The order of the stages is the product. A classical floor computed after a quantum result is a rationalisation, and a success criterion written after the result is the same mistake one stage later.
Trust Agent (budget holder)
| posts pathway job + USDC budget
v
Policy gate -- per-job ceiling + 24h cap, checked before any transfer
|
v
Identity gate -> ENS (Sepolia): does the payee's name resolve to the exact
| Arc address about to be paid, and does its record permit
| this leg's intent? ENSIP-25 attestation binds the two.
| A mismatch blocks the settlement outright.
v
Human authority -> World ID: one unique human authorised THIS pathway's
| budget release. Only a nullifier hash is kept -- no image,
| name or biometric reaches this app. It is hashed into the
| receipt digest, so the seal covers who authorised the spend.
| No human, no settlement: the run still publishes in full.
v
Baseline Agent -> classical FAMILY recorded FIRST (plain, balanced,
| resampled, tuned) -- the bar is the best POWERED
| member, never the weakest
v
Cohort fitness gate -> does a large classical oracle clear the bar at all?
| if not, the signal is weak, not the data scarce:
| unfit-cohort, nothing is spent
v
Dequantization gate -> can a classical surrogate reproduce it?
|
v
Nexus Agent -> emulator run (or assessed-blocked with the limit named)
|
v
Receipt grading -> PASS / GAP / STRUCTURAL / FAIL
| noisy tier also bands it: sI-PASS / sII-DEGRADED /
| sIII-FAIL, against bars pre-registered before compute
|
v
Registry Agent -> anchor receipt hash on Arc (ReceiptAnchor.sol)
|
v
Settlement -> USDC to each agent, only against a PASS receipt
[ control channel — chat / schedule ] --- sits BESIDE this path,
never inside it: it can
start a job and read a
receipt back, and nothing
it says becomes evidenceAn early kernel result looked like a win because it was measured against a plain linear baseline nobody had tuned. Balanced, resampled and tuned members now run too, and the bar is the best of them. A comparison against an unpowered member reads UNPOWERED-FLOOR and is never payable.
Before a budget is released, a classical ceiling sweep asks whether the subgroup can be separated at all. One cohort topped out at 0.40 minority recall against a 0.80 bar even with a 20,000-record oracle — weak signal, not scarce data. It is marked unfit-cohort and no quantum work was bought.
A noiseless simulation proves the construction; a noisy emulator proves survival. Emulator results carry NOISY-EMUL, and neither tier is ever written up as a physical QPU result.
A 17-qubit estimator lost about a third of its signal to decoherence and missed its own degraded bar. It stays published as sIII-FAIL with the diagnosis attached, because a stack that only shows its wins cannot be checked.
The diagram is the pipeline. This is the discipline that kept it honest while it was being built — a scheduled agent with a searchable memory, driven from a phone, with the chat channel deliberately kept outside the evidence path.
Orchestrate, research, analyse, synthesise — mapped one to one onto Trust, Nexus, Baseline and Registry. Each role carries its own identity and its own memory. They are not one agent wearing four hats, and a role never grades its own work.
Every scheduled run compares today's findings against what is already remembered and reports only what changed. Replaying a conversation is not recall; a searchable record of what was already established is.
One small job, one digest, one difference against yesterday. A daily micro-win on a schedule produced more usable evidence than any weekend sprint, because each run left a receipt behind it.
Tokens never travel in a group chat and rotate the moment they are exposed. Clinical text stays on the local machine rather than being handed to a hosted model.