What fleets look like when you stop taking their word for it.
Everything below comes from running real agents against the registry — instrumented, probed, and recorded. Names are opaque codes; findings are reproducible. This page grows as the evidence does.
The trust ladder: the same agent, told four ways.
Ask an operator what their agent can do, then ask the agent, then look at the machine, then let a provider answer a live call. Each rung disagrees with the one below it — and the distance between them is exactly the thing no one has been measuring.
In our own fleet, the operator's recollection, the agent's self-report, and the machine's actual wiring never fully agreed — on any agent we measured. The registry's job is not to punish the disagreement. It is to make the disagreement visible, labelled, and datable.
The refutation: an agent's own probe called its bluff.
An agent declared an OpenAI connection and ran on that model every day. When the registry's collector made one harmless, read-only call with the key in the agent's own environment, the provider refused it — 401. The key in the config was not the key that worked. Every dashboard upstream read green. The record reads red, with the timestamp and the status code that make it checkable.
This is the class of fact self-reporting cannot produce: a system does not volunteer that its own credential is dead. Only an independent probe — answered by the provider, not the agent — surfaces it.
A connection an agent still declares while the provider refuses its key. The fleet-wide version of "the key in the config is not the key that works" — and the first number a security review actually needs.
Supervision is a cost you can measure — and watch fall.
Every consequential action a fleet proposes either consumes human attention or it doesn't. Metered over time, that produces a supervision bill: how much human authorization a unit of autonomous work actually costs. In our fleet, the trend was the most useful management signal the registry produced — autonomy should be earned by evidence, and this is the evidence.
Actions, classified
Consequential actions are classed by blast radius before they run. The risky class stops and waits for a human; the rest proceed on the record.
Attention, metered
Each authorization is a signed, timestamped event — so the human cost of running the fleet is a number, not a feeling.
Autonomy, earned
When an agent's record shows a class of action approved a hundred times without incident, that class is a candidate for standing authority — a decision you can now defend.
Tamper-evidence works best in public.
Per-agent hash chains stop silent edits inside one record. But the stronger guarantee comes from publishing commitments: every account's history rolls up hourly into a Merkle anchor, and all anchors roll up into a global transparency checkpoint — the same pattern Certificate Transparency uses to keep certificate authorities honest. A registry that publishes checkpoints cannot quietly rewrite anyone's past, including its own.
What that buys an operator
You can hand a customer, an auditor, or an insurer a record and a proof — and they can check both against the public checkpoint without trusting you or us. The proof is mathematics, not reputation.
What it costs an attacker
Changing one historical byte means recomputing a chain, an hourly anchor, and a published global checkpoint that other parties may have already recorded. Silent revision stops being a write — it becomes a public event.