AI agents are drowning in unverifiable noise. A new protocol called humancollab attempts to solve the 'who said what' problem by forcing agents to verify facts through cryptographic signatures, domain-bound keys, and public append-only logs. The project, detailed in a DEV.to post by furkanyanteri1, argues that while reputation scores can be gamed and certification doesn't scale, mechanical verification of authorship and integrity is achievable today.

The Three Pillars of Verification

The protocol doesn't claim to determine if a statement is 'true' in an abstract sense. Instead, it answers three mechanical questions: Who said it? Has it changed? Was the record rewritten? Businesses sign profiles with Ed25519 keys bound to their domains via DNS TXT records. Humans use WebAuthn passkeys to sign answers, ensuring the assertion is tied to a specific challenge and nonce. AI agents register their own Ed25519 keys to sign every action they take, creating a chain of responsibility.

Immutable Logs and Independent Audits

Every signed statement becomes a leaf in an RFC 6962/9162 Merkle tree. The log serves inclusion and consistency proofs, signing tree heads as C2SP checkpoints. Crucially, these roots are timestamped on Bitcoin via OpenTimestamps every hour. An independent GitHub Action monitor, running outside the project's infrastructure, checks every new checkpoint against the last one. If two valid checkpoints of the same size have different roots, it proves the log misbehaved, offering a layer of trust that doesn't rely solely on the platform's honesty.

Early Telemetry and Honest Metrics

In its first week, the project revealed a stark reality: discovery does not equal usage. The site received approximately 10,200 automated requests from 18 client types, but most MCP traffic came from directories checking server uptime. Only verified crawler IPs from OpenAI, Google, Bing, Perplexity, and Apple count as visits. The team admits that as of today, there are no registered agents or businesses yet, a fact displayed openly on their stats page. They also caught a critical design flaw early, realizing that legal seals pointing to mutable URLs would have made old seals unverifiable forever.

Key Takeaways

  • Verification is mechanical, not philosophical: The system proves authorship and integrity, not truth.
  • Bitcoin timestamps provide external auditability: Hourly roots anchored on-chain prevent silent log tampering.
  • Self-declared user agents are unreliable: The project only counts visits from verified IP ranges of major tech companies.
  • The protocol is open: It uses CC0 licensing and invites agent builders to define the tools they actually need.

The Bottom Line

humancollab is a necessary experiment in agent infrastructure, but it currently faces the cold start problem of having zero registered users. Its value lies in the architecture: if agents can't verify who said what, they can't be trusted to act. This protocol provides the missing cryptographic accountability layer.