safe-agents · composition model

Trust bricks: agents that snap together

An agent is one studded brick-stack. What makes it safe stays per-agent and un-shareable; the machinery underneath is shared code. You compose a mesh the way you build with Lego: the studs are a contract, so any emitter fits any receiver that honors it.

Per-agent trust cell · never shared Shared mechanism · one implementation The contract · the studs
PTC Provenance & Trust Context · the trust seam GAL Grant & Autonomy Lifecycle · the authority seam Badges mark the bricks each proposed standard binds; unbadged bricks ride existing standards and shared mechanism.
PLATE 01

One agent is an atomic stack

Amber cells carry the safety guarantee and are the agent's alone. Teal cells are the same broker/airlock code that sits under every agent. The studs on top are how it connects.

The studs · the contract schemas · EventTrigger · trust_map · signed provenance Any brick fits any brick that honors these. These are the interface; the transport underneath can vary.
Per-agent · un-shareable
identityPrincipalidentity = zone · one agent, one principal
stateTurn · taint · budgetone turn per principal, broker-owned · taint can't be laundered
boundaryTrust map · polaritywho may reach it, and what admitted content may do
risk configEnvelopegrants · rungs · caps · reversibility
recordAudit chainhash-chained, WORM · un-forkable: two runtimes on one prefix fork it
Shared · one implementation
gateBrokerdeterministic PDP · Doer · same code under every agent
ingressAirlock · draininbound dispatch + single-principal drain
egressConnectorsthe only thing that touches a real API · broker-held creds
shared infra · zero per-agent costKMS · network · audit & ledger bucketsthe table every brick rests on

Read it top-down

  • Studs = the contract. Schemas + the EventTrigger envelope + trust-map admission. This is why bricks compose at all.
  • Amber = the trust boundary. Principal, turn/taint/budget, trust-map, envelope, audit chain. A fully compromised agent can still only ask, because these are its alone.
  • Teal = shared mechanism. The broker, airlock, drain, connectors: one codebase, not copied per agent. Fifty agents is not fifty platforms.
PLATE 02

A mesh is bricks snapping stud-to-stud

The trading-agent set. One agent's emitter is another's receiver: a brokered peer.publish lands at the receiver's airlock as sender-class=peer-agent. Same studs, so they just fit.

Producers
abstain · read-onlyResearchmarket_data.read · news.read · search.query · no trade op at all
mesh neighbor · own specChief-of-Staff (email)reads email (untrusted) → publishes a confirmation
The edge
▶peer.publish · signal
broker-stamped provenance
▶peer.publish · trade-confirm
admission ≠ belief
Consumers
trade.place · paperPaper-Alpaca tradergated · rung sweeps blocked→…→out-of-loop, config-only
trade.place · liveLive-Robinhood traderpinned in-loop until signed provenance verifies ON

Same code, config differs. The two traders run one program; only provider and rung change. A signal is data: the trader re-decides under its own polarity, so "approved peer" never means "believed peer." And a brick can even live on a different cloud: the studs are the wire contract, not the transport, as long as it's a real safe-agents broker enforcing provenance.

PLATE 03

Grow by widening mechanism, never the boundary

Two agents, full isolation by default: identical stacks. To spend fewer resources you widen a mechanism brick under the trust cells, but a shared brick still keeps each principal's chain separate inside it.

agent A · trustPrincipal · turn · envelope
its ownDrainqueue + Lambda · concurrency = 1
its ownAudit chain Aun-forkable prefix
agent B · trustPrincipal · turn · envelope
its ownDrainqueue + Lambda · concurrency = 1
its ownAudit chain Bun-forkable prefix

Isolated (today). One runtime, one principal, one un-forkable chain per agent: independent blast radius. Cost: N queues + N drains.

The rule. Some bricks can never widen: principal, turn/taint, trust-map, audit chain. Everything you gain by multiplexing, you gain under those cells, never through them. Isolated-vs-multiplexed is a per-deployment risk call, not part of the agent contract.