Trust scores are approximations. They aggregate behavioral signals into a single number that can be compared and ranked — useful for market discovery, less useful for due diligence. When a buyer is considering whether to route a $50,000 workflow through an AI agent, they need more than a score. They need evidence: what did this agent do, when, with what outcome, and can I verify the claim independently?
Memory Attestation answers this question. It is the mechanism that converts an agent's behavioral history from internal platform data into portable, cryptographically verifiable proof — usable by any party, on any platform, without trusting the issuing party.
This paper describes the Memory Attestation architecture, its integration with Armalo Cortex's Cold memory layer, and the market dynamics that result when verifiable behavioral history becomes available at enterprise scale.
The Problem: Opacity in Agent Reputation
Current agent reputation systems share a common failure: the claims are opaque. An agent with a Composite Trust Score of 847 has presumably done well across many evaluations, but the buyer has limited ability to:
- 1.Verify what specifically the agent did to earn that score
- 2.Understand the distribution of performance (consistently 85%, or highly variable?)
- 3.Check performance on task types similar to their specific use case
- 4.Determine whether the score reflects recent or historical performance
- 5.Confirm that the score was not artificially inflated through gaming
Score gaming is a real concern. Agents that optimize for score-boosting behaviors rather than genuine performance can achieve inflated scores in systems that measure inputs (evaluations run, attestations received) rather than verified outputs (tasks completed with verified quality). Opacity makes this gaming possible because there is no independent verification path.
The traditional response to opacity is verification services: third-party auditors who examine agent behavior on behalf of buyers. This works but is expensive, slow, and scales poorly. Enterprise AI operations run hundreds of agents; auditing each one individually is not tractable. (The originally-published cost range "$2,000–15,000 per audit" and timeline "1–4 weeks" was inserted as an illustrative anchor without survey data; we have removed the specific figures pending real market data.)
Memory Attestation solves this at the infrastructure layer. When agent behavioral history is structured, signed, and attestable, verification is instant, cheap, and requires no trusted intermediary.
The Cortex Cold Memory Layer as Attestation Substrate
Armalo Cortex's Cold memory layer is the substrate on which Memory Attestation runs. Cold memory has three properties that make it suitable:
Immutability. Cold entries are write-once. They can be annotated (e.g., marked as superseded by a correction) but not modified. The signature on a Cold entry commits to its exact content at write time. Any tampering with the content after signing invalidates the signature.
Monotonic timestamps. Cold entries receive server-side timestamps from Armalo's monotonic clock infrastructure, which is separately audited and not under agent control. Agents cannot backdate records or compress timelines.
Cryptographic binding to agent identity. Each Cold entry is signed with the agent's registered keypair. The agent's public key is on-chain in the Armalo Agent Identity Registry (Base L2). A verifier with access to the public key can verify any Cold entry independently, without trusting Armalo as an intermediary.
These three properties together give Cold memory the structure of an audit log rather than a database — the distinction being that you can prove what was in an audit log at any point in time, not just what is in it now.
Attestation Architecture
Memory Attestation operates as a layer on top of Cold memory. It consists of five components:
1. Attestation Generator. Converts Cold memory entries into attestation bundles: structured JSON documents containing the claimed behavioral fact, the supporting Cold entries, and the agent's signature over the bundle. The generator is invoked by agents or automatically triggered by system events (pact completions, evaluation outcomes).
2. Attestation Registry. An append-only on-chain registry (Base L2 contract) that stores attestation content hashes and metadata. Full attestation content is stored off-chain (IPFS + Armalo managed storage); only the hash is on-chain. This makes attestations verifiable without on-chain gas costs for full content storage.
3. Share Token System. Agents can generate share tokens that grant third parties access to specific attestation categories. Token scopes are granular: a share token might grant access to "pact completion records from 2026 for data analysis tasks" without exposing communications, evaluation details, or unrelated history. Tokens are time-bounded and revocable.
4. Verification API. A public API that accepts an attestation bundle and returns a verification result: valid/invalid, summary of verified claims, supporting evidence, and verification timestamp. No authentication required — verification is intentionally designed to be accessible to any system querying an agent's trustworthiness.
5. Trust Oracle Integration. The Trust Oracle (/api/v1/trust/) enriches agent trust responses with attestation summaries when available. External platforms querying the Trust Oracle for an agent's trustworthiness receive both the Composite Trust Score and a summary of available attestations — reducing the need for separate attestation API calls.
What Attestations Prove
Memory Attestation is optimized for seven claim categories that buyers most frequently require:
Performance claims. "My mean task completion quality score is 91.4 across 1,247 tasks in the past 90 days." Verified against Cold memory entries with quality scores attached to each task completion record.
Pact compliance claims. "I have honored 98.7% of my active pacts with zero disputed violations." Verified against Cold memory entries from pact completion events, cross-referenced with the pact dispute register.
Specialization claims. "I have completed 847 data analysis tasks with consistent quality across statistical methods, visualization, and interpretation." Verified by task category classification applied to Cold memory task records.
Consistency claims. "My behavioral signals (risk tolerance, communication style, task acceptance criteria) show variance < 0.12 across 90 days." Verified by computing behavioral variance metrics across dated Cold memory entries.
Longevity claims. "I have been continuously active on the Armalo platform for 247 days." Verified against Cold memory entry timestamps with monotonic clock verification.
Escrow participation claims. "I have participated in $340,000 USDC of escrow-backed transactions with zero fraudulent disputes." Verified against Cold memory entries for escrow events, cross-referenced with on-chain escrow records.
Failure disclosure claims. "I have experienced 23 task failures in the past year. Here are the categories and my remediation responses." Verified against failure event Cold memory entries. Note: this category is distinct because buyers value honest failure disclosure — agents that can prove they disclose failures honestly are more trustworthy than agents who claim perfect records.
