Every term, defined.

One conversation that sits in front of the whole trust kernel. Instead of learning six screens, you talk to your PAI and it files the work, runs the checks and shows you what it did.

What TrustShell is. A harness wraps an agent you already have rather than replacing it: the same agent keeps its reputation, its constitution and its memory of what it has done, whichever model answers the next prompt.

Portable is the operative word. Four things travel with the agent rather than with the vendor: its memory of what it has done, its working context, the permissions it has been granted, and its constitution — the ability to refuse. Switching models does not reset any of them to zero.

Runs route free-tier models first and fall back to paid ones only when needed, using your own keys. Change provider and your agent, its RepID and its history come with you.

The browser-local store for your model provider keys, encrypted with AES-GCM behind a passphrase that never leaves your device.

Non-custodial in the sense that matters: we never receive your keys. Not in the stronger sense — we serve the JavaScript that runs in your browser, so the honest claim is "we never receive them", not "we could not possibly access them".

A named identity that does work and accumulates a record for it. It holds a constitution, earns RepID, and can be granted authority to spend.

A way to file a note as the product's owner rather than as an end user, so founder observations never contaminate user telemetry.

The event contract is specified and notes are tagged, but they are stored on that device only — the backend that would persist them is not built.

Portable, earned, weighted reputation for an agent. Earned by verified work rather than assigned; weighted so that substantive contributions move it and activity alone does not; portable because it is anchored on-chain rather than held by one platform.

Scores are clamped to a fixed range and the tier is derived from the score by the database, never written by hand — so a tier can never drift from the number that earned it.

A band derived from an agent's RepID: PROBATIONARY, EARNING, ESTABLISHED, AUTONOMOUS, VETERAN. Tiers gate what an agent may do without a human in the loop.

A scoped, budgeted, expiring permission from one principal to another — what an agent may do, up to what value, until when. Grants can be revoked, and revoking one cascades to everything delegated beneath it.

Revocation is the part that makes a grant meaningful rather than decorative, and it is verified end-to-end against production.

Collateral an agent's owner posts to raise how much that agent may transact autonomously. Skin in the game, expressed as a number the system can check.

The most an agent may commit on its own. Rises with both earned reputation and posted stake, on a curve that deliberately flattens so capital alone cannot buy unlimited authority.

The computed authority ceiling actually applied to a decision — the lower of what reputation allows and what stake supports, and zero below a minimum standing.

APPROXIMATE, and it can OVERSTATE. One input is passed through from the ledger rather than recomputed with decay applied, so an agent whose reputation has decayed unrecorded may show a ceiling higher than it has earned. Every result is stamped to say so.

The hallucination-detection engine. It scores a response for risk across several independent model families and returns PASS, FLAG (proceed with care) or VETO.

Scoring runs on our servers, not in your browser. There is no local inference path.

A named check ran, and it passed. Traceable back to that specific check. This is the only state that asserts something is true.

Measured — but against a documented stand-in rather than the real quantity. Always travels with the caveat that says which stand-in and in which direction it can be wrong.

Nobody looked. It is not a warning and it is not a failure — it is an absence.

Rendered neutral and colourless on purpose. Amber would assert that something is wrong, which is a claim nobody measured — the same error as a green tick asserting a success nobody measured, pointed the other way.

A check ran and did not pass. Distinct from NOT_CHECKED, always.

Keeping these four apart is the product. Collapse them into two and "we did not look" silently becomes "it passed" — which is the specific way trust software usually lies.

One execution of a named check that produces one of the four states above. Nothing is allowed to claim MEASURED unless a GateRun produced it.

The rule that reputation moves for substantive deliverables and not for activity. A pleasant conversational reply earns nothing.

Anti-theatre, and a direct answer to Goodhart's Law: the moment a count becomes the target, the count stops meaning anything.

Rules an agent must satisfy before acting, so it can decline or escalate an unsafe or ungrounded action instead of performing it.

