TrustShell · Portable Agentic Trust Harness
36 terms you will meet using TrustShell — each with its own link, so any page can point straight at a definition instead of assuming you already know it.
Each entry carries an honest status. Shipped means it runs today. Approximate means it is measured against a documented stand-in and says which way it can be wrong. Not live yet means it is designed and wired as a contract surface but the implementation behind it is a stub. A glossary that reads as a feature list is just overclaiming with extra steps.
36 terms. Every one has its own link — click a heading to copy it.
The things you touch directly.
One conversation that sits in front of the whole trust kernel. Instead of learning six screens, you talk to your PAI and it files the work, runs the checks and shows you what it did.
What TrustShell is. A harness wraps an agent you already have rather than replacing it: the same agent keeps its reputation, its constitution and its memory of what it has done, whichever model answers the next prompt.
Portable is the operative word. Your agent's earned standing is not held inside one vendor's account, so switching models does not reset it to zero.
Runs route free-tier models first and fall back to paid ones only when needed, using your own keys. Change provider and your agent, its RepID and its history come with you.
The browser-local store for your model provider keys, encrypted with AES-GCM behind a passphrase that never leaves your device.
Non-custodial in the sense that matters: we never receive your keys. Not in the stronger sense — we serve the JavaScript that runs in your browser, so the honest claim is "we never receive them", not "we could not possibly access them".
A named identity that does work and accumulates a record for it. It holds a constitution, earns RepID, and can be granted authority to spend.
A way to file a note as the product's owner rather than as an end user, so founder observations never contaminate user telemetry.
The event contract is specified and notes are tagged, but they are stored on that device only — the backend that would persist them is not built.
Reputation and authority that belong to you, not to a platform.
Portable, earned, weighted reputation for an agent. Earned by verified work rather than assigned; weighted so that substantive contributions move it and activity alone does not; portable because it is anchored on-chain rather than held by one platform.
Scores are clamped to a fixed range and the tier is derived from the score by the database, never written by hand — so a tier can never drift from the number that earned it.
A band derived from an agent's RepID: PROBATIONARY, EARNING, ESTABLISHED, AUTONOMOUS, VETERAN. Tiers gate what an agent may do without a human in the loop.
A scoped, budgeted, expiring permission from one principal to another — what an agent may do, up to what value, until when. Grants can be revoked, and revoking one cascades to everything delegated beneath it.
Revocation is the part that makes a grant meaningful rather than decorative, and it is verified end-to-end against production.
Collateral an agent's owner posts to raise how much that agent may transact autonomously. Skin in the game, expressed as a number the system can check.
The computed authority ceiling actually applied to a decision — the lower of what reputation allows and what stake supports, and zero below a minimum standing.
APPROXIMATE, and it can OVERSTATE. One input is passed through from the ledger rather than recomputed with decay applied, so an agent whose reputation has decayed unrecorded may show a ceiling higher than it has earned. Every result is stamped to say so.
What a claim has to survive before we call it true — and the words we use when it has not.
The hallucination-detection engine. It scores a response for risk across several independent model families and returns PASS, FLAG (proceed with care) or VETO.
Scoring runs on our servers, not in your browser. There is no local inference path.
A named check ran, and it passed. Traceable back to that specific check. This is the only state that asserts something is true.
Measured — but against a documented stand-in rather than the real quantity. Always travels with the caveat that says which stand-in and in which direction it can be wrong.
Nobody looked. It is not a warning and it is not a failure — it is an absence.
Rendered neutral and colourless on purpose. Amber would assert that something is wrong, which is a claim nobody measured — the same error as a green tick asserting a success nobody measured, pointed the other way.
A check ran and did not pass. Distinct from NOT_CHECKED, always.
Keeping these four apart is the product. Collapse them into two and "we did not look" silently becomes "it passed" — which is the specific way trust software usually lies.
One execution of a named check that produces one of the four states above. Nothing is allowed to claim MEASURED unless a GateRun produced it.
The rule that reputation moves for substantive deliverables and not for activity. A pleasant conversational reply earns nothing.
Anti-theatre, and a direct answer to Goodhart's Law: the moment a count becomes the target, the count stops meaning anything.
Rules an agent must satisfy before acting, so it can decline or escalate an unsafe or ungrounded action instead of performing it.
Using validators from deliberately different model families so they fail differently. Checkers that share training share blind spots, and agreement between them proves less than it appears to.
Treating suspiciously perfect agreement as a warning rather than a confirmation. Validators that agree too exactly are more likely to share a blind spot than to be right.
Stopping one actor from manufacturing many identities to vote up its own reputation. The open research problem underneath all portable reputation.
Named honestly as unsolved. We would rather recruit help on it than imply it is handled.
What can be proven without being revealed. Includes what is not built yet.
Granting nothing on the basis of identity, position or assertion — every actor starts with none, and access follows verification rather than preceding it.
Why it fits here: in a world of cheap deepfakes and synthetic agents, the ecosystem as a whole deserves no default trust. What TrustShell adds is the other half — trust that gets REVEALED by what an agent verifiably did, rather than granted because of what it claims to be.
Proving a statement is true without revealing the data behind it — verification without surveillance.
NOT LIVE HERE, and the halves differ. PROVING — producing a proof — is a stub on this site: it generates nothing real, and nothing here is currently protected by one. VERIFYING — checking a proof someone else produced — is shipped and published as `@hyperdag/proof-verifier`. A verifier without a live prover protects nothing yet, so this stays labelled not-live; but the checking half is real code you can read, not a promise.
The STARK proving system the ZKP design targets.
The PROVER is not running here — see ZKP. The VERIFIER is: `@hyperdag/proof-verifier` v0.2.0 is published on npm under Apache-2.0, a Rust crate compiled to WebAssembly that checks a Plonky3 RepID proof in your own browser or Node process rather than trusting a server that says `verified: true`. It is the strongest single piece of evidence that this is engineering rather than positioning — and it is waiting for the prover, not the other way round.
Revealing only the fact you need to prove rather than the whole document that contains it — proving you clear a threshold without showing the number.
Credentials you hold yourself rather than ones a platform holds about you — provable without asking the issuer for permission each time.
The opposite of a black box: the owner can see every decision their agent made and why. Transparent to you, opaque to everyone else.
Including transparency about limits — a glass box that hides what it has not measured is just a black box with better lighting.
A tamper-evident record of who did what, when, and under whose authority.
The rails underneath. Deeper treatment lives on hyperdag.org.
The umbrella protocol underneath TrustShell — composable primitives for agent identity, reputation, validation and payment, adopted only as needed.
The emerging Ethereum standard for AI-agent identity and reputation. RepID anchors to its registries.
On Base Sepolia testnet today.
An HTTP-native payment standard for agent-to-agent micropayments, built on the long-dormant 402 Payment Required status code.
The settlement-to-fulfilment pipeline: after payment, escrow moves to fulfilled and an on-chain reputation attestation is written — autonomously, and exactly once.
A signed statement that something happened, recorded so a third party can check it later without trusting the party that made it.
The reference 12-agent swarm built on HyperDAG — a live demonstration of the primitives, not the protocol itself.