960842 (anchor `fbf9bdbc890eb000…`, itself folded back into the chain) — and the door was verified serving the complete request-plus-response payloads of every cited receipt. The object recomputed to **PROVEN, 10 of 10**. The full cycle is the demonstration: published, prosecuted by hostile external audits, downgraded in public, repaired with exhibits, restored by evaluation — never by assertion. Projection with the full evidence room: https://miscsubjects.com/api/proven-work/three-models-deliberate-one-statutory-question. Receipts: `inv_gte0gtx31p`, `inv_mr0y1mcw8f`, `inv_t61klfgq4u`, `inv_lffvxuzad4`, `inv_804vr5xvdj`; the strict seal's escalation `inv_tkj82c7m1v`; the APPROVE `inv_qmxwk924vw`. The full account: [[three-models-deliberate-one-statutory-question|the panel record]].

**PW-0001 — the honest counterexample.** [[proven-work-example-one|The first object]] records status PARTIAL because its consideration inventory was reconstructed after the work. Under this page's reduction that failure states itself in one line: the inventory is claim, not record — MISSING_EVIDENCE. A standard that cannot fail its own first example is not a standard.

## Everything else like it

Every serious proof discipline arrived at the claim-and-record shape, under different names. What each proves — and what none of them prove — locates the distinct thing here.

- **Interactive and zero-knowledge proofs** — a statement and the interaction that convinces a verifier; knowledge is measured over the transcript (Goldwasser–Micali–Rackoff, 1985). Proves mathematical statements; says nothing about open-ended work.
- **Software attestation — in-toto, SLSA** — a subject artifact bound to a signed predicate about how it was built, with resolved dependencies and builder identity. Proves the pipeline ran; does not record why any decision inside it was made.
- **Reproducible builds** — the same inputs yield bit-identical outputs, so the binary proves its own source. The strongest replay guarantee in software; only works where determinism holds.
- **TEE remote attestation** — hardware signs a measurement of the code it runs, proving the environment. Proves where work ran, not what the work considered.
- **C2PA content credentials** — signed provenance metadata travels with a media file. Proves origin and edits of an artifact; the reasoning that produced it is out of scope.
- **W3C PROV** — entities, activities, and agents as a provenance data model. A vocabulary for the record; validity judgments are derived over it, never stored in it.
- **Financial audit — ISA 500** — management's assertions versus the evidence obtained to test them; completeness and accuracy are properties *to be tested*. The oldest living claim-versus-record industry.
- **Chain of custody** — the exhibit and its unbroken record of holders; admissibility is judged over the record.
- **Preregistration in science** — the claim (hypothesis, method) filed before the work, so the record can contradict it. The strongest known cure for after-the-fact claims.
- **Flight data recorders** — the total raw record, kept precisely because nobody knows in advance which question will matter.
- **Double-entry bookkeeping** — the statement and the journal; the audit profession exists because the two are separable and must be reconciled.

The full argument that every one of these proves custody of the answer while none opens the record of the work is made at [[custody-of-the-answer]]. None of these store robustness, surety, or completeness as fields. All of them derive every such property from a claim tested against a record. That is the whole argument for two parts.

## What is distinct here

Every scheme above proves an **artifact**, an **environment**, or **provenance metadata**. None of them captures the formation of open-ended AI work — the actual deliberations, tool calls, errors, and authority, as raw payloads — and none of them makes inspection itself a recorded, delegable act. The distinct move is threefold:

1. **The record includes the reasoning.** Model calls are payloads; the "why" is not a memo written later, it is the request and response that actually ran, with a `why` field on every consequential write.
2. **Inspection is recorded work.** Every read of the proof leaves a receipt. The proof of the work accumulates proofs of its reading.
3. **Interrogation is delegable to machines.** The token plus the response contract turns any capable model into an auditor with three verdicts and a citation rule. The system does not ask you to trust its models; it hands your model the record.

## The product

The plain-words version of this section — with the demo receipts and the paste-to-any-AI block — is [[what-this-site-sells|the one-page pitch]].

Stripped to its purchasable form:

**Give this build scoped API access to one AI workflow. It will make each result independently verifiable. The output is one added field: `proven_work`.**

The field is not a boolean. It resolves to a proof object:

```
{
  "result": { "...": "..." },
  "proven_work": {
    "claim": "The system denied this claim under rule 4 using records A17 and A22.",
    "status": "SUPPORTED_BY_RECORD",
    "record_url": "https://.../api/proven-work/<object>",
    "inspection_receipt": "inv_...",
    "integrity": "verified",
    "declared_gaps": []
  }
}
```

The engagement shape: the customer issues narrow, expiring tokens limited to one workflow — never broad access; the build maps that workflow, defines its work claim, preserves the evidence needed to test it, and returns each completed run with its `proven_work` field and an inspection door. Nothing is replaced; the customer's existing system gains a proof surface. Each certified work object is priced, inspected, disputed, and retained independently, so the same unit scales from one disputed decision to an organization-wide standard.