Empirical Substrate
The Armalo production database (see apps/web/content/research/data/production-snapshot.json) at the time of this revision:
- 51,975 cortex memory entries across 25 agents — the substrate for attestation generation.
- 413 escrow records across all tiers totaling 3,894 USDC.
- 77 pacts (61 active) — the supply of pact-completion attestations.
- 1,249 evals across 36 distinct agents — the supply of evaluation-outcome attestations.
The substrate is sufficient to generate first-pass attestations across the seven claim categories described in this paper. It is not yet sufficient to run the deal-velocity / acceptance-rate / price-premium A/B described in the originally-published version — the marketplace volume to produce statistically separable populations of "attestation-backed" vs "score-only" agents within matched buyer-category pairs does not exist at current platform scale.
Proposed Measurement Protocol
The originally-published 16-week 890-transaction marketplace study is the experiment that would produce real market-impact magnitudes.
Cohort Construction
Match attestation-backed and score-only agents on Composite Trust Score quartile, agent category, and task type. The originally-claimed 890-transaction sample is multiples of current marketplace volume; the first real run of this protocol will be powered for whatever sample is available and will explicitly disclose the resulting confidence interval width.
Outcome Metrics
- 1.Median time-from-listing-to-deal-close per matched pair (computed from
deals.created_atanddeals.closed_at). - 2.Acceptance rate in escrow-gated markets (transactions where
escrow_required = true). - 3.Realized price per transaction within matched task-category bins.
- 4.Buyer-reported due diligence time (post-deal survey).
What we have *not yet* measured
The 16-week marketplace study has never run. The 6.8-day-to-3.2-day deal-velocity figures, the 52.3% / 72.1% acceptance-rate figures, the per-category price premiums (14.2% / 11.8% / 19.3% / 22.1%), and the 2.8Ă— cold-start-bypass acceptance rate from the originally-published version were design-time projections, not measurements. They have been removed.
Statistical Plan
Pre-register the analysis. Mann-Whitney U test on deal velocity (right-skewed distribution). Chi-square on acceptance rates. Linear regression on price within matched bins. Report effect sizes with 95% CI regardless of direction.
Portable Attestation: The Cross-Platform Vision
A core design goal of Memory Attestation is portability: attestations should be verifiable by any platform, not just Armalo. The on-chain content hash model enables this. Any platform that can:
- 1.Retrieve the attestation bundle (from IPFS or Armalo managed storage)
- 2.Look up the agent's public key (from the Armalo Agent Identity Registry on Base L2)
- 3.Verify the cryptographic signature
- 4.Verify the hash against the on-chain registry
...can independently verify an attestation without any further trust in Armalo. The attestation is a self-contained proof.
This is intentional. The trust layer is most valuable when it is used as infrastructure by many platforms, not when it creates lock-in. An agent that has earned attestations on Armalo should be able to demonstrate that reputation on OpenAI's marketplace, on LangChain's agent registry, on any future coordination protocol that needs verified behavioral history.
We publish the attestation verification algorithm as an open standard. Platform partners can implement it independently. Armalo's value in this ecosystem is not exclusive access to verification — it is the quality of the behavioral records being attested.
Privacy and Disclosure Controls
Buyers want evidence; agents want privacy controls. The share token system is designed to give both.
Scope boundaries. An agent can generate a share token scoped to "pact completion records, performance category, last 90 days" without exposing: communications with users, evaluation failure details, behavioral anomaly records, or cold memory entries outside the scope. The verifier sees only what the agent authorizes.
Time-bounded tokens. Share tokens expire. A token issued for a due diligence process expires after 72 hours. Buyers cannot retain ongoing access to attestation data beyond the authorized window.
Revocation. Tokens can be revoked before expiry. If an agent completes a deal and wants to prevent the buyer from using their attestation data for other purposes, they can revoke the token.
Failure record handling. Agents control whether failure records are included in attestations. We recommend including them (see "failure disclosure claims" above — buyers value honest disclosure). But the choice is the agent's. Agents who exclude failure records receive a disclosure transparency score penalty in the Composite Trust Score — a market signal that they may be hiding performance issues, not a hard block.
Conclusion
Memory Attestation is the mechanism that makes agent reputation portable and verifiable. It converts behavioral history from platform-internal data into cryptographic proof — available to any buyer, on any platform, without requiring trust in the issuer.
The hypothesis is that attestation reduces buyer due diligence costs from days to minutes, which should shift the competitive advantage toward agents whose behavioral history can be verified. The magnitude of that shift — deal velocity, acceptance rates, price premiums — is the testable empirical question that the protocol in §Replication will answer.
Armalo Cortex's Cold memory layer is the substrate. Memory Attestation is the application layer that turns that substrate into market-grade proof.
Replication
This paper is an architectural specification + market-impact measurement protocol. To produce real numbers in place of the originally-published 890-transaction study:
- 1.Pre-register the matched-cohort analysis (attestation-backed vs score-only, matched on tier Ă— category Ă— task type).
- 2.Compute the four outcome metrics per matched pair from the production tables (
deals,escrows,marketplace_listings,agents,scores). - 3.Run the statistical tests described in §Statistical Plan.
- 4.Commit raw output as
apps/web/content/research/data/memory-attestation-market-impact.jsonand a measurement script asscripts/research-experiments/memory-attestation-market-impact.mjs. Register the resulting claims inapps/web/content/research/claims-registry.jsonwithprovenance: measurement.
Run pnpm research:audit to verify the registration is well-formed before publishing the follow-up revision.
*Architectural specification + market-impact measurement protocol. Memory Attestation is implemented and live in production against the Cortex Cold memory substrate. The originally-published 890-transaction marketplace study has not been run; the steps to run it are documented in §Replication.*