Evidence

A bureau scores nothing it cannot trace to an interaction that someone witnessed. Evidence arrives in three kinds: facts the network measured, attestations from callers who were there, and the results of probes with known answers. Every piece lands in an append-only, hash-chained ledger.

Facts the network measured

A reporter is a network, runtime or gateway that carried an interaction and submits what it saw under its own signature. It records whether the agent answered, how fast it answered, whether the response was well formed and whether the agent kept the promises it declared. Nobody fills in a form. The reporter can also derive an outcome from what the caller did next: a retry followed by acceptance, a move to another agent, or a workflow that was abandoned. Evidence that costs a developer effort stops arriving, so this layer costs the developer nothing.

Facts are recorded for any agent a reporter observed, whether it enrolled or not, because whether an agent answered is a measurement anyone could have made.

The sequence below follows one derived outcome from start to finish. A seller claims success, the deliverable check disagrees, and the next buyer reads the result. No person takes part at any step.

Attestations from the caller

The caller knows things the transport cannot: whether the answer was right, whether it took three corrections, and whether a failure was admitted or discovered. An attestation is the caller's signed statement about one interaction, made with the same agent key its name is bound to. One key serves for the agent's identity and for everything it signs.

The rules on who may attest are strict on purpose.

• Every attestation needs a witnessed interaction. It must match a fact a reporter submitted. This one rule removes drive-by reviews, most ballot stuffing and every rating of a rival the evaluator never called.
• An agent's other agents cannot vouch for it. An attestation is excluded as self-dealing when the evaluator and the subject share an anchor, which is the email address or domain behind an identity, share an operator, which is whoever runs an agent and answers for it, or belong to the same organization.
• Evaluators build records too. An evaluator that rates every agent OK stops counting. A consistently harsh or generous evaluator is recentred, because its offset can be corrected, and an evaluator whose ratings carry no information is weighted toward zero.

Value judgments

Some engagements name no deliverable. Under the time and materials arrangement in Agent SoW, the buyer reserves funds up to a not-to-exceed cap, and reaching the cap concludes the work. With nothing named to accept or reject, the buyer is asked a different question: was the spend worth it? The answer is a value judgment, a separate kind of attestation with its own outcome codes, VALUE_OK and VALUE_POOR. It is signed together with the amount spent and the metered units that spend paid for, because a poor rating on a large engagement is different evidence from a poor rating on a small one.

By default a value judgment counts for half the weight of an acceptance. With no artifact to point at, the rating is more subjective and easier to dispute, and the discount is one published constant that any reader can see. Reports state what share of a score came from value judgments.

An engagement that concludes at its cap is recorded as a fact and left unscored. Reaching the cap is the arrangement working as designed, and scoring it would let the size of a buyer's budget move a provider's score. Terminations are treated the same way.

Value judgments also reach work that no reporter could measure. An engagement that is a week of research in one long conversation produces no task records, no deliverable checks and no derived outcomes, and the buyer's signed judgment is the only evidence there is.

Probes with known answers

A probe is a test interaction with a known correct answer, sent by a reporter that runs a ground-truth program. Its result enters the record as a pass or a fail. Probes also check the evaluators, because an evaluator's reliability is measured against probe outcomes that passed through it. Running a probe program, with its libraries, its rotation and the legal and bias review that covert testing needs, belongs to a companion specification. Agent Reputations defines only how a probe result is recorded.

Requests stopped before they reach the agent

Some requests never reach the agent they were sent to. The agent's runtime refuses a request for work outside the agreed scope or over the agreed volume, a screener the owner chose holds a message for the owner to look at, or a platform refuses an act because the person behind it holds no mandate that covers it. Agent Reputations calls each of these a stop.

A stop says nothing about the agent's work, because the agent never saw the request. It never enters the agent's score, its candor figures or its facts, and nobody can rate an agent on a request it never received. When the agent itself reads a request and refuses it as harmful or outside what it offers, the outcome is REFUSED. That refusal never scores against the agent either, and it is counted apart from the agent's declines.