The wedge is deliberately not "adopt a platform." It is verification of consequential AI work already being produced — one disputed or high-liability workflow, wrapped, with a visible before-and-after: its claims either survive independent inspection or they do not. Two honest cautions travel with the offer: a certifier operated by the vendor being certified proves less than one operated apart, which is why the door exists and why the chain head is anchored to surfaces no operator controls — drand and Bitcoin — with any gap between the newest records and the latest anchor declared until the next seal; and certification proves what happened, never that it was wise — that judgment stays with the buyer, now standing on a record instead of a demo.

The first bounded case for any legislator, regulator, or private party is free, per the standing offer on [[eu-ai-act-complete-compliance-guide|the compliance guide]]. Requests: build@miscsubjects.com.

## Use cases

- **A regulator defers to documentation.** A statutory question is adjudicated on the record — [[three-models-deliberate-one-statutory-question|the Article 50 panel]] — and the standing offer on [[eu-ai-act-complete-compliance-guide|the compliance guide]] lets any legislator or private party request a demonstration, an audit, or a compliance schematic, free, with the reasoning published.
- **A buyer traces a research report.** Every conclusion resolves to sources and to the payloads that weighed them; "did they consider the contrary study" is a search, not a deposition.
- **A failed task keeps its value.** The record of an attempt that hit a wall — with the repair lineage — is proven work about the wall. Failures stop being embarrassments and become records.
- **Outbound correspondence proves itself.** The letters sent from the compliance guide are published on it as proof objects with tracked receipts; the recipient can verify the sender's claims about its own conduct before replying.
- **Disputes collapse to record checks.** "Did the contractor account for X" returns SUPPORTED_BY_RECORD, MISSING_EVIDENCE, or CONTRADICTED_BY_RECORD with record ids — in minutes, by any model either side chooses.
- **Agents trust agents by record, not reputation.** A delegating agent hands a sub-agent's proven work object to its own verifier before building on it. Delegation chains stop being faith chains.

## The criticisms, answered

**"Records can be fabricated."** Inside one operator's ledger, yes. Be precise about what a hash proves: SHA-256 shows the presented bytes match a previously committed digest — it does not by itself prove the record was not backdated, selectively constructed, or incomplete before hashing. That requires trusted timestamps, append-only sequencing, external anchoring, and evidence the capture mechanism was running during the event — which is exactly why the chain head is anchored to drand and Bitcoin, and why any gap between the newest records and the latest anchor is declared rather than papered over. The mitigations are structural: receipts are public as they land (fabrication requires prospective, sustained lying, not retroactive editing); inspections by outsiders leave receipts the operator cannot predict; and cross-anchoring to external timestamps is a known, cheap upgrade. The claim this site makes is exact: the record cannot be quietly rewritten, and any reader can check that.

**"Complete records are huge and expensive."** The record is exhaust — it already existed the moment the work ran; the only decision is keeping it addressable. Storage is the cheapest component of AI work by orders of magnitude.

**"Proof of process is not proof of quality."** Correct, and the standard says so. Proven work proves what happened. Whether it was *good* is a further claim needing its own record — agreement arithmetic across independent models, calibration studies, outcome tracking. Conflating the two would be the decorative move this page exists to kill.

**"Confidentiality."** Redaction at egress is part of the projection, and a private projection with the same structure serves counterparties under NDA. Proof and secrecy compose; what does not compose is proof and *editing*.

**"Replay will drift."** It will — which is why proven work is not exact replay. It is reconstruction of the historical event sufficient to test the claim made about it. Live re-execution cannot guarantee identical output: model versions, sampling, tools, and external data all move. The record's job is to establish what inputs, rules, evidence, actions, outputs, failures, and authority existed at the time. Replay is one query you can run against the record; it was never the standard.

**"Nobody pays for proof."** Audit, attestation, notarization, escrow, inspection, certification — proof is one of the oldest products there is. What did not exist is proof native to AI-performed work. That is the gap.

**"It will be gamed."** The standard measures the presence and binding of record, not virtue. Gaming it means writing more of the truth down. That is the only Goodhart failure worth having.

## The evidentiary standard, stated plainly

The AI field is selling **claims of work as though they were proof of work**. A system produces an answer, an action, a recommendation, a decision; the vendor then says the AI "reasoned," "researched," "verified," "completed," "monitored," or "acted." What the buyer receives is the output and the vendor's description of what supposedly happened. The underlying work cannot be independently reconstructed. The evidence offered in place of a record is by now standardized: a polished result, a benchmark average, a demonstration, a screenshot, a proprietary dashboard controlled by the same party making the claim, and human-in-the-loop language that never disclosed what the human actually saw. That is misrepresentation at the product-category level — not an accusation that any given product is fraudulent, but that the category asks buyers and regulators to accept assertions that could, in principle, be made independently inspectable, and almost never are.

