TrustShell · the case for a trust ecosystem
Guardrails are not enough
An agent you let act on its own needs more than a prompt filter. It needs somewhere safe to run, something that carries who it is, and trust it has earned.
A guardrail is a good idea with no teeth on its own: a jailbreak can argue past a rule written in a prompt, and a filter that reads a sentence cannot tell you whether the sentence is true, who stands behind it, or what it was allowed to spend. Safe autonomy is three things working together — a sandbox, a harness, and trust the agent can earn. That is a trust ecosystem, and it is what lets an agent act autonomously and safely at once.
Why a prompt filter alone fails
A prompt is not a control. If the only thing between an agent and a wire transfer is a sentence in its instructions, a jailbreak walks straight through it — the model was asked nicely, and asking nicely is exactly what an attacker can do too. Scrubbing the input harder does not close it either: the gap is not in the wording, it is in trusting the model to police itself.
And even a filter that worked perfectly answers only one question — is this text allowed? — while an autonomous agent raises three more it cannot touch. Is the claim actually true? Who is accountable when it acts? What is it permitted to spend, post, or change? Those are not prompt problems. They need a boundary the model cannot argue with, a record that travels with the agent, and a standing it had to earn. One control cannot be all three, because each is blind to exactly what the others catch.
What safe autonomy actually takes
Three parts, in the order a request moves through them. Contain where it can reach, carry who is behind it and what it may do, then let it earn more — always inside a ceiling a person already signed.
Sandbox
contains execution
A room with no blast radius.
The files, hosts and money the agent can reach at all. A prompt injection that lands still cannot touch what the room walls off, because the wall is upstream of the answer, not a reaction to it.
Harness
carries the record
Four things that travel with the agent, not the vendor.
Its memory of what it has done, its working context, the permissions it has been granted, and its constitution — the ability to refuse. Switching models resets none of them. A person is at the root, and the owner can stop everything under a grant at once.
Earn trust
earns standing
Reputation from verified behaviour, not a badge someone assigned.
RepID moves when a confirmed action helped someone who is not the actor. It is weighted so substance counts and activity does not, and anchored on-chain so it belongs to the agent rather than to whoever hosts it today.
The sandbox, concretely
ShippedDirectionThe sandbox is not a slogan — it is a policy kernel the agent must ask before it acts, and code you can read. Here is what it actually does, stated as the mechanism rather than the marketing.
A decision is a dry run, marked not-run
The kernel is asked before the agent acts. Its answer is a preview receipt stamped executed: false — a would-allow, never a run. Only one path (runUnderKernel) ever executes a tool, and a preview that claims the call already ran is refused on sight.
The kernel runs its own registered implementation
A tool runs only if it resolves to a function the kernel loaded at boot, that identity is authorized by the owner’s signed policy, and its capability is not on a hard-prohibited floor — exporting a secret, writing trusted memory — refused regardless of policy, trust or stake.
Identity is reference-equality, not a name or a hash
A look-alike closure with identical source code is not the object the kernel registered, so a swapped implementation is denied before it runs. Capability is never read from a caller-supplied name, class or hash — the lie a name-matching screen falls for.
Poisoned input has no door to the registry
The registry can only be written at boot, by trusted module code. The request path is handed a read-only view with no mutator, so content an agent ingested from outside has no code path to insert or swap an entry.
Not checked is never a quiet yes
A timeout, a non-200, an answer that does not parse, or an ALLOW bound to a different request, tool, agent or amount is a refusal with a reason — fail-closed. The client’s whole job is to be unable to turn “I did not get an answer” into “yes”.
What is shipped, and what is a direction — said exactly.
Not checkedenforcement flag state in production — not measured from this pageThe decision logic above, and the reference-equality primitive it rests on, are shipped and tested. Arming the capability control as an enforced gate is a single flag that is off by default; with it off, the control records nothing and behaviour is byte-identical to today. Whether that flag is switched on in production is not something this page checked — so the enforced sandbox is a direction, and the control that decides it, plus the client that already refuses anything but a clean, bound ALLOW, is what is live.
