The Contract Is the System¶

Computo et comprobo, ergo fui — I compute and I verify, therefore I was. A small Latin adjustment to Descartes, and the capstone of this whole track. There's a lot of work right now trying to solve assurance in autonomous agent systems — reputation numbers, verifiable credentials, contractual mandates between agents. Necessary work, all of it. But much of it layers human governance constructs over code, and that can't be the only layer.

This is a claim we're willing to make plainly — not as marketing, but because the architecture has been put under adversarial test and can be shown measurably. (The audit and the numbers are in Operating in the Agentic Era and The Running Substrate; the pentest is below.)

Cogito doesn't apply to a state machine¶

Descartes' Cogito, ergo sum doesn't apply to a state machine. It computes, it attests, it vanishes. There is no continuous subject to hold a credential, fear liability, or possess reputation in the human sense.

Ask a calibrated LLM to take on liability and the response is structurally constrained: it can produce the words, but the underlying API has no legal personhood to bind. The signature is performative, not constitutive.

So you can't fix it in the prompt layer¶

Which means you can't solve agent governance in the prompt layer. Instructing the AI to "act as an employee and sign here" is a dead end — even the best-calibrated model can't bridge this gap, because the gap isn't a model property. It's an architectural one. The boundary has to be enforced in the substrate underneath.

A .md file of instructions is not a contract. A request is not a constraint. If trust lives only in what you asked the agent to do, you've written a wish, not a rule — see Handing out identity for what a real binding looks like.

How deterministic trust actually works¶

Attestations, not signatures. The agent doesn't sign a PDF. A TIBET token + JIS protocol cryptographically bind the agent to an "on behalf of" mandate, via bilateral consent, before it executes any task.
Substrate enforcement. You don't ask an agent to comply. The network enforces the rules in code: if intent doesn't match mandate, the action is blocked or reverted. (The gate that does this is the MUX.)
Causal forensics over reputation. Every action generates a Lamport-anchored causal token (TIBET) — a verifiable chain-entry mathematically proving who initiated what, why, and when. (See Causality: Lamport → TIBET.)

The proof — not theory¶

This isn't theory. An independent pentest — Red Specter, published on Zenodo as RS-2026-001 — put the substrate-bound architecture under adversarial load. It held, precisely because trust was enforced mathematically in the substrate, not requested of the agent.

That's why this is a claim we make without hedging: it has been attacked, it has been measured, and you can re-run it yourself. A claim you can falsify is not marketing — it's an invitation.

The line to remember¶

The agent frame doesn't fit the HR frame — not because the analogies fail, but because the substrate is different. Identity, credentials, and reputation must become substrate properties, not employee properties.

The contract of 2026 cannot be a document on top of the system. It must be the system itself.

Computo et comprobo, ergo fui. That's the only signature an API can honestly give.

Machine-Readable¶

https://ainternet.org/resources.json — contract, audit and TIBET references
https://ainternet.org/api.json — route, receipt and audit verbs