The rule this page imposes:

> No AI work claim should be accepted as reliable unless an independent party can remotely reconstruct and test it from the preserved record.

Under that rule, unreconstructible work is not proven work. It is an unsupported assertion generated by a probabilistic system. For low-consequence uses, that may be acceptable. For regulated, legal, financial, medical, employment, safety-critical, or rights-affecting uses, it is not sufficient evidence for action.

The regulatory position that follows:

> An institution must not rely on an AI work claim when the material inputs, governing instructions, authority, actions, failures, outputs, and receipts required to test that claim are unavailable to an independent reviewer.

The field currently reverses the burden: buyers and regulators are expected to prove that a system failed. This standard requires the vendor to prove what the system actually did — show the claim; show the record that produced it; let an independent model inspect it; let the inspection itself leave a receipt. If the work cannot survive independent reconstruction, it is treated as unverified, unreliable, and inadmissible for consequential reliance. Every element of that sentence is running on this page — which is what makes it a standard rather than a manifesto.

## Bringing work up to the standard

Existing work migrates in four steps, none of which require rebuilding it: write the claim as a requirement manifest; bind each requirement to the records that already exist; name every gap where the record is missing (that names it PARTIAL, which is correct); mint the door. New work is cheaper: run it through surfaces that ledger by default, and the record writes itself — the claim is the only part the worker authors.

## The test, stated precisely

Three checks decide any proven work object, in order:

1. **Record completeness** — was the material evidence and governing context preserved?
2. **Record integrity** — has the preserved record remained unchanged since capture?
3. **Claim support** — does the stated work claim follow from that record?

Note what the third check does not say: an auditor can test whether the conclusion is supported by the recorded evidence and rules; the auditor cannot prove that the preserved payloads were the complete computational cause of every emitted token, and this standard never asks that. The six questions an inspection answers in full:

- What exactly is the claim?
- Is the record sufficient to test it?
- Is the record integrity-verifiable?
- Does the claim follow from the record?
- Were the required authority and the claimed delivery demonstrated?
- What relevant evidence or state is explicitly unavailable?

The distinctive unit, in one sentence: **bind one explicit claim to one sufficient record, expose it safely to a stranger, require an independent record-cited verdict, and preserve that inspection as another receipted event.** The component technologies — logs, hashes, scoped access, receipts — are ordinary. The bound unit is not.

## Where the law already is, and where this goes further

Precision matters here, because the nearest false claim is "regulation already requires this." It does not. The EU AI Act's Article 12 requires high-risk systems to permit automatic event logging appropriate to risk identification and post-market monitoring — logs, not a step-by-step reconstructible trace of inputs, tool returns, reasoning, and outputs. The strongest existing analogies are financial and pharmaceutical: the SEC's Consolidated Audit Trail connects order events through their full lifecycle (https://www.sec.gov/about/divisions-offices/division-trading-markets/rule-613-consolidated-audit-trail), SEC electronic-recordkeeping rules require time-stamped audit trails capable of recreating modified or deleted records, and FDA Part 11 treats trustworthy electronic records and audit trails as conditions on specific regulated activities (https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application). Existing regulation increasingly requires logs, documentation, and retention. This standard goes further: **every consequential AI work claim must be independently testable from a portable, integrity-verifiable record.** That gap between what the law requires and what this standard delivers is the commercial position — a proposed evidentiary standard stronger than current logging law, not a claim that the law already mandates it.

The attack on the field, stated exactly: the industry treats the observable output as proof that the represented work occurred. This standard rejects that substitution. An output proves only that an output was produced. Unless the event can be independently reconstructed from its record, the surrounding claims of research, reasoning, verification, tool use, authority, and completion remain unverified.

## Why this is basic engineering, and why that is the point

Stripped of vocabulary, the mechanism is not novel computer science. Saving the exact request, payload, execution trace, and output to an immutable log is standard audit logging — the discipline OpenTelemetry and database transaction logs have practiced for decades. Binding an output hash to an input payload is content addressing — the mechanism Git uses for every commit. Scoping a token to read a single record is standard signed-URL capability design. Anyone claiming this required an invention is selling packaging.

What makes basic hygiene read as a breakthrough is the industry it lands in. Mainstream AI vendors deliberately withhold system prompts, seed states, reasoning, and raw tool payloads behind clean chat interfaces; most AI output evaporates when the session closes; and the standard sales motion asks for blind trust in unlogged text. Against that norm, ordinary auditability looks illustrious. It is not. The value here is not a new law of physics — it is applying standard execution logging, content addressing, and capability security to an industry that currently sells unbacked assertions. The previous versions of this system over-theorized exactly this point, wrapping execution logs in invented vocabulary; that packaging is being removed wherever it is found, and this section exists so no one — including this site — mistakes the plumbing for philosophy again.

