Evidence for AI Inference From Strangers: The Design Behind Mesh-LLM’s Capsules Plugin
When your agent sends an inference request to a node it has never met, what can it check afterward, and what should it refuse to take on faith?
This talk goes under the Mesh-LLM evidence plugin to the design it’s built on: Agent Action Capsules (AAC), an open specification for signed, hash-chained records of what an agent did, and the pieces around it that make a record from a stranger checkable. We’ll cover how a capsule binds a request and response by digest, how each node keeps a local log that it checkpoints without a central authority, how two parties’ records are reconciled when neither trusts the other, and how a record states what it proves and what it doesn’t, so a verifier can grade it rather than take a score.
Then we’ll apply it to Mesh-LLM: what each node records, what its peer can verify, and why catching a node that misrepresents its model needs a second independent node and a referee, not just better signatures.
For engineers building or running peer-to-peer inference, and anyone designing evidence for autonomous agents. All of it is open source and open specification.
Speaker: Steven Mih, Founder and CEO, Action State; author of the AAC drafts. Hosted after the Mesh-LLM community call.
Agenda
The problem. A node you’ve never met serves your inference. What its claims are, what you can check afterward, and the trust map of what each check shows and doesn’t.
AAC: Agent Action Capsules. The record format. Why a capsule carries digests, not payloads; how the request and response are bound; epoch chaining; the
inference_completioneffect used by the mesh. (draft-mih-scitt-agent-action-capsule)COSE and deterministic encoding. Why the record is a COSE Sign1 envelope, and why two implementations must hash identical bytes: JCS canonicalization and the COSE deterministic-encodings work. (RFC 9052, RFC 9596, RFC 9995)
CPB: Canonical Payload Binding. How a signed statement declares the canonicalization its payload used, so a verifier can recompute the binding instead of trusting it. (draft-mih-sokolov-scitt-payload-binding)
SCITT: transparency without a central authority. Signed statements, receipts, and transparency services. What a receipt proves (inclusion) and what it doesn’t. (RFC 9943, RFC 9942)
CLL and MMR: the local log. Each node keeps its own Merkle Mountain Range, signs checkpoints, and can register them later. What a checkpoint proves, what it leaves open, and how it relates to the SCITT MMR receipt profile. (draft-mih-scitt-checkpointed-local-log, draft-bryce-cose-receipts-mmr-profile)
Bilateral and settlement records. Two parties, neither trusted: each seals what it observed, a verifier derives agreement. The six reconciliation states. Settlement legs for paid exchanges. (draft-mih-agent-bilateral-attestation, draft-mih-agent-settlement-records)
Evidence bundles and selective disclosure. How records are packaged for a verifier, how completeness is claimed in three separate parts, and how fields are withheld without breaking signatures. (draft-mih-zhang-agent-disclosure-bundle, draft-mih-scitt-agent-action-capsule-sel-disc, SD-CWT)
Grades, not scores. The evidence layer: self-attested, witnessed, countersigned. Verifiers re-derive grades and report overclaims. Why there’s no reputation number anywhere in the design. (draft-mih-agent-evidence-layer)
Applied to Mesh-LLM. The
capsulesplugin (v0.1.4): what each node records, exchanging records between peers, plugin keys bound to the node key (mesh-llm #2299), thetwin_bracketcapability (#2300), and the referee for client-marked pairs.Limits and what’s next. What a verified key does and doesn’t mean; why detecting a misrepresented model needs a second node and a referee; hardware attestation (TDX) as the route beyond self-report.
Live demo and Q&A. One exchange on a running mesh, both records, one marked pair.
All drafts: datatracker.ietf.org/doc/search?name=draft-mih · Code: action-state-group · Mesh-LLM/capsules