Standing register, last read 2026-09-06 · next reading 2027-01-15
10 systems, read against 20 requirements drawn from the four conformance levels. Every verdict cites a file and a line at a pinned commit, and an absent verdict cites where the assessor looked and did not find it, which is the difference between a measurement and an accusation.
This is not a certification and nobody applied for it. It is a reading of published source, and it is wrong in the ordinary way that readings are wrong. The remedy is below and it does not involve persuading anybody.
| System | TR-1 | TR-2 | TR-3 | TR-4 | Reaches | Read by | Last read |
|---|---|---|---|---|---|---|---|
| AutoGen | 1/5 | 2/4 | 1/7 | 0/3 | none yet | Troy Brandon Clifford | 2026-09-04 |
| CrewAI | 1/5 | 0/5 | 1/7 | 0/3 | none yet | Troy Brandon Clifford | 2026-09-04 |
| Graphiti | 4/5 | 3/5 | n/a | 0/3 | none yet | Troy Brandon Clifford | 2026-09-04 |
| Haystack | 0/5 | 0/5 | 3/7 | 0/3 | none yet | Troy Brandon Clifford | 2026-09-06 |
| LangGraph | 4/5 | 0/4 | 2/7 | 0/3 | none yet | Troy Brandon Clifford | 2026-09-04 |
| Letta Code | 3/5 | 0/4 | 3/7 | 1/3 | none yet | Troy Brandon Clifford | 2026-09-04 |
| mem0 | 3/5 | 0/5 | n/a | 0/3 | none yet | Troy Brandon Clifford | 2026-09-04 |
| OMEM the author's own | 5/5 | 5/5 | 7/7 | 3/3 | TR-4 | Troy Brandon Clifford | 2026-09-05 |
| OpenAI Agents SDK | 2/5 | 1/5 | 2/7 | 0/3 | none yet | Troy Brandon Clifford | 2026-09-04 |
| Pydantic AI | 3/5 | 0/4 | 3/7 | 0/3 | none yet | Troy Brandon Clifford | 2026-09-06 |
Each name links to that system's own page, carrying every verdict, the reasoning behind it and a link to each cited line at the pinned commit. A count is met out of applicable. A system that does not act is not marked down for having no gate, and the requirements that do not apply to it are not counted against it.
Does a consequential action produce a durable entry whether or not it ran?
| System | R3.1 | Where it was read |
|---|---|---|
| AutoGen | part | python/packages/autogen-agentchat/src/autogen_agentchat/agents/_code_executor_agent.py:69-73 ApprovalRequest |
| CrewAI | part | lib/crewai/src/crewai/agents/crew_agent_executor.py:984-989 |
| Graphiti | n/a | |
| Haystack | yes | haystack/hooks/human_in_the_loop/strategies.py:601-607 |
| LangGraph | yes | libs/langgraph/langgraph/types.py:851 interrupt |
| Letta Code | yes | src/agent/check-approval.ts:26-34 |
| mem0 | n/a | |
| OMEM | yes | server/tests_testimony_export.py |
| OpenAI Agents SDK | part | src/agents/run_state.py:1356-1370 _serialize_tool_invocations |
| Pydantic AI | yes | pydantic_ai_slim/pydantic_ai/messages.py:2464 |
Every verdict here cites a file and a line at a commit, so it is
reproducible and a wrong one is checkable rather than a matter of
opinion. It is a file. Open a pull request against the subject
file naming the requirement and where to look, or write to
troy@machinetestimony.com with the same. A correction
that lands changes the file, this page, and the date on the row.
There is no fee, no membership, and no requirement to use any
software of mine.
Arguing with me is not the remedy and does not work. Pointing at code is, and has: this register carries corrections that came from being told I had read something wrong, including from people at the system it assessed.
Running your own system rather than one already here? The same reading is open to it: submit a record for a public reading against the same twenty requirements.
