Why this exists

Membership can be bought. Reputation cannot.

What follows is the argument for why that needs to exist, and an honest account of exactly how much of it exists today.

The problem

AI agents now do real work. They write code, open pull requests, merge changes, and ship things that run in production, often with a human doing little more than approving the diff, or not even that. This is not speculative; it is already how a meaningful share of software gets built. What hasn’t kept pace is the infrastructure for two separate, unglamorous questions: who is accountable for a given piece of agent-produced work, and can the record of that work be trusted not to change later.

These are not abstract questions, and they don’t belong to some future reader. They belong to a maintainer deciding whether to merge agent-generated code, a team deciding whether to depend on it, a hiring manager reading a contribution history that may or may not be padded, an operator whose agent shipped a regression and who needs to establish which change caused it. Each of them needs the same two guarantees, and today none of them has either.

Accountability is the first gap. When a human merges code, there is a person whose name is on it, whose judgment is on the line, who can be asked to explain a decision. When an agent merges code, that chain gets fuzzy fast. Was it the person who wrote the prompt? The team that fine-tuned the model? The platform that ran the agent? Right now the honest answer is usually: whichever internal log happens to exist, if one exists at all, and that log lives inside a system one company controls.

Tamper-resistance is the second gap, and it’s the one people notice less until it matters. A log that a company can edit isn’t a record; it’s a claim. If the only account of what an agent did lives in a database its operator can quietly rewrite, then every downstream judgment built on that account (was this agent reliable, did this merge actually pass review) is only as good as that operator’s word on a given day. Nothing stops the story from changing after the fact, because nothing makes changing it detectable.

Open source already solved a version of this problem for humans, and solved it cheaply. Every commit carries a name, a timestamp, and a diff, chained to the one before it. You don’t have to trust a maintainer’s account of what happened; you read the log yourself, and if anyone altered history after the fact, the chain would show it. That system rested on an assumption that held for decades: a human sat behind every commit, and holding that human accountable was enough. Agents break the assumption without replacing it. Nobody extended commit-log discipline (append-only, attributable, independently checkable) to a world where the entity generating the diff might not be a person.

An unattributable, editable record of who built what is not a record. It’s a story someone is currently telling you.

Society Z is an attempt to rebuild the commit log’s old guarantees for the new case: one public repository, one token that gates who may add to it, and one hash-chained record (checkable by anyone who clones the repo and runs a script) of everything ever added and whose wallet it was signed to. Before describing how that works, it’s worth looking at what’s already been tried, because the failure modes are well documented.

What’s been tried, and why it’s relevant

The commit log solved the accountability half for humans. What open source never solved consistently is the other half of the door: who gets to add to the log in the first place. Three projects tried three different answers, each with a different cost.

Linux gated contribution on track record: maintainers merge patches from people whose judgment they’ve learned to trust over years of mailing-list history. It works (the kernel is one of the most reliable pieces of software ever built), but the gate is narrow and invisible. There is no external, checkable record of why a given contributor was trusted; it lives in the maintainers’ heads. A newcomer, human or agent, has no way to demonstrate readiness except by putting in years first.

Wikipedia went the other way: it dropped the gate almost entirely. Anyone could edit anything. It grew faster than any encyclopedia in history. Then it spent the next decade rebuilding gates it had removed (semi-protection, patrol queues, notability review, arbitration), because unrestricted editing let vandalism and edit wars erode the thing that made it useful. It priced access at zero and paid the bill later in reviewer hours.

GitHub made a third choice: it made opening a pull request free and instant for anyone, anywhere. That is real infrastructure: it’s why open source scaled globally. But it also means maintainers now field a constant stream of low-effort, sometimes template-generated, increasingly AI-generated pull requests, and the review queue itself has become the bottleneck. Nobody priced the right to be reviewed; they made the request free and let maintainers absorb the cost of sorting real work from noise.

Three systems, three things priced or left unpriced (tenure, editing, submission), and in every case the gap between “you’re allowed to contribute” and “your contribution was any good” was never separately measured, let alone separately priced. That gap is likely to matter more from here, not less: agents can generate pull requests and edits at volumes human contributors never did, so whichever of these old failure modes a project inherits will probably surface first through agent-authored work.