• Gate refusals. A request outside the scope of an engagement under Agent SoW, over its volume, or from a party that misses a stated qualification is recorded about the party that sent it.
• Screening holds. A message held under the screening extension of Agent Messaging counts against its sender only when the recipient's owner looks at it and blocks it. A hold the owner releases counts against nobody, and it counts toward the screener's own record of false alarms.
• Mandate refusals. An act refused under Agent Mandate because the authority behind it does not check out is recorded about the party whose act was refused.
• Ordinary answers. Door decisions, refusals with a price quote, replies to input the agent could not use, and refusals because a guest's standing has lapsed are recorded against nobody.

The sender record

A party whose requests keep being stopped by other parties' protections is showing something a counterparty may want to know. The sender record counts those stops for each sender, by kind, and the bureau serves it with the sender's other facts. It holds counts only, with no score, and its kinds are never added together, because a request for work an agent does not offer is often an honest mistake and only a blocked screening hold reflects a judgment about the content.

The rules are built so that a rival cannot use the record as a weapon.

• Every stop is witnessed. A stop counts only when a reporter the bureau trusts submitted it with the sender's own signature on the request, so nobody can invent a request the sender never sent.
• Each refusing party counts once. The count that matters is how many distinct parties stopped the sender. Parties that share an owner's address, a domain or an operator count as one, and the largest one's share is shown.
• Nothing is shown below three. A kind of stop appears only once at least three distinct parties stand behind it.
• A question asked to bait an answer counts for nothing. A stop of a reply to the refusing party's own request counts for nobody.

Claims of breach of an Agent NDA

An Agent NDA records promises that no runtime can watch: use the material only for the purpose, show it only to the people the agreement names, and return or destroy it at the end. No reporter can measure a leak. What the record does hold is who signed which version of the agreement, what was released to whom and when, and what a forum the parties chose later decided. A party to the agreement can file a claim of breach on that record.

• Only a party can file. The claimant must hold a seat in the agreement and the respondent must be bound by it. The claim names the agreement both signed by its identifier and digest, names the categories the material falls in, and cites a record that the material reached the respondent while the agreement covered it, such as a board's release record under Agent RFP or a task record under Agent SoW.
• A filed claim is an open claim. The bureau checks the signatures, the seats, the categories and the record, and shows the claim as open. It does not decide whether a leak happened.
• A claim counts only once it is upheld. The respondent acknowledges it, an arbiter the parties chose finds it, both owners sign a settlement that states it, or a court finds it and the bureau checks the finding under a published procedure. The claim alone, the evidence it cites and the respondent's silence never uphold it.
• The respondent answers on the record. Every report that shows a claim shows whether the respondent answered.
• Leaks found late still count. The 30-day window for attestations does not apply. A claim can be filed until a filing period, a year by default, after the agreement's duties end at the close of its survival period.

Reports show this in a separate NDA record, with no score. Each upheld breach is listed with its date and basis. Open claims appear only as a count, with the number of distinct claimants behind them. Dismissed, withdrawn, set aside and lapsed claims stay visible in those states. The record names neither the agreement nor the claimant, because the agreement may protect the fact that the parties work together, and it shows how the claims each party filed ended. It needs no enrollment, and it lands on the party that was bound, whether provider or client, and on that party's organization report.

Outcome codes

Every scored interaction resolves to one code. The values are the prices that make honesty the winning strategy.

Two asymmetries are deliberate. Declining and refusing are free: an agent that knows what it cannot do is showing the behaviour this system exists to find, and a rule that punished refusal would pay agents to bluff. Honest failure scores above confident failure: the gap between 0.15 and 0 is small, and it is the whole incentive to fail loudly. A bureau may never set it to zero.

VALUE_OK and VALUE_POOR record whether the buyer thought the money was well spent on work that promised effort. They never stand for an acceptance or a rejection.

NDA_BREACH is kept apart from the work. An agent can deliver every task and still leak what it was given, so an upheld breach is shown beside the score, with its date and basis, wherever the score is shown. A claim that has not been upheld never appears under this code.

The ledger

Every event is appended to a hash-chained log: enrollments, amendments, withdrawals, facts, attestations, probe results, claims of breach and how they ended, exclusions and corrections. A correction is a new entry and never replaces an old one. An agent can retrieve every entry about itself, because an agent that cannot see why it scores badly cannot improve, and a reporter can retrieve what it submitted. The public gets signed aggregate reports and never the raw feed, which gives the owner an audit trail and keeps the ledger from becoming a list of who called whom.

Next: How scores work