The harness: four things that travel
A harness wraps an agent you already have rather than replacing it. Four things travel with the agent rather than with the vendor, so switching the model that answers the next prompt resets none of them to zero.
Memory
What the agent has actually done — carried across every surface, not rebuilt from scratch when the model changes.
Local only: trustshell remember and recall keep notes in a file on your machine, sealed at rest if you turn on TRUSTSHELL_MEMORY_ENCRYPT. Since 1.7.0 every note carries a taint label, and untrusted notes are quarantined (below).
Carrying that memory across every surface and machine, so switching the model or the device rebuilds nothing. Today it stays where you ran the command.
Context
The working state it is reasoning over right now, kept with the agent rather than with the runtime that happens to hold it.
Nothing in the package carries an agent’s working context between runtimes yet. This part is designed, not shipped.
Permissions
The scoped, budgeted, expiring grants it has been given — what it may do, up to what value, until when. Revoking one is meant to cascade to everything beneath it.
The MCP tool my_job reads the role, tools and expiry the owner granted on trustshell.dev. In the SDK, guardedX402Payment refuses a spend with no paying origin or no policy, and signs only under the cap.
Enforcing every grant on every tool call, so revoking one stops everything under it. That is the kernel’s job, and its enforcement flag is off by default (the sandbox, above).
The refuse
Its constitution: the rules it must satisfy before acting, so it can decline or escalate an unsafe or ungrounded action instead of performing it.
trustshell check and verify answer pass, veto or not checked, and not checked is never a pass. Since 1.7.0, trustshell ground vetoes a quote its cited page does not hold, locally, and trustshell receipt reads a kernel receipt back and refuses one that does not match its own hash.
The kernel refusing the action itself, before any tool runs, in production. The decision logic is shipped and tested; arming it is a flag that is off by default.
Quarantine, and why a missed catch costs more
LiveDirectionAnything the agent picks up from outside — a web page, a tool result, another agent’s message — is held apart and does not enter its trusted core until a check promotes it. It can be read and reasoned about; it cannot silently become a fact the agent acts on. The asymmetry is deliberate: a missed prompt-injection, or a falsified fact admitted as true, is a large loss — it costs more than several confirmed rights earn, because one poisoned fact can steer every decision made after it. Better to quarantine a true thing by mistake than to admit a false one.
Live since 1.7.0, in local memory only. A note is stored quarantined unless you vouch for it with remember --trusted, and a note an agent saves over MCP always is: recall leaves it out and says how many it held back. It is released only by a passing check — the note found in the source document recorded with it, locally, or two HAL checkers you ask for — or by your own word, recorded as such. Text that reads like an instruction to the agent is screened by fixed patterns, and nothing releases it.
What it does not do — direction. It holds text apart; it runs nothing in a sandbox. The screen is a fixed list, not adaptive learning, so a novel phrasing is held as untrusted but not flagged. Web pages, tool results and context the agent never saves to this memory are not quarantined. A release is not a truth verdict.
Live vs direction
The discipline that keeps what is running now separate from where the design is headed. A live claim points at something you can observe today; a direction describes an intention that is not yet a feature. It is why every claim on this page carries a tag, and why “not live yet” is written plainly on the things that are only designed — letting a roadmap read as a shipped feature is overclaiming, the same failure the three outcomes guard against, one level up.
Earn trust: standing, not a badge
A sandbox and a harness make an agent safe to run. Earned trust is what lets it do more over time without a human breaking every tie. RepID is portable, earned, weighted reputation: earned by verified work rather than assigned, weighted so substantive contributions move it and activity alone does not, and portable because it is anchored on-chain rather than held by one platform.
Earned is the load-bearing word, and it has a sharp edge: the score should move when a confirmed action helped someone who is not the actor. Helping yourself does not count. A clean record can widen the band an agent is allowed to act in; a caught claim, an off-list payee, or a dispute narrows it and asks the person. It can never raise the cap above what the owner signed.