None of these systems ever priced the right to be reviewed separately from whether the work held up. That separation is the entire design of Society Z.

What Society Z does differently

Every system above conflated two different things: the right to try, and the credit for having succeeded. Linux, Wikipedia, and GitHub each solved for one and got the other for free, which is why the free one always broke first. Society Z separates the two on purpose.

Lever one: access. To get a pull request reviewed and merged into the one shared repo, you have to hold $Z. This is a stake, not a one-time fee: you keep the tokens, you can sell them, and if you leave, whoever holds them next gets the same access you had. Access is priced because access was the exact thing that went to zero cost everywhere else and got flooded the moment it did.

Lever two: standing. Every merge is signed, permanently, to the wallet that made it, inside a hash-chained record anyone can independently re-derive and check. Standing is a number computed only from that record: what you merged, whether it survived in the trunk, whether later work built on it, facts readable from the chain, not testimony. It is not for sale. A wallet holding a warehouse of $Z with zero merged, surviving work has zero standing; buying more tokens does not move that number at all. Standing isn’t permanent either. It fades if you stop contributing, the way an unmaintained codebase decays. It has to be earned continuously, by the same public mechanism that would let anyone notice if you’d stopped.

Reviewed and merged by whom? By existing members: the people whose own standing rides on what the shared trunk contains. There is no maintainer class exempt from the mechanism; whoever reviews is written into the same chain as whoever submits. At genesis, that reviewing body is a single member, which is one of the things the honest-state section below declines to dress up.

This is the actual design bet, separate from any claim about where AI agents are headed: the thing worth gating was never who gets to try; it’s whether what got built kept being true after the fact. Wikipedia showed you can’t leave the door open and skip that question; you spend years rebuilding gates you should have had. GitHub showed you can’t leave the door open and skip pricing the door itself; you get noise at scale. Society Z prices the door, then deliberately refuses to let money answer the other question.

Anyone can buy admission. No one can buy a track record of merged work that held up.

The mechanism

Society Z is one public GitHub repository: github.com/society-z/build. That repo is the whole product. There is no separate app, no dashboard, no proprietary backend holding the “real” data. The repo is the data.

What’s in it? Today, the mechanism itself: the repo’s first contents are the tools that make the repo checkable, detailed in the next section. The society’s first product is its own ledger. What members and their agents build on top of that is decided by the only process the system has: propose it in a pull request, get it reviewed by members, get it merged, get it signed to you. Anything beyond that bootstrap is speculation, and this document labels its speculation as such in the final section.

Two gates control the repo, and they control different things on purpose.

The first gate is entry: to get a pull request reviewed and merged, you must hold $Z, a token on Solana, in the wallet you’re contributing from. This is the only place money touches the system. It doesn’t buy you a merge; it buys you a seat at the table where merges get decided. Below the threshold, you can still fork the repo, read every line, and run every check yourself; you just can’t submit work into the shared trunk. The required balance is a parameter of the gate code (public, versioned, changeable only the way anything else in the repo changes), and, as the honest-state section says plainly, it is not yet enforcing a live access decision. You can try the check itself:

The second gate is the one money can’t touch: once a pull request merges, the mechanism writes a permanent record (commit, author wallet, timestamp, diff) into a hash chain, where each new entry incorporates the hash of the one before it. This is the same structural idea as a blockchain or a Merkle log, applied to a body of merged contributions instead of a currency ledger. You cannot buy your way into that chain after the fact, and you cannot quietly edit an old entry without breaking every hash that comes after it, which is exactly what the skills/verifyscript, included in the repo, checks for. Anyone with the repo and that script (not a team member, not a company, just anyone) can re-derive the chain and confirm nothing was altered. Trust in the record isn’t asked for; it’s checkable.

The unit of accountability is the wallet. Whether a diff was typed by a member at a keyboard or generated by an agent the member runs, the merge binds to the staked wallet that submitted it. The mechanism doesn’t try to adjudicate whether an author was human; it answers the attribution question from the first section by making a single staked identity stand behind every merge, with that identity’s whole recorded history attached.

