11 / 11

Limits

A verified key tells you who signed, not that what they signed is true; a twin and a referee test whether two answers agree under weights both nodes claim, which narrows a misstated model without establishing which model ran; hardware attestation is the direction for that.

1What it is

A signature that verifies shows that the holder of a key signed a record, and nothing about whether that key may speak for anyone or whether what it signed is true.

A node that misstates which model it ran signs that claim as easily as a true one; a twin and a referee can test whether two answers agree under weights both nodes claim, which narrows a misstated model but does not establish which model ran.

Hardware attestation, where the machine itself reports what it loaded and ran, is the route beyond self-report, and it is a direction here rather than a released feature.

2Design choices

Chosen: verification returns the authenticated key; whether it is authorized for the record's operator or developer is the caller's policy.

Rejected: building a key-to-organization binding into the wire format. (AAC -05 §3.2; the kid is a "self-attested signer identifier", §3.1)

Chosen: state plainly that controlling a key is not standing to act for anyone, and that identity is the floor of a record's weight.

Rejected: solving organizational identity inside these drafts; they inherit it. (Evidence layer -00 §11; bilateral -02 §12.1)

Chosen: a referee only for pairs a client marked, at temperature 0, same model and weights, answers that differ; exact words, no similarity threshold.

Rejected: guessing pairs from timing, or scoring answers by similarity. ("pairs are never guessed from timing": Mesh-LLM/capsules docs/TWIN-REFEREE-SELECTION.md at v0.1.4)

Chosen: the record keeps a hardware-attestation slot and writes it empty when no quote was taken.

Rejected: presenting a node's hash of its own binary as hardware evidence; at v0.1.4 the slot is "recorded absent, never fabricated". (Mesh-LLM/capsules producer/capsule.rs at v0.1.4; a producer MUST NOT record an assurance it did not achieve, AAC -05 §5.4)

3What it shows / what it does not

Shows

A verified signature proves the holder of key K signed this record's id.
Whether two twins gave the same words to the same request at temperature 0, under weights both their signed records claim are the same.
A referee's signed verdict records which twin its own re-answer agreed with at the earliest differing word, and names the other as contradicted.
The verdict seals the pair it rules on: both halves, the request digest, the weights digest and the referee's own answer.

Does not show

Who holds key K, or that K may speak for the operator the record names.
That what was signed is true, including the model name in the record.
Which model ran. The twins' matching weights are each node's own claim, and twins serving the same wrong model corroborate each other.
Which answer is right. A verdict is a ruling on one pair; it says nothing about a node's future answers.
That the referee is independent of either twin; that is a claim about who runs it.
Honesty across different hardware: exact replay can differ on different silicon for reasons unrelated to honesty, so such a mismatch is grounds to investigate, not a verdict.
What ran inside the machine. At v0.1.4 no hardware quote is taken.

4Example

A referee's signed verdict from the plugin's test fixtures: twins A and B differed, the referee re-answered, agreed with A at the earliest differing word, and named B as contradicted.

{
  …
  "referee_key_id": "6a9a93a3af20ca17d85764e3206fd1d0417ea943f53f07157792299ba9b6f033",
  "verdict_capsule": {
    …
    "capsule_id": "1bd4fa92a5ff02c278b3c79e4e0398ede6c62212483c5a9466176bfc45408f62",
    "action_id": "adjudicate/1bb92507-473a-49b7-96a0-a6752fb42308",
    …
    "provenance": "referee",
    "model_attestation": {
      "compute_attestation": {
        "epistemic_type": "adjudication",
        "adjudication": {
          "schema": "capsule-emit-mesh/adjudication/v1",
          "source": "twin_comparison",
          "capture_method": "deterministic_replay",
          "verdict": "contradicted:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
          "status": "CONTRADICTED",
          "divergence_index": 3,
          …
          "prefix_digest": "0ec7db901e57f96f8d195aa69bbdbd858eb13d125021a24c90972a5ce35d587b",
          "twin_owner_distinct": true,
          "weights_digest": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
          "half_a_capsule_id": "7dc9427b6df5ff222617fb721f25d3c54aebe32682329bb7075902336437fb06",
          "half_b_capsule_id": "b80db10999779aa17c8fcf7006a57aeaecbc81f5e9de3ecea33e9365c2bfd4d9",
          …
          "referee_node_id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
          "half_a_node_id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
          "half_b_node_id": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
          "twins_request_digest": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
          "referee_prompt": "requester_attested",
          "referee_answer_digest": "0242bc9526adbb014565b8175ff134e2ba8731f4a13cab2d1b4d8aff8727586e",
          "twin_bracket_id": "bracket-1"
        }
      }
    },
    "assurance": {
      "attestation_mode": "self_attested",
      "effect_mode": "not_applicable",
      "ledger_mode": "chained"
    },
    …
    "key_id": "6a9a93a3af20ca17d85764e3206fd1d0417ea943f53f07157792299ba9b6f033"
  }
}

Field	Type	Meaning
key_id	hex tstr	The referee's public key; it shows who signed the verdict, nothing more.
epistemic_type	tstr	`adjudication`: a ruling, not an observation.
verdict	tstr	`contradicted:` plus the node id of the twin the referee disagreed with.
status	tstr	`CONTRADICTED`; corroborated maps to SATISFIED, inconclusive to UNKNOWN.
divergence_index	uint	The index of the word where the two answers part.
prefix_digest	hex tstr	Digest of the words both answers share before that point.
weights_digest	hex tstr	The weights both twins' records say they served.
twin_owner_distinct	bool	The two twins are different nodes.
half_a_capsule_id / half_b_capsule_id	hex tstr	The two twins' own signed records.
referee_prompt	tstr	`requester_attested`: the prompt the referee used is the requester's word.
referee_answer_digest	hex tstr	Digest of the referee's own re-answer.
twin_bracket_id	tstr	The pair id a client set; without one, no referee is asked.
assurance.attestation_mode	tstr	`self_attested`: the verdict itself is the referee's own signed word.

The node ids and some digests are placeholder test values (repeated letters), as in the fixture.

Source: Mesh-LLM/capsules:crates/evidence-plugin/tests/fixtures/referee-verdict.json @ b4e24453f572b2d9fe8f2cefbd0f35a5eb54b0ad (tag v0.1.4)

5Specs

Internet-Draft draft-mih-scitt-agent-action-capsule-05 — issuer binding: what a verified signature does and does not cover.
Internet-Draft draft-mih-agent-evidence-layer-00 — controlling a key is not standing or role; the adjudication type.
Internet-Draft draft-mih-agent-bilateral-attestation-02 — identity is the floor of a two-party record's weight.
RFC RFC 9052 — COSE: structures and process.
Code Mesh-LLM/capsules — the twin comparison, the referee and the verdict record (v0.1.4).
Code action-state-group/capsule-emit-mesh — docs/TRUST-MODEL.md: replay agrees exactly only within one hardware class.