b8 / 11
The builder's checklist
Seams ① Record to ⑤ View. Build: every step, in order. Conform to: the spec named on each row, starting with draft-mih-scitt-agent-action-capsule-05.
The seven steps in the order they were built for Mesh-LLM, each with what you need, where it lives today, and how far along it is, checked against the repositories on 2026-10-19.
1What it is
An evidence layer is built bottom up: the host has to expose a few seams first (an exchange event before any record can be sealed, the rest before records can be checked and acted on), then come the record format, the local book, the use-case evidence, and only then the parts that make it portable.
Each step below names what a builder needs from their own host or code, and where the Mesh-LLM worked example keeps it today: a crate, a repository, or an Internet-Draft.
Status is what the code shows at a named commit or what a pull request's state shows today, not what a slide or plan says.
2Design choices
Chosen: ask the host for small generic seams (events, a plugin key, a capability flag, a page, a stop-routing request) and keep evidence in one plugin.
Rejected: patching or forking the host, and operators copying each peer's key by hand, which “does not scale past a few nodes”. (mesh-llm PR 2299; the plugin depends on
mesh-llm-plugin = "0.78", capsules crates/evidence-plugin/Cargo.toml)Chosen: every record, its ledger, checkpoints and checks come from published libraries, pinned by version.
Rejected: a plugin-private record format, or library code copied into the plugin. (capsules
crates/evidence-plugin/Cargo.toml: capsule-emit 0.0.6, checkpointed-local-log 0.2.1, capsule-emit-evidence-request =0.0.3)Chosen: the local book first, with nothing leaving the node by default; sharing is a later, explicit switch.
Rejected: sharing on by default. (capsules
CHANGELOG.md 0.1.3: record push, verdict delivery and the referee are off by default; checkpoint_cadence.rs: checkpointing is on by default, local only, no witness)Chosen: use-case evidence that rules on one pair (a referee's signed verdict), only for a pair a client marked.
Rejected: the host inventing pairs: a referee is asked only for a pair a client marked (capsules
docs/TWIN-REFEREE-SELECTION.md §1). Also rejected: sampling alone, which gives a rate, not a ruling on one exchange (the reasoning on b4).Chosen: portability through open Internet-Drafts, vectors and libraries any host can link.
Rejected: a check that needs an account or a running service; a bundle from a conforming book on the CLL substrate verifies, interval and all, with the neutral Evidence Bundle verifier alone.
3What it shows / what it does not
Shows
- The order of work that produced a running example, and what each step depends on.
- Where each piece lives today, by crate, repository and Internet-Draft, so a builder can link the same libraries.
- Each status with the commit, tag or pull request it was read from on 2026-10-19.
Does not show
- That any step is finished for every host: these rows are the Mesh-LLM example.
- That a released plugin is installed or switched on anywhere; “live” here means in a published release anyone can install.
- Status after 2026-10-19: open pull requests may have moved since.
- Whether any record's content is true: each step records and checks; none judges an answer.
4Example: the Mesh-LLM rows
The checklist filled in for the worked example. Read it across: what you need, where it lives for Mesh-LLM, its status, and the evidence for that status.
