A portable contract that rejects missing authority
The falsifiable questionCan another runtime validate what an agent was asked to do, what it was authorized to do, what changed, and how the result was checked — without an OrgX account?
External validation withheld until a runtime outside OrgX emits and independently verifies a receipt.
Baseline
A completion message is a self-authored claim. It usually omits the delegated authority, action lineage, artifact digests, evidence references, verification checks, cost, and human interventions required for a second system to audit the work.
Method
Published Agent Work Receipt v0.1 as an account-free Apache-2.0 contract: JSON Schema Draft 2020-12, deterministic TypeScript validator source, Codex/Claude Code/OpenClaw fixtures, explicit negative fixtures, and cross-language integrity vectors. A public endpoint validates receipts without persisting them.
Measured result
Live verification on July 27 accepted the 5,877-byte Codex fixture with HTTP 200 and ok=true. The 1,599-byte missing-authority fixture failed with HTTP 422, ok=false, issue_count=1, path=/authority, and code=schema.required.
Where it broke
The package is still a repository preview and is not published to npm. All current emitters and conformance vectors originate inside the project; no independent runtime has published a receipt or completed an external reproduction yet.
Updates
- Published after re-running the live positive and negative validation paths.
Next test
Earn the external criterion with an independently maintained emitter and public conformance run.