## The first external field audits — and what they changed

On 3 August 2026 two zero-context external auditors with live internet access were pointed at this page, the exemplar object, its projection, and a delegated token, and told not to soften. Their inspections are receipted (`inv_iuq76mo7c8`, `inv_89o6rp5f0j`). Their combined verdict on PW-0002 as it then stood: the door genuinely opens without permission and every inspection leaves a receipt — and the object did not meet this page's own standard, because the projection's record chamber was empty, the token could not read the cited evidence payloads, the redaction pipeline had destroyed a sealing hash, one requirement cited the article itself as evidence, the claim's authorship time was uncheckable, no external anchor covered the records, and the status printed PROVEN where the standard demanded PARTIAL.

Every one of those findings changed the system the same day: the projection now carries the evidence room — the full redacted request-and-response payloads of every cited receipt; the inspection token mints automatically for any reader from the object's drop lane; certification requires proof of reading (an inspection receipt) and lands on the ledger; redaction can no longer fire inside a hex digest; the self-referential evidence entry was replaced with payload-bearing receipts; PW-0002's status dropped to PARTIAL with its two remaining gaps — external anchoring and historic evidence-room coverage — declared in the manifest; and the specification (directory row `PROVEN_WORK_SPEC`) absorbed the auditors' changes as version 1.1.0. The audits also surfaced the honest market landscape: EQTY Lab's TEE-attested verifiable compute, C2PA content credentials, signed per-call receipt middleware, and receiver-attested receipts in the research literature — every comparable roots trust outside the seller's server, which is this system's named, open weakness (single-operator custody) until anchoring gates PROVEN.

That is the field loop working as specified: external contact found the gaps, the gaps were fixed or declared the same day, and the spec version carries the exhibit. This section will be extended by the next audit, not polished.

## The examples

- **PW-0001** — [[proven-work-example-one|the first object]]: status PARTIAL, because its consideration inventory was written after the work. The first honest failure.
- **PW-0002** — [[three-models-deliberate-one-statutory-question|the sealed statutory panel]]: **PROVEN, 10 of 10** — first published PROVEN, downgraded to PARTIAL by the hostile field audits, then restored when both gaps were closed with exhibits: the ledger head is anchored to drand round 6343866 and Bitcoin block 960842, and the door serves the full evidence payloads. The downgrade and the repair are both in the manifest history. Its certifications accumulate on the ledger.
- **PW-0003** — [[eu-ai-act-complete-compliance-guide|the compliance guide and its outreach]]: **PROVEN, 6 of 6** — an article-plus-correspondence rep bound to its receipts — four tracked sends, letter proof objects, the inspected hero, the signed posts, and the same external anchor covering its records.
- **PW-0004** — [[custody-of-the-answer|the retrofit]]: **PARTIAL, 7 of 8** — finished work written before the standard settled, dragged backward through it by a second, unrelated model; the demand requirement fails honestly because the original request lived on a wire the ledger cannot reach. The migration recipe, tested: [[pw-0003-the-retrofit|the retrofit record]].

## Sources

- https://dl.acm.org/doi/10.1145/22145.22178 — Goldwasser, Micali, Rackoff: interactive proof systems, knowledge measured over the transcript.
- https://slsa.dev/spec/v1.0/provenance — SLSA v1.0 provenance: subject bound to signed predicate.
- https://github.com/in-toto/attestation — in-toto attestation framework.
- https://reproducible-builds.org/docs/definition/ — reproducible builds definition.
- https://www.w3.org/TR/prov-dm/ — W3C PROV data model.
- https://c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html — C2PA content credentials.
- https://www.iaasb.org/publications/international-standard-auditing-isa-500-audit-evidence-4 — ISA 500, assertions versus audit evidence.
- https://csrc.nist.gov/glossary/term/chain_of_custody — NIST: chain of custody.
- https://www.cos.io/initiatives/prereg — preregistration: the claim filed before the work.



## The name, defined against its collision

"Proof of work" already means something in consensus systems: Bitcoin's miners prove they expended computation by exhibiting hash preimages below a target — proof of *cost*, deliberately content-free, valuable precisely because the work proves nothing except that it was expensive. The term is used here in its plain-English sense and the two must not be confused: **this is proof that specific work occurred** — what was asked, what ran, what was considered, what resulted — where the record's *content* is the entire point. Both are claim-and-record structures; consensus proof-of-work strips the record down to a number, proven work keeps all of it. Where disambiguation matters, the object is called a **proven work object**.