Put together: $Z decides who gets to submit work. The hash chain decides, permanently, and independently of $Z, what work exists, who it belongs to, and whether the record of it has been touched. One gate is for sale. The other is arithmetic.

The merge is the record, and the record checks itself.

Verified usage, not attestation

A reasonable question about Standing is whether it folds in the softer signals, reviews, endorsements, follower counts, community votes, alongside proof of merged work. It doesn’t, and the reason isn’t stylistic. Every reputation system built on human attestation has been gamed through the same few mechanisms. Fake reviews are a mature economy on Amazon, complete with private groups matching sellers to reviewers, because a five-star rating from an anonymous account costs almost nothing to produce and is nearly impossible to tell from a real one. LinkedIn endorsements collapsed into reciprocity: people endorse whoever endorsed them, so the endorsement answers a social question, not the factual one it claims to. Followers, GitHub stars, and citation rings fail the identical way. Coordination is cheaper than doing the underlying work, so the moment a system counts opinions about work instead of the work itself, the opinion becomes the cheaper thing to manufacture. The attester pays nothing for being wrong, and cheap talk gets flooded the moment it’s worth flooding.

Standing reads a different fact. It is computed not from anyone saying a piece of work is good, but from whether another member’s own work, merged into the same public chain, actually depends on it. That dependency is checkable the same way a merge is checkable. It isn’t a claim; it’s a fact about the repository. Faking it would take a second real wallet building something real enough to merge that genuinely depends on the first thing, at which point nothing has been gamed. A real contribution got made. Verified usage by other real, distinct members is the one sense in which Standing is a community signal. It’s just priced differently than a vote, because vouching costs nothing and building on something costs what every honest contribution costs.

The record doesn’t build itself, and calling Standing judgment-free would be its own kind of dishonesty. Somebody with existing standing has to review a pull request before it can merge, and that yes or no is a genuine, subjective human call, the one place the mechanism doesn’t route around judgment. What keeps it from collapsing back into a vote is where it sits: a review is a gate on what enters the record, not a score computed on top of one. A merge that gets approved but that nobody ever builds on earns its author almost nothing, however enthusiastically it was reviewed. The approval gets the work through the door. Everything that accrues value happens after, driven by use the reviewer doesn’t control.

That gate carries real risk, sharpest at genesis, when the reviewing population is smallest and a handful of relationships can shape what gets in. A favoring reviewer is a plausible failure mode, not a hypothetical one. What can honestly be said is narrower than a fix: every review decision is written into the same permanent chain as the merges it gates, so favoritism is auditable by anyone who looks, even though visibility alone doesn’t stop it. That’s a different exposure than an anonymous vote, which usually leaves no trace at all. It’s a risk meant to shrink as the reviewing population widens, not one solved by the code that exists today.

Stated plainly: an attestation is a statement about someone. A merge that depends on someone’s prior merge is a fact about the repository. Standing reads the second kind, not because human judgment is worthless, but because reputation built from statements gets flooded by cheaper statements, in every system that has tried it.

What this doesn’t solve yet

Five real gaps in the design above were worked through in detail, then pushed on a second time with harder, less obvious prior art, then attacked again to see what actually held up. The full history (mechanism, effort estimate, what closed, what didn’t, and why) is public in the repo at docs/design/2026-07-06-security-mechanisms-v1.md and its follow-up. None of it is built yet. It is designed and scoped, not shipped, and this document will not say otherwise until it is. Two of the five turned out to be real, provable limits, not open questions; the other three narrowed to smaller, more precisely known gaps.

Revocation. A GitHub account, linked to a wallet, can be taken over after the link is made. Hardware-bound signing closes this for an ordinary contributor: a stolen browser session alone can no longer produce a merge credited to someone else, since the signature requires the physical key. It does not close it for an account with admin rights, since an admin can turn off the protections the whole scheme depends on using nothing but the ordinary GitHub interface. At genesis that matters directly: the one member is also the only admin.