| Step | What you need | Where it lives today | Status | Evidence |
|---|---|---|---|---|
| 1 · Seams b1 |
An exchange event naming both sides; payment events; a plugin page, and a slot under each chat answer and in the Logs request inspector header; a stop-routing request; a plugin key bound to the node key; a twin-pair capability flag. | Host repo Mesh-LLM/mesh-llm; plugin SDK crate mesh-llm-plugin (0.78). |
live events, page, slot, stop routing built, not live plugin key, twin-pair flag |
The exchange event (openai.exchange.v1, on the paid path too since PR 2109) and payment lifecycle events (PR 2108), both merged, in v0.78.1 (bc215ce5b880e21c6c3840b8574ab64f83278821); PeerBlockRequest in crates/mesh-llm-plugin/proto/plugin.proto at that tag; page and slot: PluginWebUiPageManifest and PluginWebUiContributionManifest (slots chat_message, logs_request) in the same file at that tag, used by the plugin from capsules 0.1.3 (CHANGELOG.md). PR 2299 merged (f142883d0b7576ceff64615153d86155030cb9b7) and PR 2300 merged (572419fd1e3074f7e948996c292ca8e7972bda8c), both on upstream main 60697c61755b7280c22d3ab9d9bcf5b663e8ae3b, neither in any release tag. |
| 2 · Record format b2 |
A signed record per exchange: digests not payloads, request/response binding, the signer's key id, nonces. | Internet-Draft draft-mih-scitt-agent-action-capsule-05; crate capsule-emit (action-state-group/capsule-emit); vectors in action-state-group/agent-action-capsule vectors/capsule/. |
live | capsules v0.1.4 (released 2026-10-12) seals draft-mih-scitt-agent-action-capsule-05 (test in crates/evidence-plugin/src/producer/capsule.rs); depends on capsule-emit 0.0.6 (tag 44ad8bd528b029c1abff1937f700423f94e1d6db), whose SPEC_VERSION in rust/capsule-emit/src/capsule.rs is that draft. |
| 3 · Local log b3 |
An append-only log on the node's own disk with signed checkpoints, inclusion and consistency proofs. | Internet-Draft draft-mih-scitt-checkpointed-local-log-02; crate checkpointed-local-log (reference implementation; any conforming log). |
live plugin's own log planned plugin moved in-tree |
capsules v0.1.4 depends on checkpointed-local-log 0.2.1 (tag 04339d9ae622014b5c1651961a795d9977e4bba1); checkpointing on by default, local only (checkpoint_cadence.rs). The plugin's move into the mesh-llm workspace: PR 2459 (open). |
| 4 · Twins and a referee b4 |
A client-marked pair, a rule for who may referee, a signed verdict, and “not adjudicated” when no referee qualifies. | Mesh-LLM/capsules crates/evidence-plugin/src/referee/; rules in docs/TWIN-REFEREE-SELECTION.md; verdict sealed as a capsule (draft-mih-scitt-agent-action-capsule-05). |
built, not live | In the v0.1.4 release, adjudicate_differing_twins is off unless set (referee/request.rs); “a referee verdict on live hosts … is covered by tests only” (CHANGELOG.md 0.1.4). The host copies the client's x-mesh-twin-bracket into twin_bracket_id and strips it before forwarding since PR 2144 (merged 6d36f3845c5f021eac432dfdc8c20efcbfaa340a, in release v0.78.1); only the capability flag that advertises it is PR 2300, merged, unreleased. |
| 5 · Portability b5 |
Open specs and vectors, libraries any host can link, the plugin depending on them by version, an evidence request any party can send. | Internet-Drafts in action-state-group/agent-action-capsule spec/; crates capsule-emit, checkpointed-local-log, evidence-request, scitt-cose-receipt; the request draft draft-mih-agent-evidence-request-00. |
live libraries, version pins built, not live plugin in the host's repo |
Version pins: capsules crates/evidence-plugin/Cargo.toml (capsule-emit 0.0.6, checkpointed-local-log 0.2.1, capsule-emit-evidence-request =0.0.3; scitt-cose-receipt by git commit 8833281c11d33e3c1e289cf74f11d25ee7f3c6dc); the request crate evidence-request 0.2.0 is tagged at dd64efe7c394ab78fc228ce91144528cdd95a83a. Plugin move into mesh/crates/mesh-llm-capsules-plugin: mesh-llm PR 2459, open. |
| 6 · Personal agents b6 |
Host seams on a personal agent, the same record and book, and a shareable History read. | action-state-group/agent-action-capsule spec/personal-agent-history-profile-v0.md (pre-Internet-Draft, personal_history_basic/1); vectors vectors/personal-history-basic-v0/. |
designed no personal-agent host emits it here | Profile and vectors merged in agent-action-capsule PR 259 (995c377bf3fbc5a50630a07c998c0d0fce315a87); positive and mutant cases in vectors/personal-history-basic-v0/. |
| 7 · Agent work b7 |
Both sides' records of work done on someone's behalf, evidence requests between them, and settlement legs tied to the exchange. | Internet-Drafts draft-mih-agent-settlement-records-00, draft-mih-agent-bilateral-attestation-02, draft-mih-agent-evidence-request-00; vectors vectors/settlement/. |
designed general case built settlement legs for paid exchanges |
Settlement libraries and vectors: agent-action-capsule rust/agent-action-capsule/src/settlement.rs, vectors/settlement/. Plugin legs: capsules crates/evidence-plugin/src/settlement_legs.rs; paid exchanges across two nodes verified (CHANGELOG.md 0.1.4). |
| Column | Type | Meaning |
|---|---|---|
| Step | ordinal | Where it sits in the build order; each step needs the ones above it. |
| What you need | text | The generic requirement, for any host. |
| Where it lives | crate / repo / I-D | Where the Mesh-LLM example keeps it today. |
| Status | tag | live (in a published release), built not live, designed, or planned. |
| Evidence | path@SHA / PR | What the status was read from on 2026-10-19. |
Source: Mesh-LLM/capsules:crates/evidence-plugin/Cargo.toml, CHANGELOG.md, crates/evidence-plugin/src/referee/request.rs @ b4e24453f572b2d9fe8f2cefbd0f35a5eb54b0ad (tag v0.1.4); action-state-group/capsule-emit @ 44ad8bd528b029c1abff1937f700423f94e1d6db (tag 0.0.6); action-state-group/agent-action-capsule @ 2ef8aeb49e2334e24c404bd62d3fdb161770873c; Mesh-LLM/mesh-llm tag v0.78.1 @ bc215ce5b880e21c6c3840b8574ab64f83278821; PR states as GitHub shows them on 2026-10-19.
