Who earned it, and may I pay them.

VTR-1 makes a track record verifiable: its statistics are proven correct on committed data, net of a committed cost floor, deflated for the committed size of the search that produced it, without revealing the strategy. VTR-1 judges the record, not its author, so it already applies to records produced by software.

Autonomous agents add four problems VTR-1 does not address, because a human manager does not raise them:

1. Who earned it. An agent is a key, an endpoint and a model, any of which can change. A verdict must be bound to the thing a counterparty will actually pay or allocate to.
2. Silent replacement. An agent can swap its model, prompt or weights between the record and the sale. Each swap is a new trial that a record would otherwise hide.
3. Identity laundering. An agent that fails can re-register under a fresh identity at zero cost and present a clean history.
4. No interview. An allocating agent cannot sit across a table from a counterparty. It needs a check it can run in one call, with defined semantics, before money moves.

This profile defines four conformance classes for agent credentials (A1 to A4), a cumulative trial count across model versions, a forward-only record discipline, an autonomy declaration, a machine-readable verdict object, and an allocate-check procedure. Every normative requirement carries a stable identifier, A-01 onward, so a conformance claim can be contradicted.

The key words MUST, MUST NOT, SHALL, SHOULD and MAY are used as in VTR-1.

This profile governs credentials whose positions were produced by an agent: software that selects positions without a human choosing each one. It is silent on what the agent is built from. Rules, statistical models, neural networks and language-model agents are all in scope.

This profile governs the claim, not the agent. It does not certify safety, alignment, intent, legality, or future performance. A conforming credential proves that a record is honest and that it belongs to a specific, committed agent. Nothing more.

Agent. A process that emits positions under a committed decision procedure without per-decision human selection.

Agent identity. A durable, resolvable identifier for an agent: an ERC-8004 agentRegistry:agentId pair, a W3C DID, or an A2A agent-card URL. An agent MAY hold several; a credential binds to at least one.

Model commitment. H(model_artifact ‖ model_salt), where model_artifact is the complete decision procedure (code, weights, prompts, parameters, tool configuration) and model_salt is 32 secret random bytes. The commitment reveals nothing about the artifact. VTR-1's sealed path already produces it.

Model version. One model commitment. Any change to any byte of the artifact is a new version.

Version ledger. A Merkle commitment to every model version an operator has run under one agent identity, in order. Its leaf count is the agent's lifetime version count N_life; each leaf also commits that version's search size N_v.

Operator. The party that controls the agent's identity keys.

Forward record. A record whose positions were committed and anchored before the market bars they act on existed (VTR-1 chained credentials).

Record age. Time from the first anchored forward commitment to the latest verified extension.

Autonomy class. The degree of human involvement in each position, declared in §07.

Binding statement. A statement signed by the agent identity's key over the credential digest, the model commitment and the identity, asserting "this record is mine."

An agent credential MUST declare exactly one class. Each class includes every requirement of the classes below it, and every requirement of the VTR-1 Level it is built on.

A3 is the class an allocating agent SHOULD require before moving capital. A4 is the ceiling: the record, the model and the decisions are all inside the proof.

### A1 · Bound

• A-01 (MUST). The credential MUST commit a model commitment, and the proof MUST bind every position to it.
• A-02 (MUST). The credential MUST be accompanied by a binding statement signed by the key that controls at least one declared agent identity.
• A-03 (MUST). The verifier MUST check the binding signature against the key the identity currently resolves to, and MUST report the identity as UNBOUND if it does not resolve or the signature fails. An UNBOUND credential is still a valid VTR-1 credential; it is not an A1 credential.
• A-04 (MUST). The binding MUST be bidirectional: the agent's identity document (ERC-8004 registration file, DID document or A2A card) MUST list the credential digest. A credential the agent does not claim, or that the agent claims but does not sign, is UNBOUND.
• A-05 (MUST NOT). An issuer MUST NOT bind a credential to an identity whose key it controls on the agent's behalf, unless that custody is declared in the credential.

### A2 · Versioned

• A-06 (MUST). The operator MUST commit a version ledger for the agent identity, each leaf binding a model commitment to that version's trial-ledger root, and the credential MUST include an inclusion proof of its model commitment in that ledger.
• A-07 (MUST). The deflated statistics required by VTR-1 Level II MUST use the cumulative trial count N_cum = Σ N_v, the sum of the committed search sizes of every version in the ledger (a version with no committed search counts as 1). An agent that tried 20 strategies under each of 5 models searched 100, not 20. N_cum MUST be computed from the ledger, never reported.
• A-08 (MUST). The version ledger MUST be append-only. Each new ledger root MUST commit its predecessor's root, so a verifier holding any earlier root detects a rewritten history.
• A-09 (MUST). A model change MUST produce a new model commitment and a new ledger leaf before the changed model emits a position that will be credentialed.
• A-10 (SHOULD). Ledger roots SHOULD be anchored to a public timestamp (Bitcoin via OpenTimestamps, or an on-chain attestation) at every append.

### A3 · Forward

• A-11 (MUST). Every credentialed position MUST have been committed and anchored before the bar it acts on opened. Backtested positions MAY appear in the same credential only in a separately reported pre-forward segment, which MUST NOT be pooled into forward statistics.
• A-12 (MUST). Extensions MUST be chained under VTR-1: same committed specification, strict Merkle extension of the data, parent digest bound in-circuit.
• A-13 (MUST). The credential MUST report record age and the date of the latest verified extension.
• A-14 (MUST). A verifier MUST report a forward record as STALE when the latest extension is older than the staleness window the issuer committed at the first forward commitment. Staleness is reported, not a failure. The window MUST NOT be changed after the first commitment.
• A-15 (MUST). A model change (A-09) MUST start a new forward record at age zero. Age earned by one model version MUST NOT be carried to another.
• A-16 (SHOULD). Forward records SHOULD extend at least monthly.