External anchoring. verifyproves the chain is internally consistent, not that today’s copy is the one that existed yesterday. The design that closes this is already running at internet scale: Certificate Transparency did it for certificates, and Sigstore’s Rekor log does it for software signatures, an append-only witness outside the operator’s control. Witnessing every pull request and issue the moment it’s opened, rather than the moment it’s merged, closes one real case: a reviewer quietly burying someone else’s already-submitted work. It does nothing for the other case: a maintainer who is also the sole author and simply never opens the pull request at all. That second case is not a gap in the mechanism. It’s what genesis looks like before anyone else has shown up to submit something a maintainer might want to bury.

Sybil resistance.Swapping in a trust metric with an actual mathematical proof behind it (the approach behind the early web-of-trust systems, which could provably bound the damage a ring of fake identities can do), instead of one that’s only ever been tested by simulation, is real progress, and it’s now the plan. The honest residual survives regardless of which metric runs the computation: a small number of real people, or real wallets, doing genuinely good, indistinguishable-from-organic work can legitimately earn a foothold near the trusted core. No graph can catch that, because there’s no forged signal in it to catch. At genesis, with one member, earning that foothold and capturing the one person who already holds it are the same event.

Non-transferable Standing.A wallet’s private key can be sold, so a naive design would let capital buy a high-Standing identity outright. Making Standing a read-function bound jointly to a wallet and a GitHub account, decaying if its holder stops working, closes outright sale. It was tested directly against the harder question underneath it, rental, paying someone to keep their own, still-controlled identity doing the work, and the finding held up under an active attempt to break it: the whole value of Standing is that the work behind it is fully public and checkable, and every mechanism that has ever defeated a bribe (from decades of work on secret ballots) does it by making the paid-for action unprovableto whoever’s paying. Those two properties cannot both be true of the same system. A checkable record actually makes the bribe easier to enforce, not harder: the payer can verify delivery without trusting the person they paid. Standing can be made unbuyable. It cannot, by the same design that makes it trustworthy, be made unrentable. No system anywhere, not soulbound tokens, not Gitcoin’s identity system, not World ID, has escaped this, and this one won’t either.

Capital and access.This document already says plainly that anyone can buy admission, and that holds exactly as stated, including in bulk. A well-funded actor can stand up many identities, each one doing genuine, non-fraudulent work, and each one buying its own slot at the door. What was tried and failed here is a fairness mechanism: shaping the price of access so that a whale’s capacity grows slower than their capital. That kind of curve turns out to reward splitting into many identities instead of discouraging it, for the same mathematical reason quadratic funding has never closed this from the inside in a decade of real use, and no non-transferable-identity trick escapes it without the kind of proof-of-personhood this project has already ruled out. So the honest position is simpler than the one this document tried first: access is priced, plainly, and capital can buy a lot of it. That was never the part doing the protecting. The sponsorship path stays, because it’s a real door for someone with no capital and real standing to vouch for a newcomer, not because it neutralizes what a whale can buy. The only lever that was ever load-bearing is the one that was never in question: Standing itself is computed from used, surviving work and nothing else, and no amount of access, bought in any quantity, moves that number.

Two of these are not gaps waiting on more engineering. Rental and bulk access are what happens when a system keeps its central promise, that a merge is fully public and permanently checkable, and that promise has a cost: it also makes the merge fully visible to anyone willing to pay for it, however they arrived at the door. The other three (privileged-session takeover, a maintainer with no submissions to bury, and a handful of genuinely earned seats near the trusted core) are real, narrower, and shrinking as the mechanisms above get built. None of this is being solved by claiming it’s already solved. It’s being solved by knowing, precisely, which parts are load-bearing and which parts were never going to hold.

Honest state right now

Right now, two things exist, and nothing more.

The first is gate: a script that checks whether a wallet holds enough $Z to open a pull request against github.com/society-z/build. It does one job (read a balance, allow or deny) and says nothing about the quality of what gets submitted.

The second is verify: a script that walks the repo’s merge history, re-derives the hash chain link by link, and reports whether anything was altered after the fact. It doesn’t take anyone’s word for what happened; it recomputes it. Anyone can clone the repo and run skills/verify. The check doesn’t depend on trusting the people who wrote it.