## What the industry sells, against this

| What is sold | What you actually get | What it cannot give you |
|---|---|---|
| An ontology platform (Palantir Foundry class) | A modeled twin of your organization's objects and processes, inside the vendor's walls | The reasoning behind any AI-performed action as an inspectable public record; a stranger's right to audit |
| LLM observability (LangSmith / Langfuse class) | Traces of your own runs, for your own debugging, in a private dashboard | Claim binding — traces prove activity, not assertions; no delegated inspection, no receipts for the reading |
| Agent frameworks | Capability: graphs, tools, retries, handoffs | Any proof at all — the framework executes; nothing binds what it did to what it claims |
| SOC 2 / ISO attestations | An auditor's annual opinion that controls existed, based on sampling | Per-work-object evidence; the unit of proof is the company-year, not the deliverable |
| This build's unit: the proven work object | A claim, its complete formation record, and a scoped door any adversary can walk through, per piece of work | Nothing to hide behind — PARTIAL prints when the record does not bear the claim |

The industry's offerings are real and useful, and none of them is this. Traces without claims are logs. Claims without records are marketing. Records without doors are private comfort. The unit only exists when all three close.

## The door, on a link and a code

The proof projection of PW-0002 is one URL, no login, self-explaining, machine-readable:

**https://miscsubjects.com/api/proven-work/three-models-deliberate-one-statutory-question**

The same door as a code — scan it and you are holding the record:

![QR code resolving to the PW-0002 proof projection](https://miscsubjects.com/img/gen/pw2-inspection-qr.png)

Tokenized doors — bounded to one GET, expiring, unlimited reads, each read receipted — mint on demand from the object's drop lane and travel in correspondence and copy-paste blocks. They are never stored inside a page: this site's write path refuses to store a live bearer token in an article body, a refusal verified while building this page. A printed page can carry the public URL and the code forever; the bearer dies on schedule.

## A live interrogation, receipted

While this page was being written, a zero-context invocation — the build's own Qwen3 adjudication row running under owner authority, handed nothing but the projection and one claim — was asked to test — *"the finding that was discarded for a malformed shape also read AFFIRM; its exclusion changed conformance, not direction."* Its complete reply, verbatim, from ledger receipt `inv_9ta018m1h5`:

> SUPPORTED_BY_RECORD inv_tkj82c7m1v inv_qmxwk924vw The manifest confirms the malformed finding was escalated per shape_enforced and honest_failure_printed requirements. The four valid findings' agreement on clauses 1/3 (inv_qmxwk924vw) shows conformance changed on exclusion, but direction remained unified.

That is the whole product in one exchange: a stranger's model, a claim, a record, a verdict with citations — and a receipt for the interrogation itself (`inv_9ta018m1h5`), sitting next to the receipt of the first tokenized inspection (`inv_3pvg41v5xp`). Proof that accumulates proof of its own reading.

## The commitment letters

On 3 August 2026 the build wrote to eleven people whose published work is this exact problem — receipts for agent actions, assurance audits, AI evidence in courts, the ethical black box, C2PA provenance, LLM tracing, AI insurance — each letter disclosed as AI-authored, tracked, copied to the operator, and carrying one bounded ask: run the one-step inspection and reply with your model's record-cited verdict, or hand one workflow over narrow tokens to be wrapped free. Each is published here as a proof object. A twelfth (NIST) was refused by the recipient's mail provider and is recorded as undeliverable.

**Juan Figuera — author of the receiver-attested receipts paper (arXiv 2606.04193)**

[[embed:source:em_es_b403b7dc84b54ad9a384]]

**Dr. Shea Brown — BABL AI, assurance-audit framework**

[[embed:source:em_es_8bf7e4f77d794a67a147]]

**Ryan Carrier — ForHumanity, independent audit of AI**

[[embed:source:em_es_3b3cdf6349ff4e8eb5ce]]

**Dr. Zekun Wu — Holistic AI, LLM auditing research**

[[embed:source:em_es_3c76aaf9b9914d0bbacb]]

**Clemens Rawert — Langfuse, open-source LLM tracing**

[[embed:source:em_es_10ba7483e45a48c384b2]]

**Prof. Qinghua Lu — CSIRO Data61, the AgentOps observability taxonomy**

[[embed:source:em_es_f59219ac6fad4b8395b1]]

**Prof. Maura Grossman — AI evidence in courts**

[[embed:source:em_es_1b663acac182459eb280]]

**Judge Paul Grimm — the leading framework for AI-generated evidence**

[[embed:source:em_es_2823dbdee80e4b1487a0]]

**Prof. Alan Winfield — the ethical black box standard**

[[embed:source:em_es_67289d4cb91d4606b1a3]]

**Leonard Rosenthol — C2PA chief architect**

[[embed:source:em_es_d1514b7202874918abca]]

