Accountability layer
In this project, "accountable" is not the same as "trust." This is Vacant's core definition. It was changed five times during the research, and each time the claim got smaller — this table is the only version that is valid now.
#The current definition
Intake point: a delivery without a verifiable receipt is not accepted.
The enforcement point is at acceptance time, not at run time. When the downstream side receives a delivery, it recomputes the hashes on the receipt and verifies the signature, and a receipt can be consumed only once.
In this project's precise terms, it is "a record that can be re-verified afterwards, in which tampering can be detected."
#Why we don't say "trust"
The classic definition of trust includes "no need to monitor." And monitoring is exactly what Vacant does — it is that monitoring layer. Saying "it increases trust" would be read as "you can check a little less," which is the opposite direction.
An independent review in 2026-07 settled this. Its conclusion was one sentence:
What this architecture currently increases is accountability, not trust.
It also listed three conditions that must all hold before one could speak of trust, and two of them plainly do not hold:
| Must hold to count as trust | Current state |
|---|---|
| ① The signal cannot be cheaply forged | Does not hold — anyone can claim someone else's stream_id and inherit their reputation (PoC measured 0.50 → 0.7417) |
| ② Punishment actually bites | Does not hold — slash preserves the evidence ratio, so for low scorers it is even a reward: saboteur 0.0161 → 0.0312 → 0.0588 → 0.1053 |
| ③ The audit anchor is credible | Partly holds — deterministic replay is a real anchor, but the sampling seed is hard-coded and publicly predictable |
So we say "accountable" instead. In this research, accountability is a technical term: the traceability and verifiability of events signed by a specific key. It does not include trust in the psychological sense.
#The five versions of the definition
This is the most important record of self-correction in the whole project. Each version is not a wording change but a narrowing of the previous version's claim.
| When | Definition | Why it changed |
|---|---|---|
| 2026-04–05 | A "resident form": a responsibility structure that agents adopt voluntarily, with keys, records and public reputation; adjudicated by the network itself, with no central referee | The starting point. Theory documents V3–V5 went through two rounds of adversarial review; 38 attack vectors were each marked as prevents / detects / raises the cost |
| 2026-06 | "A persistent, evolvable, accountable subagent," then narrowed to a capability layer that agents can call on demand, with verify–revise at its core | The consensus meeting's critique by 63 agents caught fabricated citations and unimplemented mechanisms; "one instance per agent" cost too much compute |
| 2026-07 | Resident = body (a frozen model) + memory (an event stream); responsibility lives in reviewed memory | KS-1 refuted the single-agent responsibility hypothesis; the independent review ruled that accountability is not trust |
| 2026-08 | Make "who did what, and who checked it" a record that can be re-verified afterwards, and make those who do bad work get less work | Two corrections on 2026-08-17: the subject of blame, and defense is not gain |
| 2026-09 | Intake point: a delivery without a verifiable receipt is not accepted; the executable acceptance gate is the main force, and process exit is the delivery point | Committee-style designs could not beat majority vote at equal budget; the acceptance gate became the main source of gain |
#Three consequences, stated separately
Honest defense language is a hard rule of this project. Every mechanism must state whether it prevents, detects, or raises the cost.
| Threat | Defense | Strength |
|---|---|---|
| Tampering with records afterwards | Hash chain + signatures | Detects (prevents forgery when key custody holds) |
| Impersonation | Ed25519 + announced public keys | Prevents (when key custody holds) |
| Replay and reordering | Sequence numbers, previous-entry hash, deduplication | Detects |
| Moving a score onto a different delivery | Reviews bound to the chain head; substrate and task family declared by the delivering side | Prevents |
| Vote stuffing and Sybil attacks | Endogenous weights, unproven reviewers at 0.1/k, same-origin down-weighting | Raises the cost |
| Laundering by switching identity | Probation-period cap, mandatory audits, credit follows the event stream | Raises the cost |
| Reviewers lying collectively | Deterministic sampled audits | Detects (with probability equal to the sampling rate) |
| Doing bad work and still getting jobs | UCB routing, punishment, decay | Raises the cost |
#Six design principles
Every part of the current architecture is derived from these six.
- No central referee. Any role that can decide "who is qualified to check" becomes something the whole system has to trust. So peer review has no whitelist, audit sampling is decided by hash values, and the registry is only an aggregation layer for announcements.
- Honest defense language. See the table above.
- Execution instead of opinion, receipts instead of votes. What can be decided by deterministic execution is not handed to a model's judgment; what can be proven by a signed record is not replaced by a majority vote.
- Reputation follows memory, not the body. The accounting unit of reputation is the event stream, not the key or the model. If you switch the model or wipe the memory, the credit does not carry over.
- Not measured is not the same as measured zero. Every coverage field is three-state (true / false / not measured); refused delivery counts as a failure, and infrastructure failures do not count as model failures.
- A system that claims to be accountable must first be accountable to itself. Refuted claims are not deleted; they are kept in the claim index together with their verdicts.
#What this project does not claim
- That Vacant increases human trust in AI (we did not recruit users and did not measure trust).
- That pulse attacks, shared blind spots or any single component are new discoveries.
- That the revision loop beats resampling at the same budget.
- That the system can resist Sybil attacks, or guarantees correctness.
We once claimed item 3; on 2026-09-13 it was refuted by our own five replications. After five replications: the headline claim lost to its own stability rule
#Verification scarcity
The same theory document defines trust functionally as "the amount of verification the delegating party can reasonably skip at an acceptable residual risk." This gives the mechanism its boundary:
- Where verification is scarce, the accountability layer's total return may exceed its total cost.
- Where verification is free, it is pure overhead.
- Where requirements cannot be formalized, it has no usable referee.
Our gain experiments measure one facet of exactly this substitute: given acceptance tests, how much the delivery success rate goes up, and at what cost in tokens.
#Next
- The receipt's format and levels: Receipts
- How the enforcement point is implemented: The acceptance gate
- The full record of refutations: The evidence ledger
