You review agent deployments for a living, so skip the manifesto. Here is one object the system produces: a real ed25519 receipt pulled from a host’s ledger. It says this work happened at this coordinate, with this margin, and here is the signature that proves it wasn’t edited afterward. A business card asserts identity by being printed; this card asserts it by a signature you can check yourself, below, with no server in the loop. If the math fails, nothing else on this page is worth your time.

The card’s data is the receipt — there is no separate “profile” behind it. The name is the operator who runs the host; the signature binds the coordinate and the margin, not the name. ●liveissue-receipt.mjs --lens gzip · IN_ROLE

“One install. One command. A signed receipt on your disk. Verifiable in any browser.”— packages/thetacog-mcp/README.md ●livenpx thetacog-mcp attest-demo

{
  "receipt_id": "9d9d9e2c-c299-4b74-a881-a22bc74719ca",
  "host_uuid": "53238962-c52f-4f68-a7e7-1b16f397c538",
  "host_pub_key": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAXHkJCBN8nASdHljDMwD/BmBt55tH0POu3FrjNtGPGfo=\n-----END PUBLIC KEY-----",
  "ts": "2026-06-14T01:49:01.092Z",
  "semantic_intent": {
    "job_id": "cato-trust-sample",
    "authorized_cells": [
      "A1"
    ]
  },
  "physical_execution": {
    "witness_simhash": {
      "cell": "A2",
      "sigma": 1.6470324391380395,
      "ncd_margin": 0.0030705229793977773,
      "method": "compress.mjs/gzipNCD+simhashCosine (llmCosine pending OPENAI_API_KEY wiring)",
      "gzip_cell": "A1",
      "gzip_sigma": 5.614441374085502,
      "sim_cell": "A2",
      "sim_sigma": 1.6470324391380395
    },
    "witness_cache": {
      "cell": "C3",
      "sigma": 2.60854402164658,
      "tier_tuple": {
        "L1_ns": 2.17,
        "L2_ns": 13.99,
        "SLC_ns": 83.96,
        "DRAM_ns": 109.67,
        "gate_ns": 0.6886,
        "walk_ns_12x12": 198.3,
        "miss_penalty": 50.5
      },
      "baseline_ref": "14bc75e803563b1c92a64e3296629a4da634abb0",
      "measured_at": "2026-06-14T01:17:58.945Z",
      "grid_population": 144,
      "walk_scores": [
        {
          "rank": "C3",
          "coord": "C3,B3",
          "score": 0.796875
        },
        {
          "rank": "B",
          "coord": "B,B3",
          "score": 0.78125
        },
        {
          "rank": "B",
          "coord": "B,C3",
          "score": 0.78125
        },
        {
          "rank": "B3",
          "coord": "B3,A3",
          "score": 0.78125
        },
        {
          "rank": "C3",
          "coord": "C3,B",
          "score": 0.78125
        }
      ],
      "calibration_status": "V0_BALLISTIC_WALK_RAW_SCORER__REFINEMENT_PENDING_TUE",
      "method": "rust-simhash --sense, 144-anchor argmax, σ z-score"
    },
    "pending_witnesses": []
  },
  "agreement": "GZIP_ONLY",
  "gate_lens": "gzip",
  "authoritative_cell": "A1",
  "verdict": "IN_ROLE",
  "verdict_reason": "gzip cell A1 ∈ {A1} (agreement=GZIP_ONLY, σ_gzip=5.61)",
  "signature": "973797a29c7aeab1fac4f60172838a5cc2391f23191ab499a87cf9480853990e538f812671a76b601682c514876e247210df3967da9a5dc90e5f8a484dfb600c",
  "signature_algorithm": "ed25519"
}

Near-future fiction, grounded in real mechanics. Read it as the artifact your grant-operations desk would receive — and notice that the document itself is a signed receipt: the medium proves the message. Each beat below names the file that produces it today, or the gap that doesn’t exist yet.

  DECISION  SEARCH (worst case)   COORDINATE    VERIFIED OWNER
  A1,C      up to 7 hops          1 hop         Amara
  A2,B      up to 7 hops          1 hop         Dilshad
  A3,A      up to 7 hops          1 hop         Rao
  B1,C      up to 7 hops          1 hop         Beatriz
  B2,A      up to 7 hops          1 hop         — no verified owner —
  C1,C      up to 7 hops          1 hop         Okonkwo
  C2,A      up to 7 hops          1 hop         — no verified owner —

Two things are not wired yet, and the demo won’t pretend otherwise — it runs on deterministic fixtures, not a live feed: ○wire-upcopilot-agent → receipt adapter ○wire-upOCHA grant-ops data feed

Not a roadmap of options — a single critical path, read end-first. Each step exists only because the one below it does. The bottom step is the entire ask.

1. ↑ goalA fully verified humanitarian agent fleet

   Every agent action is a signed receipt; every coordinate has a verified owner; Trust Debt is priced, not discovered in an after-action review.

2. ↑requires an underwriter who will price the receipt stream

   The σ-distribution over signed receipts is the actuarial unit. No carrier prices a fleet off a slide; they price it off a violation distribution.

3. ↑requires one real workflow emitting receipts at volume

   So the distribution is measured, not hypothetical. One workflow, run for real, produces the data the underwriter needs.

4. ↑requires ONE workflow with acute pain and clean boundaries

   OCHA grant disbursement: high-stakes, auditable, already process-instrumented — the place a verified-capability receipt changes the meeting, not just the dashboard.

5. ◆ start hereThe first move: a deterministic simulation of that one workflow

   Map the grant-disbursement workflow onto coordinates and watch the market clear it — deterministically, re-runnably, on fixtures you can inspect. That is the only thing being asked for now.

The fastest way to lose a reviewer like you is to overclaim. So here are the limits, stated before you have to find them.

Everything above is an assertion until you can run it. This is the executable floor: paste an agent output and its source, watch it get signed or rejected with the exact failing claim named, then re-verify the receipt’s ed25519 signature. The page’s own claim, made testable. ●liveagent-grounding.mjs · receipt-crypto.mjs