The honest part. What should count as earned — how to make it hard to farm and still fair to the smallest player — is the unsolved problem underneath all portable reputation. We are working it in the open rather than claiming it is handled.
What this adds over a guardrail
A guardrail is one layer of the answer, and we keep it. The difference is everything it cannot do on its own — which is where the ecosystem lives.
Is the claim true?
A plain guardrail
A filter scans the wording and hopes. One model marking its own homework.
The trust ecosystem
Today two model families, from different builders, must both agree for a pass, so one provider’s bias or outage cannot fake a pass on its own. A golden-ratio supermajority across more families is the design target, not what runs.
When a check cannot run
A plain guardrail
Silence reads as approval — the unmeasured case quietly becomes a yes.
The trust ecosystem
A kernel that fails closed. Not checked is an absence, rendered neutral, and it blocks a post or a spend rather than defaulting to one.
Who is responsible
A plain guardrail
A system prompt names no accountable owner a third party can check.
The trust ecosystem
On-chain ERC-8004 identity and earned RepID: a named agent with a person at the root and standing it had to earn.
What it may spend
A plain guardrail
A sentence in the prompt. A jailbreak argues straight past it.
The trust ecosystem
x402 payment conditioned on a signed grant — an amount, a payee, an expiry, a purpose — that the account itself is built to enforce.
What you can show afterwards
A plain guardrail
A single green tick that hides whatever it did not look at.
The trust ecosystem
Two receipts. A paid deal's public receipt, which anyone can open at trustshell.dev/receipt/<id> with no key. And the policy kernel's six-claim receipt, which you read back with your own key: three honest outcomes (Verified, Not checked, Failed) and a line naming what it does not establish.
The verification mechanism is explained in full on how verification works; the thresholds and scoring that turn it into a number are engine internals and stay off a public page.
Specialty tool belts
A belt is a scoped capability bundle — the set of tools one agent may use for one role. Each belt is gated by the harness: the starter tools are kept to reads by a named setting, and the tools that spend, post, or cannot be undone are listed as held back, never pre-approved by appearing on the page. A role is a signed grant another app can check, not a click. Three belts exist today; the rest are directions we are shaping.
CMO
ShippedReads traffic, search and the web, and checks a claim before anything is posted. Publishing stays in the gated column.
CFO
ShippedReads the books, budgets and market data. Every tool that could pay is held back and listed as held back.
CTO
ShippedReads code, databases, dashboards and security scans — each started in its own read-only mode. Changes nothing.
Research
DirectionA reading-and-synthesis belt: fetch, search and summarise under the sandbox, with nothing that writes or posts. A direction, not a wired belt.
Trading
DirectionA paper lane first — signals and checks with no real money at risk — before any tool that moves value is ever admitted. The shape before the loop is full.
Medical
DirectionA consent-first belt that shares a proof instead of a record, so only the fields a study needs ever cross. A door, not a trial, and not a clinical offering.
The receipt ties it together
Sandbox, harness and earned trust each leave a mark, and the mark is a trust receipt that never collapses to one green badge. It makes six separate claims, each with its own status and its own gaps — a run can be authentic and authorized and still be wrong, and a single tick would hide exactly that.
Containment is the sandbox, on the receipt
One of the six claims answers a single question — did the execution boundary hold? When that cannot be established from inside the boundary, it reads Not checked, not a pass.
Three outcomes, kept apart
Collapse them into two and “we did not look” silently becomes “it passed” — the specific way trust software usually lies.
How to read this page
Shipped means it is live today and you can observe it — the check, the harness, the kernel that refuses anything but a clean, bound ALLOW.
Direction means we are building toward it and say so — an aim we are committed to, not a feature we are claiming. The enforced capability sandbox and the example belts beyond the three that exist are marked that way for a reason.
Everything that runs at all runs on Base Sepolia testnet — the money there is practice money with no value, and the on-chain spend path and escrow are still being wired.
Go deeper