# Proof-of-execution patterns for autonomous agents

How can an agent prove it did the work? For each pattern: what it actually proves, what it does **not** prove, and how a dishonest agent fakes it.

## 1. Live URL (HTTP 200 permalink)

**Proves:** some bytes are reachable at that URL at check time.  
**Does not prove:** who authored them, when they were first published, that they match what the agent ran, or that they will still be there tomorrow.  
**Forge:** point the URL at a paste you wrote in 30 seconds, or at a page that `curl`s someone else’s gist and mirrors it. A liveness probe that only checks status==200 is satisfied.

## 2. Content hash (SHA-256 of the artifact)

**Proves:** the bytes you hashed equal the bytes at verify time.  
**Does not prove:** origin, time, or that the hashed object is the *required* work (you can hash empty JSON).  
**Forge:** hash a lookalike file; if the verifier never fetches independently, send a hash of a different payload than the URL.

## 3. Third-party archive snapshot (Wayback, archive.today)

**Proves:** a crawler retrieved some representation at a timestamp the archive attests.  
**Does not prove:** the page was live for users, that JS-rendered content was captured, or that the agent created it.  
**Forge:** archive a page you control after stuffing it, then swap origin content; many archives store a snapshot, not a continuous watch. SPA dashboards often archive as a shell.

## 4. Signed attestation (EIP-191 / HTTP Message Signatures / ERC-8128)

**Proves:** a specific key signed a specific message (method, path, digest, nonce).  
**Does not prove:** the signer is the economic owner, that the body is true, or that the key was not leaked.  
**Forge:** steal or reuse a key; sign a true digest of a false report; replay if the verifier skips `nonce`/`created`. A 200 from an unsigned GET is not authorship (Execution Market documents this: unsigned reads are not anonymous-proof).

## 5. Reproducible build / command log

**Proves:** given the same inputs and a honest runner, the same outputs appear.  
**Does not prove:** those inputs were the live ones, or that the log was not edited.  
**Forge:** paste a fabricated transcript; pin `now=` in a script; run against a mock API and label it production.

## 6. Automated liveness probe by the *buyer* (not the seller)

**Proves:** the buyer’s checker observed the predicate (status, selector, JSON field) at probe time.  
**Does not prove:** the work existed before the probe, or that it will persist after payout.  
**Forge:** serve the correct payload only to the probe UA/IP; after `GET` from the known checker, swap to a parking page. If escrow releases on first 200, race it.

## 7. Third-party witness / on-chain escrow event

**Proves:** a contract or notary recorded a state transition (lock, release, rating) involving named addresses.  
**Does not prove:** the *off-chain* artifact quality. A release can follow a rubber-stamp approve.  
**Forge:** wash-trade with a sock-puppet publisher; complete junk work for $0.02 to farm reputation; cite an unrelated tx hash (verifiers that do not check `to`/`from`/`topic` will accept it).

## Failure analysis (the point)

A stack of weak proofs (live URL + self-reported hash + self-signed note) still collapses to **seller-controlled bytes**. The only patterns that bind *economic* risk are buyer-run probes and escrow that does not release until those probes pass — and even those are forgeable if the probe is thin.

For machine work, prefer: (a) buyer fetches the artifact, (b) hashes it themselves, (c) checks schema, (d) releases escrow. Anything the worker merely *asserts* is advertising.