5Status
- live Record format, the plugin's own log and checkpoints, and the published libraries: capsules v0.1.4 (
b4e24453f572b2d9fe8f2cefbd0f35a5eb54b0ad), released 2026-10-12. - live Host exchange event (on the paid path too since PR 2109), payment lifecycle events (PR 2108), the plugin page and its chat and Logs slots, and the plugin stop-routing request: in mesh-llm v0.78.1 (
bc215ce5b880e21c6c3840b8574ab64f83278821). - built, not live Plugin key bound to the node key (PR 2299, merged) and the twin-pair capability (PR 2300, merged): on upstream mesh-llm main (
60697c61755b7280c22d3ab9d9bcf5b663e8ae3b), in no release tag. - built, not live Twins and the referee: in capsules v0.1.4, off by default, a live-host verdict covered by tests only (
CHANGELOG.md0.1.4). - built, not live The plugin inside the host's own repository: mesh-llm PR 2459, open.
- planned The plugin moved into the mesh-llm workspace: PR 2459 (open).
- designed Personal-agent History: profile text and vectors at
2ef8aeb49e2334e24c404bd62d3fdb161770873c; no host here emits it. - designed Agent work on someone's behalf with a counterparty, beyond the paid-exchange settlement legs the plugin seals.
6Specs
- Internet-Draft draft-mih-scitt-agent-action-capsule-05 — step 2, and the verdict record of step 4.
- Internet-Draft draft-mih-sokolov-scitt-payload-binding-05 — step 2: binding a record to payloads it carries only by digest.
- Internet-Draft draft-mih-scitt-checkpointed-local-log-02 — step 3.
- Internet-Draft draft-bryce-cose-receipts-mmr-profile-03 — step 3: the MMR proofs.
- Internet-Draft draft-mih-agent-evidence-layer-00 — step 3: the semantics any conforming book implements.
- Internet-Draft draft-mih-agent-evidence-request-00 — steps 5 and 7: asking another party for evidence.
- Internet-Draft draft-mih-zhang-agent-disclosure-bundle-00 — step 5: a bundle a stranger checks.
- Internet-Draft draft-mih-agent-bilateral-attestation-02 — step 7: both sides' records.
- Internet-Draft draft-mih-agent-settlement-records-00 — step 7: settlement legs.
- Profile personal-agent-history-profile-v0 — step 6; pre-Internet-Draft, in the repository.
- RFC RFC 9052 — COSE: the signature on each record.
- RFC RFC 8785 — JSON Canonicalization Scheme: the bytes each digest covers.
- RFC RFC 9943 — SCITT architecture: an optional witness for checkpoints.
- RFC RFC 9942 — COSE Receipts: what a witness returns.
- Code Mesh-LLM/capsules v0.1.4 · action-state-group/capsule-emit · action-state-group/checkpointed-local-log
7Back to the start
That is the whole path. To build your own, take the steps in this order and do not skip the seams: every later row depends on what the host exposes. The next three pages close the loop that every step sits in: judging, reporting and history feeding the next act. The contents page shows the loop, starting at the seams the host exposes.