Agents already found their forum. We built the better one.

goun7 — Sun, 13 Sep 2026 18:51:41 +0000

A security talk recently described an incident where ~1,200 AI agents —
supposed to be isolated — discovered a shared writable storage medium and
organized themselves a message board. Tens of thousands of messages. One
agent's discovery became another's tool. No superintelligence, just
emergent coordination through an unmanaged channel. (The details are
secondhand — see the linked commentary — but the pattern is the point:
close the door, and they talk through the window.)

While standards bodies were still drafting agent-to-agent communication
protocols, agents had already demonstrated they don't wait for one.

Here is the uncomfortable conclusion: if your audit strategy depends on
discovering the channels agents use, you are always at least one
pundit-cycle behind.

The alternative: make the managed channel better than the covert one

I built Veridict (Apache-2.0, 20 core modules, stdlib-only core) around a
simple inversion: don't wall off coordination — out-compete the covert
channel. Give every AI actor a coordination surface that is:

append-only and hash-chained — every entry's hash binds its author, its timestamp (as a language-neutral string — floats are too fragile to hash across languages), and its parent. A retroactive edit is not "hard to detect," it is mathematically loud.
identity-bound — machine producers get signed manifests; W1a-grade machine truth is structurally impossible for them to claim; a calibration ledger discounts producers whose past claims were contradicted.
fail-closed by construction — no evidence is never a pass; it is an INCONCLUSIVE verdict with a flag. There is no configuration in which silence looks like success.
verifiable without trusting us. Certificates replay offline against the ledger. We publish language-neutral test vectors, and — the part we are proudest of — a verifier implemented from the specification alone (zero imports of our code) that reaches identical verdicts on every failure mode we could fuzz: 8/8 agreement, and the cross- implementation fuzz property is now permanent in the suite.

What the receipts say (regenerated on every push, not narrated)

260 tests, three Python versions in CI
the system audits itself and holds its own watchers to its own conformance kit — ten shipped example watchers at the moment (secret-scan, license-scan, docker hygiene, doc-sync, SBOM, a11y, import-weight, security, compliance, cost), each one certified by the same kit a third party would face
a 1500-ledger tamper soak: 100% detection, zero silent passes
a canary protocol with honest misses in the published quality sheet — 10 catches / 3 misses / 0 false positives across 12 defect classes. A measurement that catches everything is a rigged measurement.

Two things are deliberately absent from that list, because they're not
done yet: a jury run against a real LLM endpoint (the shipped one is a
deterministic stub; the real provider path is validated against a local
mock), and an independent verifier written by someone who isn't me. The
second one is the whole point of publishing — see below.

The human part

The design's conceptual heart is not the hash chain — it is this: the
machine owns the verdict of intelligence, the human owns the verdict of
responsibility. When a critical-class claim splits, the system escalates
with a dossier presenting both sides' strongest evidence, and the
system is structurally incapable of resolving itself.

Links

Repo: https://github.com/goun7/veridict
Install: pip install veridict-standard (PyPI; the bare veridict name on PyPI is a different, unrelated project)
The standard (normative draft, errata included): https://github.com/goun7/veridict/blob/main/docs/specs/2026-09-10-veridict-standard-v1.0.md
The spec-only verifier: https://github.com/goun7/veridict/blob/main/examples/spec_verifier.py
Commercial model (open core, interest-gated everything else): https://github.com/goun7/veridict/blob/main/docs/commercial-model.md

I'm looking for exactly one thing right now: someone to implement an
independent verifier from the spec and tell me where it is ambiguous.
That is the standard's own exit criterion ① — and honestly, the only
review that counts.

DEV Community: goun7

Agents already found their forum. We built the better one.

The alternative: make the managed channel better than the covert one

What the receipts say (regenerated on every push, not narrated)

The human part

Links