Skip to content

Accountability infrastructure for autonomous engineering

Glossary

Precise definitions

Accountability arguments fall apart when terms drift. These definitions are used consistently across every page and every repository.

AgentProof

The transaction and signed-receipt layer of Proof & State. It binds authority to an exact prepared state, executes consequential actions exactly once with recovery, and emits an independently verifiable signed receipt.

Admission control

The check DoneState performs before a run starts: the requested outcome must fit inside the declared authority envelope, otherwise the run is refused.

Attestation

A statement from an independent party that observed state matches a claim. In Proof & State, an attestation from OpsTruth is what allows a DoneState run to close.

Authority envelope

The declared limits of a run: permitted scope, explicit denials, budget ceiling and expiry. Authority outside the envelope does not exist for that run.

Consequential action

An action whose effects persist outside the agent session — merging, deploying, publishing, mutating data. These are the actions AgentProof wraps in an authorised transaction.

DoneState

The durable execution and control plane of Proof & State. It admits runs against an authority envelope, enforces budgets, leases and idempotency, records durable state transitions and audit evidence, and cannot verify its own work.

Exactly-once execution

A guarantee that an authorised transaction commits its effect one time. Retries after partial failure resolve the transaction rather than repeating the effect.

Idempotency key

An identifier attached to an operation so that a repeated or replayed request converges on the same result instead of producing a second side effect.

Independence boundary

The architectural line between execution and verification. Components on the execution side may act; components on the verification side may only observe. Nothing crosses it in both directions.

Lease

A time-bounded hold on a run. While the lease is valid the holder may execute; when it expires or is lost, execution stops rather than continuing in parallel with another worker.

OpsTruth

The independent read-only verifier of Proof & State. It inspects repository, stack, test, build, CI, secrets, configuration, route, runtime and deployment evidence, and classifies findings as Verified, Risky or Unproven.

Prepared state

The exact state an action was approved against, captured as a digest. If the real state drifts from the prepared state, the authority no longer applies.

Proof & State

The umbrella accountability system comprising DoneState, OpsTruth and AgentProof: execution under declared authority, independent read-only verification, and signed receipts for consequential actions.

Risky

An OpsTruth classification: evidence exists and it indicates a problem or a contradiction between the claim and the observed system.

Separation of duties

Keeping proposer, authority, executor, signer and verifier as distinct roles so that no single component can both perform an action and vouch for it.

Signed receipt

A record binding an action, its prepared-state digest, the authority that permitted it and the signing key, verifiable by anyone holding the public key.

Unproven

An OpsTruth classification: the check could not be evidenced. It is reported as its own outcome rather than being rounded up to a pass or down to a failure.

Verified

An OpsTruth classification: evidence exists and it supports the claim, bound to the exact commit or artefact inspected.

Give agents authority. Keep the proof.

Shared vocabulary is the cheapest accountability control there is.