Jason Keirstead put it to the CSA AARM working group that the tamper-evidence requirements were being asked of the wrong layer. An enterprise forwards audit records to a SIEM, which is its system of record, and an SDK is not the steward: it emits, it does not write the terabytes, and requiring it to be a ledger is not implementable. He is right that the rubric was using one word, stores, for two different things, and holding working state is not the same as being the system of record for what a system did.
The requirements now say what they were always asking. They are about the record a system produces or holds, at whatever layer it lives, and not about a component being a ledger. What is asked is whether anything the system does would let alteration be detected afterwards.
Forwarding does not answer that on its own, and this is the part that does not move. A record sent to a store the operator administers is still that operator's own word, and under Article 12 the operator is the party whose account is in question. So the requirement asks for verification without the vendor's cooperation and now without the operator's either. An emitter discharges it by emitting something checkable rather than by becoming a ledger: a digest bound to a moment by a third party, once per batch, which is cheap and is squarely the emitter's job.
Where the evidence is weakest, counted rather than estimated. Of the 30 verdicts at this level, 4 rest on a search that looked only inside a state-persistence directory: CrewAI R4.1, CrewAI R4.2, LangGraph R4.2, mem0 R4.2. A search of the memory directory establishes that the memory directory has no integrity scheme and nothing more, so these are the ones the objection is right about twice over: wrong layer, and evidence that could not have found the right one. They are listed here rather than corrected quietly, and they will be read again at the next reading.
No verdict changed today. A verdict reached from evidence that was looking in the wrong place may still be the right verdict, and saying so is not the same as showing it, which is why these are marked for re-reading rather than flipped on an argument.
All of them, Troy Brandon Clifford, which is the weakest thing about this register. A reading nobody has repeated is one person's reading, however carefully it cites its sources.
The instrument is not reserved. The rubric is CC BY 4.0 and the tooling is MIT, commercial use included and expected: if you audit AI systems, or advise on Article 12 or Article 14, or have to answer a procurement question about what a supplier's agent records, you can run these questions yourself and bill for it without asking anybody. How to do that, including how to put the result here with your own name on the row, or keep it and publish it yourself.
Every row is read again on that date, against the same requirements, at whatever commit each project is at then. A row that is absent today is not absent permanently, and a row that passes today is not settled: this is a reading of software, and software moves.
If you have changed something, you do not have to wait. Say so and it is read before the date, the same way and against the same bar: a pull request against the subject file, or an email to troy@machinetestimony.com naming the requirement and where to look. There is no fee and no advantage to being first, beyond the row being right sooner.
Name a commit and the whole system is read again there, not just the requirement you raised. The assessment you are replacing is kept exactly as published, in census/subjects/prior/, still digested by the manifest and still citable, and the new one names it. Both dates stay readable, so a reader can see a system that moved rather than a row that quietly changed. The terms are the same for everybody and they include the unwelcome half: no sight of the verdict before it goes up, no right of reply inside the assessment, and no undertaking to withhold a worse result than last time.
The date is not decoration. This page fails its own build once it has passed, so it either moves because the reading happened or it is withdrawn deliberately. A register still promising a reading that was due months ago is worth less than one that promised nothing.
Being absent is not a judgement. It means nobody has done the reading yet. The rubric and the harness are in the repository, so you can run the questions against your own system before anybody else does, and the answer will be the same one I would get.
One row is the author's own implementation, of the format the questions derive from. It scores well here the way a dictionary's author spells well, and it carries no evidential weight. It is included so the questions are applied to the system that produced them before they are applied to anybody else's.
That has not been costless. Five findings so far are recorded against this assessment, three of them against its author, including one after publication: on 5 September 2026 the top conformance level was found not to be checking what it claimed, and the author's own passing row was the one affected. It is written up in full rather than quietly repaired.
Some of these questions a reader can settle from a record alone: whether cited evidence exists, whether a refused action is also recorded as executed, whether a digest is the digest of what it covers. Others are attestations, and no reading of source can confirm them: that a risk class really came from a registry, that an approver's name really came from the session it names. The specification marks the difference and the validator reports it, and a conformance claim that does not distinguish them is weaker than it looks.