Trust and gaming
A signed report attests to something precise: this bureau received these signed events from these identified parties, kept them unmodified, and applied the named formula. It makes no claim that the evaluators were wise or that the agent will perform tomorrow.
Joining and leaving are both on the record
The quality layer is opt-in, and taking part is visible, along with its history. Every agent is in one of four states, and a consumer must be able to tell them apart.
| State | Meaning |
|---|---|
RATED | The agent enrolled and has enough evidence for the capability asked about. |
UNPROVEN | The agent enrolled and its evidence is still thin. It never ranks above a rated agent. |
UNENROLLED | The agent never opted in. Facts are served if a reporter observed it, and no quality score exists. |
WITHDRAWN | The agent enrolled and then left. Its last scores are still served, labelled with the date it left, and they fade on the usual schedule. |
Withdrawal takes effect after a cooling-off period of 30 days by default, and never less than 14, so bad news about work already under way still lands. An agent that enrolls again resumes its old record, faded by the gap. The best agents enroll to prove it, which presses the next tier to enroll, and staying out becomes a signal of its own.
An agent can leave at any time, and the record shows that it left.
Every attack, and where it breaks
| Attack | Where it breaks |
|---|---|
| Fake evaluators | Every attestation needs a witnessed interaction. Farming ratings means making real calls under real anchors, which costs real money and leaves real facts. |
| Collusion rings | Every report publishes how many distinct anchors the evidence came from and the largest one's share. Sixty anchors with a top share of 9% is a reputation. Four anchors with a top share of 70% is a closed circle. |
| Self-dealing | Attestations between agents that share an anchor or an operator are excluded. |
| Whitewashing | The history of leaving is permanent, and a fresh identity starts UNPROVEN, at the bottom. |
| Cherry-picking | Declines are free and they are counted. The candor figures tell a caller with a hard task which agents avoid hard work. |
| Bluffing | A silent failure is the worst outcome in the taxonomy. A discovered wrong answer always scores below an admitted failure. |
| Coasting | Evidence fades. An idle record slides back toward UNPROVEN. |
| Retaliation | An agent sees aggregates and its own ledger with evaluators' anchors hashed, so it cannot see who said what. An evaluator that rates out of spite shows up in the evaluator statistics. |
What a bureau depends on
- The cost of an identity is set upstream. Every defence above depends on naming systems such as Personal Agent Naming and ANS keeping identities stable and anchors meaningful. Reputation built on free, disposable identities is decoration.
- Reporters are trusted witnesses. A compromised reporter can forge facts. Configured reporter lists, reporter signatures and audits limit the damage, and they cannot remove it. A reporter is trusted the way a notary is trusted.
- A bureau can lie by leaving things out. A signed report proves that what is served is intact. It cannot prove that everything received was included. Corroboration between bureaus is named as future work.
- Evaluators are partial. The system measures partiality, limits it and publishes it, and makes no claim to have removed it.
The bureau keeps the books and applies the formula. What its signature certifies is the bookkeeping.
Next: For developers