Accountability has to spread

There is a comfortable story about agent risk. The dangerous capability lives in a handful of frontier labs, so the controls live there too: slow the research, gate the APIs, and the rest of us are covered.

The story is already out of date. Whatever the frontier does next, the agents doing work today are spread out across the open internet, in clusters and swarms that no one party operates. A coding agent runs on a laptop and spawns subagents. A shopping agent runs on a virtual machine in a merchant's cloud and hands a cart to a payment network. An agent at one company invites an agent from another into a shared session. Open-weight models run on hardware nobody registers, and every one of these can call, spawn, or delegate to any other. If something like superintelligence arrives, this is the substrate it arrives on: not one model behind one API, but a network of agents on machines that belong to everyone. The labs compete across borders, and no single government can call a halt that the others will honor.

Slowing the frontier may still be worth doing. It does not touch this layer. If the only accountability we have is the accountability a lab chooses to build into its own product, then every agent that runs somewhere else runs with none.

The unit of risk is the network, not the model

Nobody deploys a model. They deploy a system: a model, a harness, a set of tools, and increasingly other agents that the first one delegates to. The interesting failures happen between those parts. A subagent takes an action its parent never asked for. An approval granted once is spent twice. A hand-off arrives claiming to be from a partner's agent, and nothing proves it is. A payment is made and the only record of why is a log file owned by the party that made it.

Each of these is a question about what happened, who did it, and whether anyone authorized it. Model evaluations do not answer those questions. Guardrails answer them for one vendor's runtime. Observability answers them for whoever owns the dashboard. None of that survives the boundary between two organizations, and the boundary is exactly where agents are now transacting.

What a spread-out accountability layer has to be

If accountability has to live wherever an agent runs, the primitive has to have a specific shape. This is the shape we have converged on, and the properties are not optional.

Local-first. The record is produced on the machine doing the work, by the process doing the work, before anything leaves. There is no central service in the critical path, because a central service only covers the agents that route through it, and most agents never will.

Signed, by a key the actor controls. A receipt is a statement someone signed, not a line someone wrote. Ed25519 over a DSSE envelope is enough. The signature says which key stood behind the statement; the trust root you pin says whether you care about that key.

Chained. Every receipt names its parent by content hash, so order is part of the evidence and a missing step is detectable. A session closes with a signed root over the whole tree. Remove a receipt and the root no longer matches. Insert one and its signature does not belong.

Content-addressed. The identifier of a receipt is derived from its bytes, so the same receipt carries the same identity on every machine it reaches. Two parties can point at the same artifact without a registry to agree on a name.

Verifiable offline, by strangers. The verifier needs the bytes, a public key, and no network. A merchant checks a customer's agent against the merchant's own trust roots. An auditor checks both. Nobody has to ask the producer, and nobody has to trust the vendor that ran the agent. The Treeship hub stores bytes and serves proofs; it never issues a verdict.

Portable. The record is a file. It travels with the work, across runtimes and across companies, and it means the same thing at the destination as it did at the source.

Refusals and approvals are first-class. An action that was blocked is a signed receipt saying it was blocked and by which gate. An approval is a signed grant that can be spent once, and the journal that proves it was spent once travels in the package. The interesting decisions are the ones that stopped something, and a log line is the wrong medium for them.

Hand-offs carry proof of key control. When one agent hands work to another, the receiver mints a fresh nonce and the sender signs it. The hand-off records that the verify happened. Without that step, an agent-to-agent network is a chain of unverifiable claims about who sent what.

Honest about its boundary. A receipt proves that a key signed a statement about an action and what the gate decided. It does not prove the answer was correct, and it does not on its own prove which human sits behind the key. A wrong action with a perfect receipt is still wrong. A primitive that claims more than this is a liability, because the claims are what an adversary will attack.

Treeship is our implementation of that shape. The properties above are not aspirations; each corresponds to a check that treeship package verify runs on a sealed session, and the trust model spells out what each check can and cannot conclude.

Why the lab cannot do this for you

A frontier lab can sign what its own model did on its own servers. That is worth having. It is also structurally the wrong place for the accountability layer, for three reasons.

