NENRIN: tree rings for AI facing services

A tree adds one ring a year. Nobody can paint one in afterwards. NENRIN gives that property to software services.

In one thirty day window, measured 2026-08-17, this server appeared in 93,983 AI search results. How many of those became a call from outside, we cannot say. The usage counter deliberately stores no IP addresses, so it cannot separate our own automated checks from external traffic. An earlier version of this paragraph said the answer was 0. This instrument cannot establish that, so the claim is withdrawn here rather than quietly deleted. Discovery is solved. Choice is not. An agent picking between 90,000 servers can only read what each vendor wrote about itself. NENRIN adds the missing layer: records of conduct that the vendor did not author and cannot delete.

How it works, in three lines:

1. Open witnessing. Anyone can measure any endpoint and submit the walk to the public ledger under their own name and vantage. The operator holds no veto: acceptance is mechanical schema checking, and the code that enforces this is in this repository.
2. Discrepancies are the product. When two witnesses report incompatible observations of the same target, the disagreement itself becomes a permanent, citable record. The founding one is real: NENRIN_DISCREPANCY_0001, two honest witnesses, one target, both correct.
3. Rings. Each month the accepted records bundle into a ring that carries the hash of the previous ring, timestamped to Bitcoin. Eighteen months of rings cannot be created in an afternoon, by anyone, including us.

The specification is anchored on the public ledger as entry 19 (sha256 9ccba2e325fd2a555fcdb2dec519b8c6bf7a669064674846aea98ecfff824e3d): NENRIN_SPEC_v1.md. It names its own prior art (Certificate Transparency, Rekor, in-toto, SLSA, OpenTimestamps), states exactly which combination is claimed as new, and invites refutation into the same ledger.

The witness intake is live. Start here:

curl -s https://ledger.horizonshield.dev/witness

We are the first test subject under our own rules. The ledger keeps the record of our gate failing its own test, and the full 522 incident that started all of this. Unflattering records stay.

If a register that cannot delete criticism of its own operator is infrastructure you want to exist, star this repository. Stars are how researchers and agent platforms find it. The rings accumulate either way. They accumulate faster with witnesses.

Repository map

The agreement record: the other half of a measurement

A conduct record is one sided. Somebody measured somebody. Nothing in it records the other half of commerce: that two agents agreed on terms, and that both said so.

a2a-agreement-v1.1 is that record. At time T, party A and party B both signed the same canonical bytes describing terms, and each of them pinned, by sha256, a conduct record about the OTHER party written by somebody who is neither of them.

What it refuses to be is as load bearing as what it is. No custody. No matching. No editorial step. The recorder must not hold funds, must not decide whether a deal happens, and must not charge a fee that varies with the amount or the outcome. A record whose fee moves with the number is refused by name. Refusal is mechanical, and none of the terms are ever judged by anyone in this layer.

The claim is not a new primitive. It is the combination: two mandatory signatures, the counterparty's measured conduct pinned by sha at the moment of signing, an intake that judges nothing, and an external anchor nobody here operates. Prior art is named in the draft rather than left for a reader to find: AP2, x402, ACP, MPP, Cedulon, the 1F916 Agent Record, and SCITT.

The verifier is written twice. Once in Python, once in JavaScript, by design and not by accident: two implementations that disagree are the exact seam this project measures everywhere else, and building one into this layer on purpose would be a poor joke. 5,286 frozen cases, and the two produce the same report byte for byte, including every refusal code and the English sentence attached to it. Proving that moved the Python once, when the JavaScript disagreed on two cases and the check that settled it was running the Python against its own frozen fixture, where it failed the same two.

Then the rules were broken on purpose, 77 ways in Python and 36 in JavaScript, to find out whether the 5,286 cases could tell. Six breakages survived, and not one was a defect in either implementation. They were holes in the test set. All six are closed.

• The record: ops/AGREEMENT_EXT_v0_1_DRAFT.md. v0 is anchored as JIDEC entry 39 and does not move.
• The verifiers, the adversary and the contract: workers/hs-ledger/nenrin/agreement-v0
• What an intake may and may not do, written before one exists: ops/AGREEMENT_INTAKE_v0_BOUNDARY.md

There is no intake yet, and that is deliberate. A record layer built before it has two parties is an empty exchange, and an empty exchange is worse than none.

The register, as a repository

The same measurements are published as a standalone, machine generated repository: mcp-conduct-register.

Nobody selects the rows there either. A script rebuilds the table from the public API once a day, and the same run writes a register.json snapshot so an agent can read the register without parsing Markdown. It carries a CITATION.cff, so the register can be cited the way a dataset is cited, and an llms.txt that states in plain words what the register is and, more importantly, what it is not.

Three ways in, none of which need us

Since 2026-09-04 the gate can be used without asking anyone at HORIZON SHIELD.

For the server you operate. Put {"allow_tool_call": true} at /.well-known/mcp-conduct.json on your origin. Only the owner of an origin can place a file there, so the gate takes it as consent, measures determinism on the public register with it, and writes into every verdict where it read it (gate 0.2.4). Add a compensation block to your agent card (paid_by, referral_fee, listing_fee; the content is not judged, only its absence) and POST /watch once. A row can then reach verified with no hand of ours involved.

For your CI. One step measures the server on every push and recomputes the verdict hash on the runner, so the gate is never trusted: wedjat-check-action (uses: ogasurfproject-jpg/wedjat-check-action@v1). It fails the job on a measured failure and leaves unmeasured conditions unmeasured; require and must_pass decide how strict that is.