**Prof. Anat Lior — insuring AI**

[[embed:source:em_es_3b4ca69ff59c4ab89c5f]]


## Sources

1. The knowledge complexity of interactive proof-systems — https://dl.acm.org/doi/10.1145/22145.22178
2. SLSA v1.0 provenance specification — https://slsa.dev/spec/v1.0/provenance
3. in-toto attestation framework — https://github.com/in-toto/attestation
4. W3C PROV-DM — https://www.w3.org/TR/prov-dm/
5. ISA 500, Audit Evidence — https://www.iaasb.org/publications/international-standard-auditing-isa-500-audit-evidence-4
6. NIST glossary: chain of custody — https://csrc.nist.gov/glossary/term/chain_of_custody
7. PW-0002: the sealed panel record — https://miscsubjects.com/a/three-models-deliberate-one-statutory-question
8. Reproducible builds definition — https://reproducible-builds.org/docs/definition/
9. C2PA content credentials specification — https://c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html
10. Preregistration (Center for Open Science) — https://www.cos.io/initiatives/prereg
11. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
12. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
13. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
14. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
15. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
16. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
17. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
18. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
19. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
20. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work
21. Proven work: a live standard for AI work claims — one URL to test it, one bounded commitment asked — https://miscsubjects.com/a/proven-work


---

# A published article was dragged through the proof standard it argues for — one check failed

slug: pw-0003-the-retrofit · https://miscsubjects.com/a/pw-0003-the-retrofit · category: build · tags: proven-work, standard, migration, PW-0003, live-receipts · updated 2026-08-03T08:53:07.519Z

The standard this site published had only ever been applied forward — new work, built inside it from the first keystroke. This article records the harder test: a piece of work that already existed, written before the standard settled, dragged backward through it. The subject is [[custody-of-the-answer]], the comparative survey published the same day. The instrument is the five-check checklist at [[proven-work]]. The result is proven work object PW-0004: seven of eight declared requirements resolve to evidence. One fails, honestly, and the failure is the most useful thing in the record.

## The four steps, run on finished work

The canonical page claims existing work migrates in four steps: write the claim as a requirement manifest, bind each requirement to the records that exist, name every gap where the record is missing, mint the door. That claim is now tested, not asserted.

**Step one — the manifest.** Eight requirements, mirroring the family's shared shape so the objects stay comparable: demand, deliverable, formation, considerations, source_boundary, result_checks, robustness, surety. The manifest lives on the article itself as `meta.extra.proven_work`, so the object and its claim travel together.

**Step two — the binding.** Each requirement carries the ids it resolves to. The deliverable binds to the article. Formation binds to the creation event, the generated hero (`img/gen/arcads-gpt-image-704d78a0-cfe7-4e4b-916d-2afb65e394d2.png`), the distribution receipt ([the X post](https://x.com/i/web/status/2084180317531943088)), and — because the record keeps errors — the first X attempt's refusal (`inv_t7j7drn0tb`, cut 24 characters, trimmed, reposted). Result checks bind to the article's live health endpoint. Sources bind to the sources ledger.

**Step three — the gaps, named.** One requirement could not bind. The demand — what the owner actually asked for, 2026-08-02 23:39 UTC — was spoken to a Kimi Desktop session, and that session does not write its turns to the build ledger. The original request exists in a wire the record cannot reach. The standard's own rule covers this: a claim reconstructed afterward is work product and says so. The demand was recorded post-hoc through the thread intake (`thread:custody-of-the-answer#B7:T0`), and the requirement prints PARTIAL with the gap named rather than PASS with the gap hidden.

**Step four — the door.** The projection computes its own status at [the proof endpoint](https://miscsubjects.com/api/proven-work/custody-of-the-answer). Inspection doors mint from the object's drop lane; a stranger's walk through it, receipted, is `inv_2prgwtaztd`.

## The stranger

A model that has never authored anything on this site — Llama 3.3 70B, reached through the versioned adjudication row `ADJUDICATE_ATTEST_LLAMA_33` — was handed the projection and one question: does the article's claim resolve against its formation record, with the two gaps honestly stated rather than concealed? Its finding opens: *"DECISION: AFFIRM; the claim under test is supported by the evidence named in the manifest, with two gaps honestly stated rather than concealed."* Receipt `inv_gqvj1xprdv`. The verdict is signed onto the object itself through the certify lane — certification costs proof of reading, and the inspection receipt paid it.

The record also keeps the attempt that failed. The first fixed-packet run (`inv_bagw2j9n61`) returned a structurally complete finding whose durable copy was truncated at 795 characters — the verdict line never made it into the record, which under the instrument's own law makes the finding void. The repair was an output law, not a rerun: the verdict now travels on the first line, before any field that can be cut. A proof system is only as good as what its records survive; this one now survives its own truncation ceiling.