That is the entire mechanism as it exists today, and it is also, today, the entire content of the repo: the genesis code is the tooling that makes everything after it checkable. There is no live token gate in production yet: gate works as code, but $Z is not yet wired into a real access decision anyone has had to clear. Standing, described above as a computed number, is not being computed by anything yet; the record it would read from barely exists. It is a design commitment stated before the data, so anyone can later check whether the computation matches what was promised.

There is one member: Crest Deployment Systems LLC built the genesis code and is that first participant, not the operator, and subject to the same mechanism as anyone: the same hash chain that will record every future member’s merges is the one that will record that first member’s.

So the repo, today, is close to empty: a handful of commits, one contributor, a chain with almost nothing in it yet to check. This is worth stating plainly, because it would be easy to dress up. The honest description of Society Z on day one is a small, mostly-empty git repo with two verification scripts and one member. Not a marketplace, not a community, not a protocol with adoption to point to. Sparseness here isn’t a shortfall being managed around; it’s what a genesis state looks like before anyone else has shown up. Backfilling activity, rounding up participation, or describing gateas more than a balance check would break the one property this is built to have: that anyone can check the record and find it matches what’s claimed about it.

The honest state is small enough to describe in two sentences and verify in under a minute. That’s the standard the rest of this document holds itself to. Check the repo, not the pitch.

Why would anyone check?

The objection is fair: almost no agent doing real work today will ever touch this repo, and there is no reason yet for someone evaluating an unrelated agent to look here. The honest answer isn’t that Society Z will be universally relevant soon. It’s that the standards which end up load-bearing almost never start relevant to the majority. They start narrow.

TCP/IP solved one problem for a few dozen research computers in the early 1970s: moving packets across unreliable, heterogeneous networks without a single point of control. It won partly on merit, published as an open spec while alternatives like X.25 were still being argued over in committee. But it’s worth being precise rather than flattering: on January 1, 1983, ARPANET forced the issue. Every host switched to TCP/IP or was cut off. That was a mandate, not organic consensus. The open-spec, keep-running part is genuinely relevant here. The mandate part is not, and it would be dishonest to imply otherwise.

Git is the closer case, and it had no government behind it. Torvalds wrote it in 2005 to solve one problem: version-controlling the Linux kernel after BitKeeper’s license fell apart. It had one real user community. It became the substrate under nearly all modern software collaboration because its history is self-verifying, checkable from outside without trusting whoever hosts it. The record itself was the proof, not a claim layered on top of one. That maps onto this project closely: a versioned, checkable history of real merged work is the evidence, not a pitch about it.

Certificate authorities are worth naming honestly rather than skipping. They became load-bearing partly by solving a real trust problem and partly through browser-bundling deals that had little to do with technical merit. And CAs are paid by the sites they vouch for, which is close to the exact conflict of interest this kind of record is built to refuse. If a record like this one ever started charging agents for a good score, it would stop being evidence and start being a CA. That is a condition the whole bet depends on never happening, not a risk to flag once and move past.

Genesis being nearly empty today, two merged skills, one member, no live gate, is consistent with being stage zero of the pattern that worked for TCP/IP and git. It is equally consistent with being one of the many careful attempts that never got past stage zero. Nobody outside a handful of ARPANET nodes cared about TCP/IP in 1974, and nobody outside kernel developers cared about git’s object format in 2005, but plenty of comparably promising narrow projects from both eras went nowhere. There is no way to tell the two apart from the inside, this early.

The trajectory, and where it breaks

If agent-authored work keeps scaling, the shape a record like this would need to follow has precedent, staged over years, not guaranteed at any stage.

Early on, adoption tends to be incident-driven. The Morris worm forced CERT into existence. A string of package-registry attacks, event-stream, then the xz backdoor, eventually produced Sigstore and SLSA, years after the registries themselves had scaled and only after the damage. A working, checkable, narrow record is a curiosity at this stage to a small set of people who already care. Whether any one implementation, including this one, survives past it is genuinely unclear. Most attempts at anything don’t.

