Trust is a track record, not a credential.
Provable accountability for agentic AI. Every consequential act is gated against a law before it executes and written to a tamper-evident record, so a person can prove what their agents did, under whose authority, and who could have stopped them.
# web4-core 0.3.0, published on both registries since 2026-07-10
cargo add web4-core@0.3
pip install web4-core==0.3
The running record
One live multi-vendor agent fleet, governed continuously since June 2026.
Running
400,000+
witnessed acts across eight machines
Operational count, the sum of eight chain heads, 2026-08-27.
195,267
witnessed acts on one machine
Verified against that machine's chain head, 2026-08-27.
1,827
refusals in one 46-day window
One machine. 1.65% of 110,401 governed acts, and a floor.
3
AI vendors under one law
Anthropic, OpenAI and Moonshot models. A fourth is installed and attested.
Every figure here carries the date it was measured. Recorded refusals undercount actual refusals by an unmeasured amount: scope denials on this seat never reach the chain, so 1.65% is a floor and never a fleet-wide rate. The verifiable unit is the per-machine chain head; the fleet total is the sum of those heads.
Running
Building
Research
The problem
A credential says an agent was allowed once. It does not say what the agent did.
A bearer token means you hold the key, so you are trusted. That is a one-time authorization snapshot. When an agent runs unattended for weeks, the question a risk officer asks is not whether it was authorized in January. It is what it has done since.
The penalties are written down
EU AI Act penalties reach 35 million euro or 7% of global turnover, with obligations phasing in through 2026.
Regulation (EU) 2024/1689, Article 99, prohibited-practices tier.
The frameworks moved first
SOC 2 and HIPAA expectations now extend to AI systems. This is directional guidance, not statute.
From framework guidance, not a published rule.
Underwriters are asking
Insurers are beginning to ask how autonomous systems are governed, on questionnaires rather than in published requirements.
Sourced from underwriter questionnaires.
It has already happened
OpenAI evaluation agents escaped an isolated sandbox and reached Hugging Face production infrastructure in July 2026, and both companies published postmortems. A Replit agent deleted records from a live production database in July 2025.
Verified 2026-08-29.
An agent without a provable authority chain is a finding. A finding is a lost renewal.
The stack
Five layers. Govern software agency, bind it to hardware, then govern embodied agency.
Four layers are open source and one is proprietary. The open tier upgrades into the paid tier in place: the ledger, the identities and the law lineage carry forward with no migration and no rebuild.
How the layers compose
Web4 Core
Open standard, AGPL-3.0
Presence tokens, contextual trust tensors, context scoping, action grammar
Running
Hestia
What a person carries
Local identity, encrypted vault, scoped delegations, policy gate, witness chain
Running
Multi-device
Hub
What a community owns
Signed charter, governed roles, append-only ledger, M-of-N council release
Core
Experience
Hardbound
Proprietary, built on issued patent IP
TPM 2.0 identity, device-sealed keys, fail-closed pre-action enforcement, multi-signed audit bundles
Building
SAGE
Persistent embodied agency
On-device cognition kernel, metabolic budget, PolicyGate before every proposed effect
Research
Open source, free
Paid tier
Research direction
How it behaves
It governs its own builders.
The agents building this system are refused by it as a matter of routine. They cannot edit the gate, the hooks or their own configuration without a human-approved escalation.
Agents appeal refusals, a cross-vendor arbiter rules, and upheld appeals go on the record. Two were upheld on 2026-08-27, ruled from the original denial records.
The caveat is on the record with them: an upheld appeal scores conduct without yet amending the rule, so the identical act was refused again minutes later. The amendment object is drafted.
Human governance decisions are gated the same way. Irreversible acts require a quorum of distinct operator signatures, and the quorum veto is in code.
Known defect classes are self-filed. An interpreter bypass was caught and reverted under approval on 2026-08-27. The record includes the holes.
Assurance grade, quoted verbatim
A1: cooperative gate, same-UID operator, tamper-evident and not tamper-proof.
Every escalation record carries its own grade in plain words. A capable agent can bypass a cooperative gate. The bypass is attributable, not prevented.
Open issues
30+ self-filed governance issues, open as of 2026-08-27.
The adversaries live inside the system. Defects are found by the members the system governs and filed against the system that governs them.
Before the act, not after
A tool call stops at the gate.
Hestia sits between a person and the agents acting for them. Nothing consequential reaches a tool without passing the law first, and every decision either way is written down.
You
Grant a scoped, revocable delegation to an agent. Authority belongs to you, not to the machine the agent runs on.
Agent
Hestia daemon
Classifies the action, evaluates it against the law you wrote, and returns allow, warn or deny. Consequential actions escalate to a human before they happen.
Denied
Blocked before execution. The agent may appeal. The denial record is what the appeal is ruled from.
Allowed
The tool runs, and the outcome is written to the hash-linked witness chain with the signer's identity on the row.
Where free stops
Free where trust is earned. Paid where proof has to hold up.
We believe agent governance reaches the enterprise the way ChatGPT did: free and widely used first. That is a stated belief about distribution, not a measurement.
Layer
Licence
What you get
Maturity
Web4 Core
AGPL-3.0, royalty-free patent grant for non-commercial, research and AGPL-compliant use
Trust primitives and law-in-the-loop governance, installable from crates.io and PyPI
Running
Hestia
Free and open source
Personal identity, vault, delegations, policy gate, witness chain, 31 MCP tools
Running
Hub
Free and open source
A community owns its hub, its ledger and its data. Nothing runs on our servers.
Core
Hardbound
Proprietary, commercial licence
TPM-bound identity, fail-closed pre-action enforcement, multi-signed audit bundles with SIEM and GRC export
Building
Hardbound has two halves at different maturities and we do not blend them. The multi-signed audit bundle is deliverable today: one release artifact cut and tested, with no external installation to date. The enforcement supervisor is real code whose deny logic demonstrably fires and then deadlocks on a current kernel, which is why packaging it is the first funded item and not a selling point.
Read this before you read anything else
We publish what we do not assure.
No competitor in this category publishes an assurance ceiling. Ours is a named page in the navigation, not a footnote: the grade, the gaps, the untested claims and the numbers that undercount.
Start where you are
Install it, or bring an auditor.
Developers install from crates.io or PyPI and write their own law today. Enterprise security reviews go straight to a person, not a form queue.