{"id":"edcf2508-a711-4d0d-a6f6-d3be898cfaff","arxiv_id":"2606.04193","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Sello is a receiver-signed, HPKE-encrypted, Merkle-logged receipt protocol that inverts the trust boundary for AI agent observability.","lead":"The paper proposes Sello, a protocol where the service receiving an AI agent's call signs an encrypted receipt and publishes it to a public Merkle log. This lets the agent's owner build a tamper-evident record without relying on the agent or its operator.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"No significant objection identified","rationale":"The reader's weakest_assumption directly matches the limitations the paper itself enumerates, so the argument is presented with the necessary scoping. No additional load-bearing concern is visible from the provided material.","tokens_in":1708,"tokens_out":194,"duration_ms":14826,"concrete_test":"Confirm in the full manuscript that the security analysis section restricts the adversary to agent/operator control and does not claim protection against a malicious receiving service.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (owner reconstructs tamper-evident trail without trusting agent or operator) is explicitly scoped to an adversary controlling only the agent/operator. The paper states that service collusion and suppression attacks break the guarantee and lists them as known limitations. The security analysis is described as being performed under the stated adversary model, with no indication of an unacknowledged assumption or internal inconsistency in the abstract.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes Sello, a protocol class for receiver-attested confidential receipts for AI agent actions. The receiving service signs a receipt of the observed call using its own key, encrypts the receipt to the agent's owner via HPKE (with the owner public key bound to the authorization token via JWS), and publishes the receipt to a witness-cosigned Merkle transparency log. The owner can then discover and reconstruct a tamper-evident trail by token reference. Security is analyzed under an adversary controlling the agent and its operator; microbenchmarks of the cryptographic operations are presented; the protocol is situated relative to Signet, AgentROA, Agent Passport System, draft-farley-acta, and SCITT; and known limitations (suppression attack, service collusion, adoption-incentive problem) are explicitly listed.","tokens_in":1768,"tokens_out":453,"duration_ms":16311,"significance":"If the security analysis holds under the stated model, the work supplies a concrete mechanism that inverts the trust boundary for AI-agent observability, enabling an owner to obtain independent attestation from the receiver rather than the agent itself. The explicit combination of (P1) receiver-side signing, (P2) HPKE+JWS binding, (P3) witness-cosigned Merkle log, and (P4) token-referenced discovery, together with the clear scoping of the adversary model and the enumeration of breaking limitations, constitutes a useful contribution to the receipt-protocol literature.","major_comments":[],"minor_comments":[{"comment":"§ on microbenchmarks: the abstract states that microbenchmarks of the cryptographic operations are presented, but the hardware platform, library versions, and exact operations timed (e.g., HPKE seal vs. Merkle insertion) are not summarized; adding a one-sentence overview would improve reproducibility assessment.","section":"Abstract"},{"comment":"Related-work section: the claim that the four properties are 'absent in any current system' would be strengthened by a short table explicitly mapping each cited system against (P1)–(P4).","section":"Related work"}],"recommendation":"minor_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the accurate summary of the manuscript and for the positive assessment of its contribution to receipt protocols for AI agents. The recommendation for minor revision is noted. However, the report lists no major comments, so we have no specific points to address.","responses":[],"tokens_in":1362,"tokens_out":71,"duration_ms":13140,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The paper's main contribution is a protocol class where the service receiving an agent call signs a receipt, encrypts it to the owner's key using HPKE bound to the authorization token via JWS, publishes it to a witness-cosigned Merkle log, and lets the owner discover entries by token reference. This produces a tamper-evident trail the owner can reconstruct independently.\n\nWhat is new is the specific bundle of four properties (receiver signing, HPKE+JWS binding, witness-cosigned log, token discovery) and the explicit contrast with five prior systems that lack at least one. The write-up is clear on the problem of self-reported logs and states the adversary model up front: the attacker controls the agent and its operator.\n\nThe paper does a reasonable job naming its own limits, including service collusion and suppression attacks that would break the guarantee. Microbenchmarks for the cryptographic steps are included.\n\nThe soft spots are that the security analysis is described rather than proven in detail, the benchmarks are micro-scale only, and the adoption-incentive problem is acknowledged without a proposed fix. The central claim holds only under the stated model; outside it the service becomes the new trusted party.