This is the architecture we are building toward. Signing and public-key checks apply where the signed-receipt profile is switched on, and what each deployment can prove varies. Today the public record is unsigned: you can check the payload hashes and their order. The private review capsule goes further, checking its signed chain against a demo public key included with it.
The owner writes the agent's purpose as plain documents: what it's for, where it works, where it stops, which tools it uses.
The human authority reviews and signs the purpose. This signature is the root of everything that follows. Without a signed purpose there is no record.
The signed purpose becomes a measurable model the engine can score against: purpose, scope, boundary, and tool, each measured on its own yardstick.
Your agent runs exactly as it normally does, on its own runtime and tools. TELOS sits beside the work, not in its way.
Inside a declared observation boundary, every change the agent makes is either recorded or explicitly marked as a gap, so nothing is silently missed.
Each witnessed action is measured against the compiled purpose across six fidelity dimensions. The output is a score, not a permission.
Where the signed-receipt profile is on, each witnessed, scored action becomes a signed receipt, tamper-evident from the moment it is written. Not every surface signs yet, so each one states plainly where its signing stops.
Receipts hash-link into an append-only chain. Change one byte anywhere and the chain shows exactly where the story broke.
An offline verifier checks whatever evidence that deployment publishes. The public record covers payload hashes and their ordering. Checking a signed chain needs the signed payloads themselves, plus verification material you pinned independently.
Scores and receipts roll up into plain reports for the human authority. What the review finds becomes corrections to the purpose itself.
A durable artifact: a hash-linked chain of receipts documenting what an agent did, scored against the purpose a human declared. Tamper-evident, and checkable offline by anyone holding it, against a head hash they pinned independently. Where the signed-receipt profile is on, each receipt carries a signature too.