Verifier of Record
A Verifier of Record is a neutral, non-counterparty service that ingests agent-economic intents from many different networks and emits a single, canonical, cryptographically-signed, audit-defensible receipt. It is delivered by verifier-svc (service AP00016), Osyra's Pillar-6 substrate, and the receipt it emits is the Verified Intent Receipt (VIR).
The defining property is neutrality. In the agent economy, the parties that attest an intent are usually also the parties that profit from it — a payment network attesting a payment it also settles, an interoperability hub attesting a verdict it also orchestrates. A Verifier of Record verifies and attests across networks but settles nothing, issues nothing, and holds no reserves. That neutrality is the entire point.
Why it matters
The agent-economy stack has well-populated layers for wire protocols, issuers, interoperability hubs, and hyperscaler bundles — but the neutral cross-network verifier layer was vacant. Every incumbent at the layers below conflates two roles: attester and economic counterparty.
A Verifier of Record occupies that vacant layer by construction:
- It accepts all competitor receipt and intent formats and is indifferent to their issuers.
- It sits above the interoperability hubs and bridges to the hyperscaler bundles.
- It emits one canonical artifact (the VIR) that feeds dispute resolution, audit, and regulators — replacing N vendor-specific framework attestations with a single conformity artifact.
How it works
Deliberately small novel surface
The Verifier of Record is built to be small in new cryptography. It consumes
ratified Osyra substrate rather than re-deriving it. A VIR is a COSE_Sign1
structure whose payload is a canonical-CBOR Form B envelope tagged
osyra-vir-v1 — the exact primitives Verified Memory's .ome bundles use,
reused. By inheriting an already-frozen, cross-platform-conformant cryptographic
core, the service starts at deployment maturity rather than prototype maturity.
The VIR lifecycle
-
Originate at the edge. The edge gateway (AP00001) receives an authorized request carrying a source-protocol intent and calls the verifier.
-
Translate and project. A cross-network bridge translates the source intent into Osyra's canonical capability form and projects the intent body. A monotonicity ratchet refuses any projection that would expand scope, and an expired intent is refused.
-
Reserve exclusivity, then sign. For an exclusivity-bearing emission, an atomic conditional insert is committed to a cross-network exclusivity registry before signing — so two concurrent calls yield exactly one receipt and the same capability cannot be projected into the same receiver twice.
-
Sign and persist. The codec encodes the Form B preimage and a HSM/KMS-backed signing key produces the COSE_Sign1 signature; the receipt is persisted in a workspace-partitioned linkage store.
-
Return and fan out. The signed VIR is returned and fans out to consumers — the memory engine, billing, and the frontend receipt viewer.
What a VIR carries
The receipt's signed preimage binds the fields a verifier and downstream consumer
need, including the workspace id (ws), the subject/agent DID (subj), the L5
attestor DID (signer), the capability id authorizing the intent (oaec_cap), a
source-protocol discriminator (src), the canonical projection of the intent, a
content hash, a Merkle-root binding, and a timestamp used by the freshness gate.
Because the workspace id is covered by the signature inside the Form B preimage, and signing keys are per-workspace and HSM/KMS-custodied, a receipt issued for one workspace cannot be replayed or forged as another's.
Receipts compose under an algebra
VIRs are not free-floating documents. They are elements of the Osyra receipt algebra: a receipt chains to its predecessor, evidence extends into an envelope, and a projection through a cross-network bridge is guaranteed never to expand scope. The verifier implements this ratified algebra; it does not invent new receipt semantics.
Availability versus auditability is surfaced, not hidden
When the verifier is momentarily unavailable, the behavior is a tier-configurable, explicit trade-off rather than a silent fallback:
- Compliance tier → fail-closed. The originating operation fails rather than completing without an audit-defensible receipt. This is what preserves the audit guarantee under a denial-of-service attempt.
- Free tier → fail-open. The operation completes and the receipt is best-effort, retried durably so it is eventually emitted; every fail-open event emits a metric and an audit event so the gap is observable.
How the Verifier of Record relates to the rest of Osyra
A VIR originates at the edge (AP00001), is signed by the verifier (AP00016), and fans out to the memory engine (AP00011), billing (AP00003), and the frontend viewer (AP00010). It reuses the same canonical-CBOR Form B and COSE_Sign1 primitives as Verified Memory, and its receipts can feed directly into audit and regulatory processes. It verifies across the other pillars without becoming a participant in any transaction.
Scope and roadmap
The VIR wire format, the cross-network bridge ingest path, the OAEC algebra binding, workspace-scoped HSM/KMS signing, the cross-network exclusivity registry, and the fail-closed/fail-open tiers are built in V1, with the productized Go service shipping and its receipt path conformance-tested. A blinded / zero-knowledge commitment-only receipt mode is on the roadmap (V1.5); the receipts described here carry their bound fields in canonical CBOR today.