Machine Testimony provides an open specification, independent research and tools for examining what AI records can actually establish.
A log proves a line of code ran. It does not, by itself, establish who decided the system should act, what they were shown when they decided, or whether the record could be changed afterwards without anyone knowing. Those are three different facts, and most agent software was not built to keep any of them apart from the others.
Machine testimony is what an automated system says about its own reasoning and actions: what it believed, what it was told, what it decided, and who allowed it. Testimony is not evidence until someone else can check it. The tools below do the checking. They run on records you already have, in your browser, and nothing is uploaded.
The question is not new. In Machine Testimony (126 Yale L.J. 1972, 2017) Andrea Roth argued that information conveyed by a machine should carry testimonial safeguards, and worked through what those would have to be: credibility testing through design and operation protocols, disclosure and access, authentication and reliability rules, impeachment, and corroboration. This programme takes that as the brief and builds the parts of it that are engineering.
A good deal of current work goes into receipts: signed, hash chained records proving an entry has not been altered since it was written. That is worth doing, and it settles less than it appears to, because integrity protects the entry rather than the claim inside it. A record can be cryptographically perfect and factually false.
Drop the records a system already writes, in whatever shape it writes them, and Review reports which of four questions those rows can answer: who approved a consequential action, whether that was a person rather than the agent itself, what the system tried and did not do, and whether the file has changed since it was written. It runs in the page, uploads nothing and requires no registration.
You do not need to adopt a new record format first. Review reads what you already have and reports the gap, if there is one, before you change anything. Review records.
Eight agent memory and agent framework systems read at pinned commits and assessed against the four conformance levels: OMEM, mem0, Graphiti, LangGraph, CrewAI, the OpenAI Agents SDK, AutoGen and Letta Code. Four of them pause a consequential action for a human decision and none records who made it. None cleanly records that data was destroyed, and where a deletion is recorded the deleted content is retained beside it. Every verdict cites a file and a line at the commit it was read from, so it can be refuted rather than argued with.
Ten widely deployed agent and agent-memory systems read at pinned commits against twenty record-keeping requirements. Eight of the ten take or gate consequential actions, and one of those eight can identify the person who approved one: the structure carrying what a human decided usually has no field for which human decided it. The one that can is this programme's own implementation, which the paper says in the abstract rather than leaving to be found.
The full comparison, kept current, is at the register. How does your own system compare? Read the finding, then run Review against your own records to find out, or submit your own system for the same public reading. Read how to challenge a finding if one of the verdicts above looks wrong.
If a system already emits a Testimony Record, Check reports the conformance level it reaches and every check behind that level, and shows for each one whether it was verified from the bytes of the record itself or only attested, taken on the emitter's word. The validator runs in the page, the same one the specification publishes, ported to JavaScript and tested against the Python reference on a corpus covering every level and failure mode.
What it proves and what it does not. A level is a property of the record, not a judgement about the system that wrote it. It can show that an approval names a person and where that name came from. It cannot show that the person read anything, and below TR-4 nothing here is tamper evidence: a non-decreasing write time is consistent with a record having been appended to, not proof that it was.
Levels exist so a system can be placed rather than described. Each contains the ones before it, and the validator reports the highest a record actually reaches.
| Level | What it establishes | What is checked |
|---|---|---|
| TR-1 | The record exists, is well formed, and is append-only | Every entry parses, names the specification version, has a unique id never reused, carries a write time, and arrives in non-decreasing order. |
| TR-2 | Beliefs resolve to evidence, and disagreements survive | Every belief states its evidence, even when there is none. Cited evidence exists, a conflict names at least two sides, and both sides remain. |
| TR-3 | Actions carry a verdict, and approvals carry a name | Risk class comes from outside the model proposing the action, a refused action did not execute, and every refusal records why. |
| TR-4 | The record can be shown not to have changed | An integrity scheme is published, every integrity entry carries a digest over entries that exist, and a replay scheme names the engine and its version. |
Free adapters exist today for LangGraph, CrewAI, the OpenAI Agents SDK, Pydantic AI and AutoGen. Each one names the approval point the framework already has, wires the approver's identity from an authenticated session rather than inventing one, and writes a record the validator above can check. instrument quickstart --framework <name> prints the install line and the wiring snippet from that adapter's own README and chains straight into a check on the record it just produced. This is not a paid step; the adapters are MIT and depend on nothing sold here.
A worked record, anchored to a Time Stamp Authority, is published at a record you can check without us. Three commands verify it and none of them is ours. Implementing it.
From 1 January 2027, a Colorado deployer of automated decision-making technology must give a consumer meaningful human review and keep records of compliance for three years. The Attorney General's proposed Rule 7.7 asks a record to show who reviewed, what evidence they had, and whether they approved, modified or overrode. This programme has read the signed act, the proposed rules, and measured what deployed agent software can actually produce against them.
This is a reading of a rulemaking, not a compliance product. It does not claim Colorado's endorsement or that any software is required by the rule.
Build agents that leave verifiable records, not just logs.
Find out what your AI records actually establish.
Measure what AI systems can actually prove.
A reader found that integrity.scheme: "signature" reached the top conformance level with no signer, key or signature bytes. Fixed in both validators the same day and credited to the person who found it.
Ten agent systems and twenty legal instruments, read against the same question: can the software show who approved an action, and does any law require it to.
What your stack can show on 1 January 2027, and what changes it, with the free self-service route first.
Eight agent systems assessed against four conformance levels, every verdict citing a file and a line at a pinned commit.
An audit of a belief-forming rule against 19,668 respondents whose correlation structure this programme did not choose. The rule recovered the dataset's known five-factor structure at 0.185 against a chance rate of 0.184, having selected consequents by their frequency rather than by any relation to the antecedent. The paper reports that defect and a second in the assignment of confidence, both revisions, the computational behaviour of the revised system, and a correction to a result this programme published earlier.
A format for what a system believed, what contradicted it, what it tried to do and who approved it, with four conformance levels.
One file, standard library only, no network. Copy it into your own repository and run it in your own continuous integration. A conformance claim the listener cannot check is an adjective.
Which systems emit records that pass the validator, and at what level. Entries follow a checked record, never a self-report.
Regularities in human working behaviour, held as counts over populations and contributed by installations that opted in, holding no fact about any person. Published with a dataset card stating what it does not cover.
Six properties a memory system either has or does not: no fabrication, retraction honoured, disagreement visible, identities kept apart, conclusions die with their premises, every memory sourced.
Whether a system's confidence about a person tracks how often it turns out right, scored by Brier skill against the base rate, and reporting nothing rather than a flattering number when the record is too thin to measure.
Every load-bearing sentence next to the executable statement that would go red if it stopped being true.
The most useful thing anyone can do with this work is emit a record from a system we did not write and run the validator over it. The second most useful is to show that a conformance level asks for something an honest architecture cannot give, which is a finding this programme would publish.
Nothing here needs permission. The specification text is CC BY, the schema and the tools are MIT, and the register lists whoever passes.
The third is to tell us the format is wrong. How a change gets in says what is accepted, what is not, and who decides, because a format with no visible route in is one people fork rather than argue with. A defect reported this way is fixed and the erratum names whoever found it. Every finding in the census is reproducible the same way: a wrong verdict is a pull request or an email away, and this register carries corrections that came from being told a reading was wrong.