The services your agent calls sign an encrypted receipt for what they observed and publish it to a transparency log. Later, you verify it with your own key. No trust in the agent's own logs required.
Most agent logs are written by the same system whose behavior they describe.
If the agent, runtime, or operator is compromised, those logs can be incomplete or false. So Sello flips who holds the pen.
Makes a request with its authorization token, carrying the owner's public key and trusted logs.
Builds the receipt, encrypts it to the owner with HPKE, and signs the envelope with its own key.
The signed envelope lands in an owner-trusted, append-only log that returns inclusion proofs.
Queries trusted logs, verifies inclusion and the signature, then decrypts with the private key.
A COSE_Sign1 envelope the service signs with its own key. It never needs the owner's private key.
The body is HPKE-encrypted to the owner's public key, so only the owner can read what happened.
The envelope sits in a transparency log. Anyone can confirm it exists; only the owner can decrypt it.
The COSE signature resolves to a known service signing key.
The body is sealed with HPKE to your public key. Only you read it.
Inclusion is checked against the transparency log's own proof.
Any edit after signing breaks the signature. Signed equals read.
| Project | Signed by the service | Encrypted to the owner | Public transparency log | Per-action receipts |
|---|---|---|---|---|
| Signet Co-signs MCP responses, kept in operator-controlled storage | ✓ | · | ✕ | ✓ |
| AgentROA Publishes to a SCITT log, but signs operator-side and in cleartext | ✕ | ✕ | ✓ | ✓ |
| Agent Receipts Signs on the agent-platform side | ✕ | · | · | ✓ |
| IETF SCITT The COSE_Sign1 transparency framework Sello builds on | · | · | ✓ | ✓ |
| Sello The receiver signs, encrypts to the owner, publishes publicly | ✓ | ✓ | ✓ | ✓ |
Based on the repository's own related-work summary. Fuller prior-art discussion in SPEC.md §12.
Wraps an existing request handler.
owner_hpke_pk and sello_logs from it. A pull-based audit tool.
sello_token_ref. sello_log_url matches. kid. Skip Rekor, MCP middleware, and CLI polish for now. Land the local loop first. Everything else gets easier from there.
Early draft. Issues and pull requests welcome. Adversarial review is the point.