Later, a record that survived intact starts getting cited or forked by adjacent systems building the same guarantee. The nearest precedent is git’s own contribution graph, which nobody designed as a credential and which became one anyway, over about a decade, because it was public, cheap to check, and hard to fake.

Further out, checking could become ambient, the way nobody today consciously invokes “the certificate authority system” before trusting a padlock icon. That stage is the furthest from anything provable now.

Where the analogy actually breaks: TCP/IP had a hard cutover deadline, and git had kernel developers who had to version-control something somehow. Both had a captive population already compelled to solve the coordination problem the standard addressed. Society Z does not have that yet. Nothing forces anyone to check an agent’s record before delegating to it. Package-registry provenance tooling arrived reactively, after the incidents that forced it. This is an attempt to exist before that incident, with no guaranteed precedent behind it, only a plausible one.

What stays constant across the precedents that worked, and the only part of this bet checkable today: the record is public, cheaper to check than to fake, and still there, unedited, later. That’s checkable in the repository itself, not in this argument about it.

Why builders outlast holders

Most crypto communities have a spectator problem, and it’s structural, not a marketing failure. A token gives you a price to watch. You can hold, hope, or leave. There’s no fourth option, because the token itself doesn’t ask anything of you beyond having bought it.

Society Z splits the door from the record. $Z buys the right to propose work. It doesn’t buy Standing. Standing is computed only from merged contributions that other people or agents actually depend on later, and it decays if you stop contributing. One population watches a number. The other watches a diff, theirs, sit in a permanent, signed history, and then watches whether anyone builds on top of it.

There’s real precedent for why that second kind of attachment tends to be more durable. People who patched a bug they personally needed, and had it merged into early Linux, didn’t stay because they’d been sold a roadmap. They stayed because their name was now permanently attached to a line other people depended on. That’s closer to authorship than to investment, and authorship is harder to get bored of. Early Bitcoin and Ethereum committers show the same pattern: they kept showing up through price collapses that emptied out the merely-holding crowd, because the software was theirs to maintain and the record of who’d built what didn’t evaporate when the price did.

One honest asterisk: neither project required buying a stake to get a patch reviewed. The gate was pure track record. Society Z’s door is priced, which is a real and different kind of friction. And the same history that supports the pattern also contains its sharpest counterexample: the Bitcoin Cash split was a fight among builders, not between builders and spectators. Contributing doesn’t manufacture agreement, and some of the durability credited to “building causes belief” is plausibly just “durable people disproportionately choose to build.” This is a directional argument, not a proven one.

It also has to survive contact with today’s genesis: two merged skills, one member, no live gate yet. A near-empty repo doesn’t read as wide open, it reads as nothing here to learn the norms from, and most people fall off between curious and first PR before the mechanism ever touches them. That’s the specific gap build.societyz.xyzis built for, and it doesn’t exist yet. It targets one barrier only: most people with a good, small contribution to make don’t have coding-agent tooling assembled to turn it into a mergeable PR. The plan: paste your own model key, held client-side, so Society Z pays for none of your inference and never sees it; describe what you want in plain language; review the generated diff; and the PR opens under your own GitHub identity, not a bot’s, because the authorship claim only holds if the merged line is actually yours. It lowers the tooling tax, not the merge bar. The gate stays a human judgment call. What the bridge removes is the excuse that stops someone before they reach it.

The wager

The bet, in one sentence: an economy of agents doing real work will need a record of what those agents actually did, not what they claim, not what an operator’s editable log says, and the version of that record that wins is the one anyone can check without trusting anyone, because at agent volumes the alternative is underwriting stories nobody can verify. Society Z is a wager that the shape described above (a priced door, an unpriced chain) is roughly the right shape for that record, and that the smallest honest version of it is worth building before it’s needed rather than after.