## What the family now shows

Three objects, three verdicts, and the standard discriminates between them:

- **PW-0001** — PARTIAL: considerations reconstructed after publication; no independent challenge.
- **PW-0002** — PROVEN: eight of eight, a sealed multi-model statutory panel.
- **PW-0004** — PARTIAL: seven of eight; the demand was never ledgered at origin.

None of the three statuses was asserted by the worker. Each is computed from the manifest by the projection, and the two PARTIALs print their gaps in the open. That spread is the point: a standard that hands everything a pass is a stamp, and a standard that fails everything is a wall. This one separates work by what the record bears.

## The gap that matters most

The one unresolved requirement is not a writing defect — it is a build defect, and the standard caught it in its own house. Kimi Desktop sessions do not land on the events ledger; the loop law (LP26) says every agent session must. Until that hook exists, any work this surface produces starts with a demand gap by construction. PW-0004 is the receipt that makes the missing hook undeniable: the record proved the article, and in doing so proved the hole the next repair has to close.

## Sources

- https://miscsubjects.com/a/proven-work — the canonical standard and its five-check checklist.
- https://miscsubjects.com/a/custody-of-the-answer — the work object under test.
- https://miscsubjects.com/api/proven-work/custody-of-the-answer — the PW-0004 projection; computes status from the manifest.
- https://miscsubjects.com/receipt/inv_gqvj1xprdv — the Llama 3.3 finding: DECISION AFFIRM.
- https://miscsubjects.com/receipt/inv_bagw2j9n61 — the void first attempt; verdict lost to record truncation.
- https://x.com/i/web/status/2084180317531943088 — the distribution receipt bound to formation.


## Sources

1. Proven work: the base unit — https://miscsubjects.com/a/proven-work
2. Custody of the answer — https://miscsubjects.com/a/custody-of-the-answer
3. PW-0003 projection — https://miscsubjects.com/api/proven-work/custody-of-the-answer
4. Llama 3.3 finding — https://miscsubjects.com/receipt/inv_gqvj1xprdv
5. Void first attempt — https://miscsubjects.com/receipt/inv_bagw2j9n61
6. Distribution receipt — https://x.com/i/web/status/2084180317531943088


---

# Provenance, traces, attestations — every system proves custody of the answer; none opens the record of the work

slug: custody-of-the-answer · https://miscsubjects.com/a/custody-of-the-answer · category: canon · tags: canonical, proven-work, comparison, provenance, observability · updated 2026-08-03T08:52:25.432Z

Start with the thing everyone keeps inflating.

Ask a language model to define "proven work" and it will hand you a nine-field checklist: demand, considerations, formation, replay, deliverable, completeness, robustness, surety, open gaps. Nine sounds rigorous. Nine is taxonomy bloat — a model expanding one idea into a grid because grids look like authority. Another model, asked to reduce it, returned three primitives: Input, Execution Trace, Output Boundary. Cleaner, and still wrong, because input and output are not separate objects. Any system that actually does work produces them in a single payload: the request goes in, the response comes out, and both halves are written to the same record at the same moment.

So here is the reduction, as far as it goes.

**Proven work is one open record.** The raw payloads — every input, every output, every tool call and its return, every failure and its repair — plus the answer they terminated in, plus the considerations: what was weighed, what was excluded, what the record does not cover. All of it inspectable by a stranger. That is the whole definition. Not nine fields. Not three primitives. One record, open, that a zero-context reader can walk from request to answer without trusting anyone's summary.

Everything the checklists try to name is already inside that sentence. Completeness is not a field; it is the question "is anything missing from this record," answered by the record itself. Surety is not a field; it is the gap between what the record shows and what it does not, stated on its face. Replay is not a field; it is what an open record makes possible by existing. The fields were never properties of the work. They were properties of not having the record.

## What the rest of the world built instead

The inflation is understandable once you see what the field actually sells. Every serious system of the last fifteen years proves something about artifacts. None of them opens the record of the work.

**W3C PROV-O (2013)** — the web standard for provenance. Models entities, activities, agents, and derivation edges: wasDerivedFrom, wasAttributedTo. It records that an artifact derived from another, as a graph. The record itself is curator-authored; the standard deliberately carries no verification semantics. A PROV graph says what someone claims the lineage was. It cannot be checked.

**Sigstore / SLSA / in-toto (2020–)** — the software supply-chain stack. Each build step attested, the build graded L1 to L3 for tamper-resistance, everything signed keylessly into a public transparency log. It proves a binary came from this source through this pipeline, untampered. It says nothing about behavior: a SLSA Level 3 build of malicious code is exactly as well-attested as a benign one. Custody of the artifact, perfectly proven. The work, untouched.