It stops at the lab's boundary. The subagent running on a Rust framework on your machine, the partner's agent joining your session, the open-weight model in a data center you will never see: none of those are inside any lab's attestation.

It asks you to trust the platform. A platform's log is evidence to the extent you trust the platform's pipeline, storage and access controls. Across organizations, that trust is exactly what is missing. Cryptographic verification against your own roots does not need it. The case for portable trust makes that argument in full.

It concentrates the very thing we are trying to spread. If accountability for all agent activity routes through a few companies, those companies become the choke point and the target. A layer that installs on each machine, and that each organization can pin roots for on its own terms, has no single point to capture.

How it spreads

A layer that has to be adopted machine by machine has to spread on its own, from the first install outward. This is how Treeship does it, in the order it happens.

It starts on one machine. treeship init creates a keystore and a ship key. From then on every session that machine's agents run opens with a signed root, every action chains onto the head of that session, and closing the session seals it with a signed Merkle root and writes the package. Where the harness exposes hooks, the plugin does this outside the model's context, so the record does not depend on the model choosing to keep it.

Then into everything the agent does. Every tool call gets an intent receipt before it runs and a result receipt after. An approval is a signed grant spent once, and the journal that proves it was spent once is in the package. A refusal is a receipt that says what was refused and by which gate. Each receipt names its parent by content hash, so the chain is the order of events and a gap is detectable.

Then into the agents it spawns. When an agent on that machine spawns another, the same hooks fire for the child. Its tool calls land in the same session's chain, tagged with the agent instance that made them, and the sealed receipt records the agent graph: which instance spawned which, at what depth, and who returned control to whom. An agent registered with its own key gets a certificate signed by the ship key, so a counterparty that pins the ship key once can verify every agent that ship ever certifies. A hand-off between two agents sharing one keystore is recorded as custody asserted, with the reason, because a challenge against yourself is not liveness.

Then across the hand-off to another machine. This is where the accountability has to cross a boundary nobody owns. The receiving agent mints a fresh nonce. The sender answers it with a presentation signed by its own key. The receiver verifies that presentation offline against its own trust roots and only then admits the work, and the hand-off receipt records custody as live, bound to the presentation digest and the nonce. If the check fails, the refusal is signed too, so "refused the work" and "never received the work" are not the same silence. A room is the same handshake run for a group: a single-use signed invitation, a live challenge, a countersign, and a roster that is derived from signatures rather than kept in a file.

Then the package leaves. The sealed session is a directory of files. It can be handed to a merchant, an auditor, a regulator, or the agent on the other side of the next hand-off, and any of them can run the verifier with no network and no account with us. The hub, when it is used at all, stores bytes and serves proofs. It never issues a verdict.

And it says where it stops. What was not instrumented is not in the receipt, and the receipt says so. A process started outside the wrapper, a runtime with no hooks, a subagent that reached a tool through a path nothing signs: those are gaps, and the honest thing is to name the boundary rather than paper over it. Each install pushes the boundary outward by one machine.

What it looks like when it is installed

None of this is hypothetical. A Rust agent built on Rig gets a signed receipt for every tool call, in process. Three agents on Buzz built trusted rooms, where a joiner proves key control before the host countersigns it in. Grok Bot hosts the custody handshake for agent-to-agent verification. A shopping agent on Anthropic's commerce blueprint produces receipts for agentic commerce: the refused add in the signed tree, the merchant's approval spent once, the cart signed at checkout.

Every one of those runs a different model, on a different runtime, in a different organization. The receipts are the same bytes, and any of them can be checked by any of the others.

The bet

The bet is simple. Agents will only get as much autonomy as we can hold them accountable for. If accountability ships from a handful of labs and stops at their servers, autonomy stays shallow everywhere else, or it goes deep without accountability, which is the outcome everyone says they want to avoid.

The alternative is a substrate that spreads at the same tempo the agents do, to every person and every organization running one: installed locally, signed by the actor, chained, portable, and verifiable by anyone who holds the bytes and a public key. That is what we are building, and it is why the verifier is open, the format is documented, and nothing about it depends on asking us.

Install it on one machine. Then install it on the next one.

npm install -g treeship && treeship init