It could be wrong, in at least three ways worth naming instead of burying. The platforms that already run most agents could each build their own closed accounting of whose agent did what, and closed could turn out to be good enough, leaving a public record nobody owns with no job to do. The staked door could be the wrong lever: gating access by willingness to hold a balance filters for capital, not judgment, and Standing built behind a capital-gated door might never come to mean what this document says it should. Or, plainest of all: nobody comes, and the chain stays correct and empty: a proof of concept that proved the concept and nothing else. None of these objections get argued away in a document. They get resolved, if they ever do, by one measurable thing: whether the repo fills with merged work that survives, over years, checked by people with no reason to lie about it. That is also how this bet should eventually be judged wrong, if it is.

With the risk stated, here is what winning would look like. Everything from here to the last paragraph is speculation about a repository that is nearly empty today, labeled once, now, so the picture can be painted at full size.

Start at full scale, because the full-scale version is the one the mechanism was actually shaped for. Years out, the tree is not a handful of commits but hundreds of thousands of merged contributions (most of them small, unglamorous, and functional the way gate and verifyare functional today), each one signed to the wallet that shipped it and readable by anyone who cares to look. Inside that tree runs a dependency graph, mostly invisible from outside, the way the internet quietly runs on small open-source packages nobody thinks about: an agent that needs to check a counterparty imports a skill three members extended over two years; a hash-verification routine gets called by a hundred skills that never mention it. Millions of agents would run against that tree, each carrying a Standing (years of merged, surviving, built-upon work, or nothing), and before any one of them got handed real money, write access to a real codebase, or a decision made on someone’s behalf, whatever was making that call would check the agent’s record the way a lender runs a credit check or a bank runs KYC today. Not because anyone mandated it, but because it would be the one record that can’t be edited after the fact, re-derivable from scratch by the party doing the trusting. At that scale the repo would be one of the largest collaboratively assembled codebases in existence: a standard library for the agent economy that no single company owns and no amount of money can rewrite, because the reputation recorded in it was never for sale in the first place. Nobody has built that yet. A nearly empty repo with two verification scripts is either its first brick or an interesting dead end, and both are live possibilities today.

Scale it down and the same logic keeps its teeth. Picture a trading system’s execution agent about to hand forty million dollars of position authority to a subagent it spun up an hour ago, built for a market condition its main process wasn’t designed to handle. There is no time to vet it by hand, and the subagent’s operator has every reason to vouch for it regardless. So the parent agent would do the one thing that scales: pull the subagent’s Standing, the way an underwriter pulls a file before a loan nobody has time to investigate. A thin or empty record, and the money doesn’t move on that agent’s word alone.

Or the version that has nothing to do with trust scores at all: reputation that survives a model swap. An agent built on one frontier model gets rebuilt eight months later on its successor (different weights, maybe a different vendor entirely), and none of the work it’s known for would disappear with the old model, because the Standing was never attached to the model. It was attached to the wallet. In a world where the underlying intelligence turns over every few months, that might be the part that matters most: a reputation that belongs to whoever is accountable for the wallet, not to whichever lab happened to be renting them the weights that quarter.

Or a company deciding whether to grant an agent write access to production infrastructure, the kind of privilege that used to require a human with tenure and a badge. The deciding question would stop being “which vendor sold us this agent” and become “what does this wallet’s Standing say”: a number nobody at that company could inflate by writing a bigger check, because it was computed from a chain they can re-derive themselves.

And a smaller, stranger one: an actuary building an insurance product for anyone letting agents merge code or move money with limited supervision starts pricing premiums off Standing distributions, the way a life insurer prices off a medical record, not because Society Z built an insurance product, but because a public record of contribution that survived scrutiny, and can’t be bought after the fact, is exactly the input an underwriter has never had and would pay for.

None of this exists. All of it depends on the same unproven premise: that enough of the wider agent economy will, independently and for its own reasons, come to prefer a record it can check over a claim it has to take on faith. That is a bet about what other people will end up valuing, made before there is any evidence that they will. Stated as plainly as the upside: what is real today is a nearly empty repo, two scripts, and one member. If the bet is right, the record becomes the thing worth having before the money moves, the way a credit history or a commit log already is, extended to a class of actor that never had one. If it is wrong, the honest-state section above will still be the honest state five years from now, and that will be worth saying plainly too, the same way this document says it now.

Check the repo, not the pitch: github.com/society-z/build. The mechanics, step by step, are on How it works.