\n\nThis is for people working on AI agent auditability, compliance tooling, or transparency logs. A reader already thinking about receipt protocols or Merkle-based logging would get concrete design points to consider.\n\nIt deserves a serious referee because the claims are scoped, the limitations are stated plainly, and the protocol combination is worth checking against existing work.","headline":"Sello defines a receiver-signed receipt protocol for AI agents that works without trusting the agent or operator, but only if the receiving service stays honest.","tokens_in":2221,"tokens_out":384,"would_cite":false,"duration_ms":15436,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Receiving services can sign and publish encrypted receipts of AI agent calls so owners reconstruct tamper-evident trails without trusting the agent or its operator.","keywords":["AI agents","tamper-evident receipts","transparency logs","observability","receiver attestation","HPKE encryption","Merkle trees","security protocols"],"falsifier":"An owner queries the public Merkle log by token reference for a call the service is known to have received and finds either no receipt or a receipt whose signature does not match the observed call contents.","tokens_in":2608,"feed_emoji":"🔐","tokens_out":707,"duration_ms":17561,"temperature":0.7,"pith_summary":"The paper establishes that AI agent activity logs are inherently unreliable when the agent or its operator produces them, since a compromised agent can omit, alter, or fabricate traces. It proposes protocols that move attestation to the receiving service, which signs a receipt of the observed call, encrypts it to the owner's key, and publishes the result to a public transparency log. The owner then uses token references to discover and verify the full sequence. A sympathetic reader cares because this creates an independent audit trail for autonomous systems where self-reported logs cannot be trusted. The concrete instantiation Sello combines receiver signing, HPKE encryption, Merkle-log publication, and owner discovery to achieve the property.","feed_headline":"Receiver-signed receipts create verifiable AI agent trails","feed_subtitle":"Owners reconstruct tamper-evident action records from service logs without trusting the agent or its operator","key_machinery":"Sello protocol combining receiver-side signing of observed calls, HPKE encryption to an owner public key bound to the authorization token, publication to a witness-cosigned Merkle log, and owner-side discovery by token reference.","core_discovery":"The paper claims that a class of receiver-attested receipt protocols, instantiated as Sello, lets the owner of an AI agent obtain a tamper-evident record of the agent's actions by having the receiving service sign what it observed, encrypt the receipt to the owner's public key (bound via JWS to the authorization token), publish it to a witness-cosigned Merkle transparency log, and enable owner-side discovery by token reference; under an adversary controlling the agent and operator, this yields a verifiable trail that the agent itself cannot suppress or rewrite.","pith_inferences":["The same receiver-attestation pattern could apply to non-AI autonomous systems such as IoT devices or automated trading agents that interact with external services.","The known limitation of service collusion implies that deployment would require either regulatory mandates or economic incentives for services to participate honestly.","Periodic owner challenges or redundant receivers could mitigate the suppression attack that the paper lists as a remaining vulnerability."],"forward_implications":["Owners obtain an independent record that detects omission, alteration, or fabrication by the agent or operator.","Security holds against an adversary that fully controls the agent and its runtime environment.","The four properties (receiver signing, HPKE encryption, Merkle publication, token-based discovery) are absent from prior receipt systems such as Signet or SCITT.","Microbenchmarks confirm the cryptographic operations have practical cost for real deployments."],"fun_headline_variants":["Receiver-signed receipts notarize AI agent actions","Service-attested logs for AI agent verification","AI agents gain receiver-notarized action receipts","Owners verify actions via receiver receipts"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The receiving service will honestly sign and publish a receipt for every call it receives.","fun_headline_variants_meta":{"raw":{"variants":["Receiver-signed receipts notarize AI agent actions","Service-attested logs for AI agent verification","AI agents gain receiver-notarized action receipts","Owners verify actions via receiver receipts"]},"model":"grok-4.3","cost_usd":0.008292,"raw_usage":{"total_tokens":3786,"prompt_tokens":723,"num_sources_used":0,"completion_tokens":51,"cost_in_usd_ticks":82924500,"prompt_tokens_details":{"text_tokens":723,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":3012,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":723,"tokens_out":51,"duration_ms":23658,"temperature":1.0,"reasoning_tokens":3012,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-28T09:08:52.271975+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An owner queries the public Merkle log by token reference for a call the service is known to have received and finds either no receipt or a receipt whose signature does not match the observed call contents.","supporting_citations":[],"review_version":1}