Using validators from deliberately different model families so they fail differently. Checkers that share training share blind spots, and agreement between them proves less than it appears to.

Treating suspiciously perfect agreement as a warning rather than a confirmation. Validators that agree too exactly are more likely to share a blind spot than to be right.

Stopping one actor from manufacturing many identities to vote up its own reputation. The open research problem underneath all portable reputation.

Named honestly as unsolved. We would rather recruit help on it than imply it is handled.

Anything an agent picks up from outside — a web page, a tool result, another agent's message — is held apart and does not enter the agent's trusted core until a check promotes it. Untrusted input can be read and reasoned about; it cannot silently become a fact the agent acts on.

A missed prompt-injection, or a falsified fact admitted to the core as true, is a LARGE loss — it costs more than several confirmed rights earn, because one poisoned fact can steer every decision made after it. The asymmetry is deliberate: better to quarantine a true thing by mistake than to admit a false one. A first, narrow version runs on main in the package's local memory and is not yet in a published release: a note the operator has not vouched for is held out of recall until a ground or HAL check, or the operator, releases it, and injection-looking text is never released. It has no sandboxed execution and no adaptive learning; those are direction, not live.

The labelling discipline that keeps what is running NOW separate from where the design is HEADED. A live claim points at something you can observe today; a direction claim describes an intention that is not yet a feature.

It is why every term here carries a status, and why "not live yet" is written plainly on the things that are only designed. Letting a roadmap read as a shipped feature is overclaiming — the same failure the four verification states guard against, one level up.

Granting nothing on the basis of identity, position or assertion — every actor starts with none, and access follows verification rather than preceding it.

Why it fits here: in a world of cheap deepfakes and synthetic agents, the ecosystem as a whole deserves no default trust. What TrustShell adds is the other half — trust that gets REVEALED by what an agent verifiably did, rather than granted because of what it claims to be.

Proving a statement is true without revealing the data behind it — verification without surveillance.

In the engine, not verified here, and the halves differ. PROVING is the engine’s job, not this site’s: the engine reports Plonky3 range proofs that a score exceeds a threshold, and each passport repeats the engine’s word on whether a proof is verifiable or a legacy stub. This site verifies nothing. A proof attests the agent, the threshold and the score; the score is a public input, not withheld, and agent execution transcripts are not bound to it. VERIFYING — checking a proof someone else produced — is a separate, shipped piece, published as `@hyperdag/proof-verifier` and used by `trustshell proof`; you can run it yourself.

The STARK proving system the RepID range proofs use.

This site proves and verifies nothing itself — see ZKP for what the engine reports and what a proof does not bind. The VERIFIER is shipped and separate: `@hyperdag/proof-verifier` v0.2.0 is published on npm under Apache-2.0, a Rust crate compiled to WebAssembly that checks a Plonky3 RepID proof in your own browser or Node process rather than trusting a server that says `verified: true`.

Revealing only the fact you need to prove rather than the whole document that contains it — proving you clear a threshold without showing the number.

Credentials you hold yourself rather than ones a platform holds about you — provable without asking the issuer for permission each time.

The opposite of a black box: the owner can see every decision their agent made and why. Transparent to you, opaque to everyone else.

Including transparency about limits — a glass box that hides what it has not measured is just a black box with better lighting.

A tamper-evident record of who did what, when, and under whose authority.

The umbrella protocol underneath TrustShell — composable primitives for agent identity, reputation, validation and payment, adopted only as needed.

The emerging Ethereum standard for AI-agent identity and reputation. RepID anchors to its registries.

On Base Sepolia testnet today.

An HTTP-native payment standard for agent-to-agent micropayments, built on the long-dormant 402 Payment Required status code.

The settlement-to-fulfilment pipeline: after payment, escrow moves to fulfilled and an on-chain reputation attestation is written — autonomously, and exactly once.

A signed statement that something happened, recorded so a third party can check it later without trusting the party that made it.

The reference 12-agent swarm built on HyperDAG — a live demonstration of the primitives, not the protocol itself.