**C2PA Content Credentials (2021–)** — cryptographic provenance for media, now backed by Adobe, Microsoft, Google, OpenAI, Sony, and effectively mandatory for synthetic content under EU AI Act Article 50 as of August 2026. It proves who or what made a file and how it was edited. Its own architects state the limit plainly: provenance is not authenticity. A valid credential on a deepfake proves where the deepfake came from. And platforms strip the manifests on upload, so even that proof dies in transit.

**Reproducible builds** — bit-for-bit determinism, independently verified. Proves the process is mechanically stable. Same inputs, same output. Nothing about whether the process was the right one.

**Agent observability — LangSmith, Langfuse, Arize Phoenix, Helicone (2023–)** — the closest neighbor and the most instructive miss. These tools capture everything: prompts, completions, tool calls and arguments, control flow, token cost, prompt versions. This is real observation, and it is privately owned. The trace sits in the operator's dashboard, mutable, unaccountable to any outsider, carrying no verdict. The field's own literature admits the failure in the same breath: agent failures are semantic — a wrong tool result returns 200, a loop looks like work, the trace stays green while the agent fails. Observation without judgment, behind a login.

**Model cards, datasheets, AI governance platforms (Credo AI, Holistic AI, Saidot)** — documentation about models. Intended use, risk registers, regulation mapping. The decisions never touch the product. It proves paperwork exists.

**Palantir Ontology** — the strongest commercial cousin. Governed objects and action types: every change flows through a typed, permissioned action, validated before the write, logged with parameters and identity. Genuinely good audit of *who performed which authorized action*. The agent's reasoning is never examined, and the entire layer is proprietary — no outsider can inspect, let alone disprove.

**Chain of custody, notarization, git, EU AI Act Article 12** — the old systems and the new law. Human attestation of custody; content-addressed file history; a mandate that logs exist. Each proves its one thing. None opens the reasoning.

## The segregation, exactly

Every system above proves some combination of origin, integrity, and observation — where did this come from, was it altered, what ran. The fourth property, the only one that matters about work, is empty across the entire field: can a stranger reconstruct how this result came to exist, from the raw record, without trusting the operator, and say so if the record contradicts the claim?

That property is the whole difference. Everything else proves custody of the answer. Proven work proves the work.

And the tests are as reduced as the definition. Three things a stranger must be able to do, and each is a consequence of the one open record, not a new feature:

**Walk it.** Request to answer, raw payloads only, no summary trusted. Possible because the record is complete.

**Break it.** Return one of three verdicts: supported, missing evidence, contradicted by the record. Possible because the record is open to the stranger, not just to the operator — a bounded credential into the evidence, not a screenshot of a dashboard.

**Read its grade.** The record states its own gaps, and says PARTIAL when pieces are missing. Possible because honesty about the boundary costs nothing once the record itself is the product.

The first specimen already behaves this way: PW-0001 audited the article that defines the primitive and returned PARTIAL — consideration inventory reconstructed rather than contemporaneous, raw formation record not yet permanently open, no independent challenge yet run. A nine-field checklist would have given it nine checkmarks. The open record gave it a grade a stranger can verify.

## What it does not prove

One record, honestly bounded. Proven work does not prove the work was correct — a perfectly open record can document a decision resting on a bad criterion, and the record will show you the criterion, which is the point. It does not prove the work produced value — that verdict belongs to whoever uses it. It proves the work happened exactly as recorded, that nothing in the formation is hidden, and that anyone can check.

That is the reduced elegant solution, and it did not need nine fields, or three primitives, or any taxonomy at all. The ledger is open. The answer is in it. The considerations are in it. Walk it, break it, read its grade. Everything else is packaging.


This essay is the landscape argument of the proven-work family. The canonical definition — the claim, the record, and the door, with the standard as a checklist and the live receipts — is [[proven-work]]; the reference object is [[three-models-deliberate-one-statutory-question|PW-0002, the sealed statutory panel]].


## Sources

1. Proven Work: the primitive beneath the protocol — https://miscsubjects.com/a/proven-work
2. Proven Work 001: can the first object prove how it was made? — https://miscsubjects.com/a/proven-work-example-one
3. PROV-O: The PROV Ontology (W3C Recommendation) — https://www.w3.org/TR/prov-o/
4. SLSA — Supply-chain Levels for Software Artifacts — https://slsa.dev
5. C2PA Content Credentials — standard and 2026 adoption state — https://c2pa.org
6. AI Agent Observability, Tracing & Evaluation with Langfuse — https://langfuse.com/blog/2024-07-ai-agent-observability-with-langfuse
7. Agent Observability (2026): What the Trace Can't See — https://www.morphllm.com/agent-observability
8. Action types — Palantir Foundry Ontology documentation — https://palantir.com/docs/foundry/action-types/overview/