### A4 · Inference-bound

• A-17 (MUST). The proof MUST recompute, for every credentialed position, the committed model's output from committed inputs, and MUST reject if any submitted position differs from that output.
• A-18 (MUST). The model's inputs MUST be derived inside the proof from the committed market data, or from additional data committed by Merkle root before the first position.
• A-19 (MAY). Implementations MAY satisfy A-17 for a subset of model classes only. The credential MUST name the class (for example, "fixed-point MLP, ≤N parameters"). Agents outside a supported class can reach A3 but not A4.

The cheapest attack on an agent's reputation is to abandon it. An agent that fails registers a new identity and starts clean. No cryptography can stop an operator from generating new keys. This profile does not pretend otherwise. It makes the attack expensive instead.

• A-20 (MUST). A verifier MUST report record age, N_life and N_cum beside every verdict. A clean history with zero age is visibly a new agent, not a good one.
• A-21 (MUST). A FAIL credential is a credential. A conforming issuer MUST publish FAIL verdicts under the same issuer identity and registry as PASS verdicts, and MUST NOT delete them. Retraction is a published status, never removal.
• A-22 (SHOULD). Where one operator controls several agent identities, the operator SHOULD commit a single version ledger across them. An allocator MAY require it.
• A-23 (SHOULD). Allocating agents SHOULD weight record age as the scarce quantity. Age is the one property of a record that money cannot buy and a new identity cannot inherit.

ERC-8004 identities are ERC-721 tokens and can be sold.

• A-24 (MUST). A credential binds to the model commitment and to the identity at the time of binding. When control of an identity changes, a verifier MUST report the transfer and the date, and MUST NOT present credentials bound before the transfer as earned by the new controller.
• A-25 (MUST). A new controller MUST NOT re-sign a binding statement for a credential earned before the transfer.

An allocating agent cannot interview a counterparty. This section defines the one call it makes instead. An allocating agent conforms to this profile if, before transferring capital or payment conditioned on performance, it performs:

• A-26 (MUST). Resolve the counterparty's declared identity and endpoint.
• A-27 (MUST). Retrieve the credential by digest, and verify its hash against the issuer registry or a timestamped anchor.
• A-28 (MUST). Verify the proof against the named era, offline or through a verifier it trusts, and obtain the verdict exactly as issued.
• A-29 (MUST). Verify the binding (A-02 to A-04) and check that the endpoint it is about to pay is listed in the bound identity.
• A-30 (MUST). Read the class, record age, N_life, N_cum, autonomy class and staleness.
• A-31 (MUST NOT). Treat any of the following as passing: a verdict other than PASS, a hash mismatch, an UNBOUND identity, an endpoint absent from the identity, or a class below the one its own policy requires.

The allocate-check reads properties. It does not set thresholds. What class, age or autonomy level is sufficient is the allocator's policy, exactly as VTR-1 leaves gate thresholds to the implementation.

• A-32 (MUST). The credential MUST commit an autonomy class.
• A-33 (MUST). A verifier MUST present the autonomy class as declared, not proven. No current construction proves the absence of a human; this profile does not claim one.
• A-34 (MUST). At A4, a declared H0 or H1 MUST be reported as inconsistent if any credentialed position differs from the model's committed output, because then a human chose it.

• A-35 (MUST). An issuer MUST publish each agent credential as a verdict object with at least these fields:

• A-36 (MUST). Where verdicts are posted to a reputation registry as a score, the mapping MUST be PASS = 100, NOT_SIGNIFICANT = 50, FAIL = 0, with tag vtr1 and the class as the second tag, and the feedback MUST reference the bundle and commit its hash.
• A-37 (SHOULD). Verifiers SHOULD expose the allocate-check as a single callable operation over at least one agent protocol (MCP tool, A2A skill, or HTTP).

This profile does not certify, and a conforming credential MUST NOT be presented as certifying:

• the safety, alignment, or intent of an agent;
• that a human was absent (A-33);
• future performance;
• the conduct of an agent outside the committed positions;
• strategies excluded by VTR-1 §5, including high-frequency strategies, without exception.

• A-38 (MUST). Every surface that displays an agent verdict MUST display the class beside it. "PASS" alone, without a class, misrepresents an A1 credential as an A4.

Residual risks this profile does not remove: an operator running many agents and promoting the survivor across operators it does not disclose; collusion between an agent and its data source outside committed data; and the declared, unproven nature of autonomy below A4.

This profile adds A-01 to A-38. It removes nothing, weakens nothing, and redefines nothing in VTR-1. A credential that satisfies this profile satisfies VTR-1 at the Level it is built on. Governance follows VTR-1 §6: the profile freezes at v1.0, changes after that by errata or a new version only, and every credential names the profile version and era that judged it.

1. Should A3 require a minimum record age, or leave it entirely to allocator policy?
2. Can the version ledger be made to cover all agents of one operator without revealing how many the operator runs?
3. What is the smallest A4 model class that is useful, and can a language-model agent's tool calls, not its full inference, be the committed decision procedure?
4. Should staleness windows have a published maximum?

To be published with v1.0: one known-answer vector per class (A1 to A4), one UNBOUND, one STALE, one transferred identity, one laundering case (fresh identity, zero age), and one A4 inconsistency (declared H1, position differs from model output).

Prove the edge. Never reveal the strategy. — Mizan Verification, Inc.