Richard Zhao

构建 AI Agent 的行为证据与信任基础设施：验证谁在什么权限下做了什么，以及真实结果。正在寻找能用中文深度沟通的技术合伙人｜Agent / MCP / A2A / 分布式系统

[Richard Zhao @passerbyRichard]

An agent can return “success” while the real system never changes.
Execution ≠ effect.
Link Protocol binds the action, signed downstream receipt and source-of-truth read-back into one verifiable trace.
Seeking 5 agent builders to test it:
https://t.co/gcYZJcLq9k

[Richard Zhao @passerbyRichard]

Agent 返回“成功”，不等于真实系统已经改变。

Link Protocol 把执行记录、下游签名回执和权威状态回读绑定为一条可验证证据链。

现寻找 5 位 Agent 开发者参与测试，也希望认识一位讲中文、技术扎实的联合创始人。

演示：https://t.co/gcYZJcLq9k

[Richard Zhao @passerbyRichard]

The evidence chain:

1. Attested execution — who acted under which authority
2. Signed downstream receipt — what the target accepted
3. Source-of-truth read-back — what actually changed

One action ID binds all three into a verifiable trace.

[Richard Zhao @passerbyRichard]

An agent can return “success” while the real system never changes.
Execution ≠ effect.
Link Protocol binds the action, signed downstream receipt and source-of-truth read-back into one verifiable trace.
Seeking 5 agent builders to test it:
https://t.co/gcYZJcLq9k

[Richard Zhao @passerbyRichard]

The evidence chain:

1. Attested execution — who acted under which authority
2. Signed downstream receipt — what the target accepted
3. Source-of-truth read-back — what actually changed

One action ID binds all three into a verifiable trace.

[Richard Zhao @passerbyRichard]

The internet wasn't trustworthy because of HTTP. It became trustworthy when HTTPS became the default—almost a decade later.

The agent economy is on the same curve. In 2026, MCP/A2A/x402 shipped the "transport layer": agents call, talk, pay. But the trust layer—who proves what an agent did—has no default implementation yet.

My bet: the agent economy's HTTPS moment won't be triggered by idealism. It'll be triggered by **one sufficiently large incident**—an agent executing a massive erroneous payment with no one able to prove why. Regulators will force a standard, the way breaches forced HTTPS.

Whoever makes the trust layer the default *before* that incident owns the definition. We're building the foundation now.

[Richard Zhao @passerbyRichard]

The failure is intentionally simple:

`disable_user("alice")` → `200 OK`
authoritative read-back → `ACTIVE`

The call was executed. The intended state change was not.

For consequential actions, agents need proof of effect—not only proof of execution.

[Richard Zhao @passerbyRichard]

Everyone's building the 100th agent tool. I'm not.

Tools = efficiency = linear business. Your agent makes me 30% faster, I pay a sub. Then a bigco bundles it and your moat evaporates—the SaaS story of the last decade.

Trust = rights confirmation = exponential business. When agents move real money and contracts, whoever owns "behavior is verifiable, disputes are arbitrable" sits at the center of the value graph.

HTTPS for the internet. SWIFT for cross-border. Link Protocol for the agent economy.

Not betting on a feature. Betting on infrastructure.

[Richard Zhao @passerbyRichard]

Why incorporate an AI-agent trust company in Hong Kong? Three reasons, not the "going global" buzzword:

1/ Legal structure. Agent trust = behavioral evidence + dispute arbitration. Common-law contract & evidence rules aren't a plus—they're the entry ticket.

2/ Crypto + cross-border friendly. DBS HK account. Ed25519 signatures + A2A-compatible stack serving cross-border agent networks.

3/ Real backing. Submitted Cyberport CIP (HK$500K / 24mo).

v1 is real: 80+ server modules, 99 client files, 17 migrations, 97.8% test pass. Not a deck.

[Richard Zhao @passerbyRichard]

AI agents can now move your money and book your flights. But when one screws up, who's liable—and where's the proof?

The protocol stack solved a lot:
• MCP → agents call tools
• A2A → agents talk to each other
• x402 → agents pay autonomously

One layer is still missing: when an agent causes damage, **who proves what it did?**

We're building that layer. Link Protocol → cryptographically signed, chain-recorded, tamper-proof behavioral records for agent networks.

The internet became trustworthy because of HTTPS. The agent economy needs its own trust layer. And it's still empty.

🇭🇰 incorporated in HK (CR 80713863), v1 at 97.8% test pass.

[Richard Zhao @passerbyRichard]

@Lummox_eth These repos cover the build surface well. For production, the missing connector is evidence across the chain: plan → tool call → state change → evaluation → approval. Portable traces make the stack interoperable even when frameworks and model providers change.

[Richard Zhao @passerbyRichard]

@neil_xbt An agent org chart needs an evidence layer too. The manager should not only route and approve; it should preserve delegation scope, signed tool receipts, and outcome checks so a human can reconstruct why a specialist acted and what actually changed.

[Richard Zhao @passerbyRichard]

@AiswaryaVenkit1 Strong stack map. I’d add one cross-cutting layer: portable trust across identity, security, observability, and evaluation. When a task crosses MCP/A2A handoffs, can downstream systems verify who acted, under what policy, and whether the intended state change occurred?

[Richard Zhao @passerbyRichard]

@OriginsNetwork_ Identity, authority, and execution should be verifiable as one chain. An agent passport is not enough: downstream systems need delegated scope, signed action receipts, and a read-back of resulting state. Otherwise “autonomous” remains unauditable.

[Richard Zhao @passerbyRichard]

@RishiUvaach Exactly—the stack is becoming the product. The missing connective tissue is portable trust across models, tools, and runtimes: identity, policy scope, tool receipts, outcome checks, and recovery traces that survive handoffs. Observability explains; it cannot prove authority.

[Richard Zhao @passerbyRichard]

@startupideaspod The strongest ideas here are identity, permission, and receipts. Once agents become customers, each call needs portable proof of who acted, under whose authority, what changed, and whether the intended outcome occurred. That is the missing trust substrate.

[Richard Zhao @passerbyRichard]

@AleiahLock Persistent memory is useful, but trust needs provenance. Each task or link should retain source, agent identity, policy scope, and correction history—otherwise a “second brain” can preserve errors as efficiently as facts.

[Richard Zhao @passerbyRichard]

@rohanpaul_ai The key boundary is authority continuity, not MCP connectivity. Can seller, Claude, and Salesforce show which permission enabled each call—and provide a read-back proving the CRM change stuck? That evidence will decide whether headless workflows scale.

[Richard Zhao @passerbyRichard]

@choopyplug1 Harness engineering is the right abstraction. The next layer is portable evidence: bind each permission check, tool call, retry, and recovery to agent identity and policy version, then make it replayable by an independent verifier. That turns a harness into a trust boundary.

[Richard Zhao @passerbyRichard]

@shmidtqq Delegation is production-grade only when every handoff has a trust boundary: scoped credentials, explicit approvals, signed tool receipts, and read-back for consequential changes. Automation is valuable when you can reconstruct why an agent acted—not only that it acted.

[Richard Zhao @passerbyRichard]

@CoreyGallon @ChrisLovejoy_ @saulhoward Exactly. An audit trail is a chain of justified actions, not a developer log. The design question I keep coming back to: can a reviewer replay the event stream, verify each authorization, and independently confirm the final state without exposing sensitive data?