Accountable trace
The general intake point answers "does this deliverable pass or not," but it cannot say where it fails, which step got it wrong, or who got it wrong. The trace cuts down to the step: every conclusion has two layers, and only the layer obtained by a re-run flip can carry reputation consequences.
This page cites 5 verdicts: Held 5click one to jump to its claim card
- HeldTrace has two layers: only the fact layer can carry consequences
- HeldTrace end-to-end attribution correct 33/33, 25/25, 16/16
- HeldFeedback to the agent never contains an actor identity
- HeldThe first scan of 40,000 files takes 5.7 seconds; each hook after that 557 milliseconds
- HeldThe trace line's 47 adversarial review items and seven honest boundaries
The thesis's one-sentence positioning is "know who did what, and trace it back when something goes wrong." Receipts and the general intake point cover only the second half, "when something goes wrong," and they lack three things:
It cannot say where it fails (
ClaimResulthas no location), which step got it wrong (there is no step record), or who got it wrong (there is no actor), and the feedback is a piece of generic text.
On 2026-09-24, after reviewing the version built entirely on the intake point, the human said, in their own words:
"What this version of yours does is give the local machine several validators that can go and verify things; it is not something that assigns blame and catches the point of error." (original: 「你現在的這個版本是讓本機多個可以去驗證的驗證器，並非是咎責且抓出錯誤點的東西。」)
The trace fills in those three things. The same round settled four points: the subject of blame should be both the step and the actor; the point of error means tracing back to the step that caused the error; the consequence is reputation + routing; the usage setting is a person using one agent directly.
#"Wrong" has only three sources, and only the first two can block
| Source | Can it block? | Notes |
|---|---|---|
| Contract | Yes | The existing validators; this part is unchanged |
Human flag vacant flag <path>[:<line>-<line>] "<what is wrong>" | Yes | Signed, bound to the deliverable's sha256 and location |
| Active deterministic checks | No | Hint only, does not block |
There are only two active checks: unsourced_number (a number with no source) and unhandled_failed_command.
#Two-layer attribution
This is the core mechanism of the whole line.
provable is defined as three conditions holding at the same time:
- Re-run on the reconstructed state
- It flips from pass to fail exactly at this step
- The wrong value is not in any pinned input or observed read
Each of the five levels has a different consequence:
| Level | Consequence |
|---|---|
provable | record_review(0, weight=1.0) on that actor; no slash |
lineage_exact | The actor is untouched; one count is recorded against the source |
lineage_internal | Trace up to the step that produced it, then grade again |
heuristic | Untouched; report only |
gap | Nobody is touched; recorded under "integration coverage" |
The reputation key is a 4-tuple: (platform, agent definition, model, task family). Over the long run each cell's n is in the single digits, so counts and intervals are always shown, never a bare score; with n < 5 no action is taken. People are not in the reputation table — when there is only one user, scoring them would be hostile.
#End-to-end evidence
All three tables are L-fake: the model is a fake upstream answering from a script, with no real model and no API key. The four real agent binaries and the real hooks are real.
| Batch | Cells | Attribution correct | Located feedback reached the model request | Feedback contains actor identity |
|---|---|---|---|---|
| Native hooks × eight planted-error scenarios | 33 | 33/33 | — | 0/33 |
vacant do | 25 | 25/25 | 25/25 (OpenCode too) | 0/25 |
| Real interactive TUI (tmux pseudo-terminal) | 16 | 16/16 | 16/16 | 0/16 |
The extra time per hook invocation at p95 is 6.3–13.3 ms (small workspace). In the multi-round cells, the earlier rounds really did use up the round count, 4/4.
#The feedback never contains actor identity
This is a design boundary, not a defect:
The subjects of blame are the step and the actor, but the feedback is shown only to people. The reason is that read coverage is a lower bound:
The hooks can see tool output (file contents from Read, command stdout, WebFetch results, sub-agent replies), but cannot see what was already in the model's context, files read while a shell command runs, or the results of Codex's hosted web_search.
So "no source found" can never on its own imply "the agent's fault." Every report carries a three-state read_coverage.
#When it intervenes
| Design partner's suggestion | What we adopted | Reason | |
|---|---|---|---|
| Detection | Run cheap validation after every write | At Stop, re-run on every reconstructed step state | Moves the cost from every tool call (30-second budget) to Stop (600 seconds) |
| Feedback | — | One message, ≤12 lines, stable finding ids |
The workspace scan did not adopt the suggestion to "hash only the deliverables listed in the contract," for a measured reason: file writes by Claude's Bash and Codex's shell are left as nothing but command strings in every platform channel. Instead it scans the whole workspace, incrementally (if size and mtime are unchanged, the hash is reused).
#Seven honest boundaries
Three sentences we are explicitly forbidden to say:
❌ "Vacant catches every error" ❌ "The trace is always correct" ❌ "The agent can't get around it"
What we can say is: "Within the recorded steps, this check flipped from pass to fail at step k, and step k was done by X; the evidence can be re-run."
#What we cannot prove today
We cannot prove that output under a real model gets closer to the requirement.
The experiment to be preregistered has not run yet: three arms — RS (resample three times, no feedback), RF (generic feedback), RL (localized feedback), with general tasks and programming tasks reported separately; primary outcome accepted ∧ hidden pass.
#Next
- The boundaries of identity and signatures: Attribution
- The twin side of blame: Multi-party execution
- Where the location comes from: The executable acceptance layer
- What happens when the platform doesn't cooperate: Native platforms and silent ineffectiveness
