An accountable-action layer for agent tool calls: design of signed intents, outcomes and withdrawals
No measurement of its own: a reviewed specification with English contracts and conformance vectors, whose three review rounds found 17, 3 and about 40 blockers. The chain test and the contract-only reader check parts of it.
MeasurementDoes it work?Working note
- Designed for
- To define the smallest set of signed statements and executor duties that lets independent services in any domain act on each other's outcomes, keep one effect per intent, share a limit and carry a withdrawal to every dependent.
What was tested
We wrote the layer down in three steps: a format sketch, specification 0 with falsification criteria stated before code, and specification 1, which adds a steward that keeps one shared budget across executors. English contracts with conformance vectors followed. AI-agent reviewers read specification 0 in three rounds.
What we observed
The rounds found 17, 3 and about 40 blockers. The specification claims, under stated conditions: no effect without a narrowing grant chain, one effect per intent, arguments only from signed facts or grants, attributable outcomes, and withdrawal reaching dependents as findings.
What this means for Heimdall
A design record that fixes what each node verifies. The chain test and the contract-only reader check parts of it.
Limits
No measurement of its own. The layer gives attribution, not enforcement. Single-node usefulness is a goal; no proof of the holder invariant exists. Round-3 fixes had no fourth review. In code, the log signs its head alone, the watcher does not flag two outcomes on one intent, keys do not rotate, and outside modules cannot import the packages. A dependent sees a withdrawal only with every upstream issuer’s key.
What remains open
Executor conformance vectors and an outside implementer.