On August 10, Mark Zuckerberg published a manifesto promising every person on earth a superintelligence that knows everything about them, and privacy so strong that even Meta cannot see inside. I believe he means it. That is not the problem.
The problem is a column that stays empty no matter who fills in the row.
I have been keeping a ledger. For thirty-four days, teams I have never spoken to, at every scale from one anonymous Redditor to the largest social company on earth, have been converging on the same architecture. Personal memory. Agents that act for you. A gate that guards what crosses. Privacy as the foundation. Every one of them arrives independently. Every one of them draws the same map.
And every one of them leaves the same layer blank.
The ledger
July 7. Petros Lamb publishes the requirement at the organizational layer: a harness has not learned until the next real run proves it used the change, and learned changes gate behind human authority. The rule exists. No mechanism holds it.
July 13. Meterless appears: five open engines for agent memory, world state, reasoning, and intent. Hierarchical memory that mines, dreams, and audits. A “trust ledger.” Signed execution contracts. I read their specs the way you should read anyone’s, including mine: looking for the key. Their own documentation says the signature is “not a cryptographic-grade defense.” The daemon signs itself. The ledger is an append-only audit trail with no signature at all, and nothing but policy stops the party running it from rewriting history. They are honest about this, which I respect. It is simply not the layer.
August 1. I run a prior-art sweep before publishing my own measurements and find agentreceipts.ai, a public spec sharing my project’s shape almost exactly: hash-linked entries, Ed25519 signatures. Signed by a key the daemon holds. The party being recorded holds the pen that attests the record.
August 4. Cloudflare announces wallets for AI agents. Identity, handles, spending caps. Real infrastructure, solving real custody-of-money questions. An anonymous writer on Reddit, five essays deep into agent trust, names what it cannot solve: account-anchored reputation launders by re-registration. Burn the handle, mint a clean one. His words for the alternative: history-anchored reputation, held by witnesses independent of the party it describes. And his verdict on the whole stack, worth quoting exactly: “a receipt proves something happened, not that it was good,” and the valuation layer independent of both actor and rail is “the layer nobody in this stack has built yet.”
August 9. I compare the LLM observability platforms, the tools whose one job is watching agents work. Langfuse, LangSmith, Braintrust, Arize, Datadog. Self-hosted or cloud, every trace store is mutable by its operator. Not one offers a record the operator cannot rewrite. The watchers keep diaries in pencil.
August 10. Zuckerberg. Personal superintelligence for everyone. And the load-bearing sentence: people will not adopt agents they do not trust with sensitive details. His answer is a private mode sealed so tight that even the provider cannot look. An encryption promise from the party you are being asked to trust.
Five weeks. Seven independent arrivals. One empty column.
Why the column stays empty
It is not that these teams cannot build it. Meterless reimplemented five engines. Cloudflare moves a measurable share of the internet. Meta employs more cryptographers than most countries. The column stays empty because it cannot be filled from inside the row.
A record only functions as evidence if it is held against the party it describes. The agent cannot hold it, because the agent is the subject. The vendor cannot hold it, because the vendor is the interested party. “Even we cannot see your data” is a sentence about encryption. It is not a sentence about evidence. When the dispute comes, and the dispute always comes, the question is not who was locked out. The question is who kept the record, and whether the party that kept it had a stake in what it says. A company cannot audit itself. Neither can a superintelligence.
Zuckerberg’s own safety argument makes this sharper than I ever could. His case for distributing superintelligence to everyone is balance of power: many strong agents checking each other. Checking each other against what? Balance of power without a record none of the powers controls is not a check. It is a staring contest between parties who each keep their own score.
The measured floor
I did not arrive at this by pattern-matching Reddit posts. I measured it.
In July I ran the experiment that became The Bones Do Remember: strip an agent’s model away, keep its record, and test whether the behavior is in the weights or in the bones. Ten for ten, twice, at odds around one in two hundred thousand. The agent is the record, not the model. Which means the record is not exhaust. It is the asset. And the custody of an asset decides everything about what it is worth.
On July 31 I gave the missing party a name: eviduciary. The fiduciary of evidence. A neutral holder of the record, independent of the actor and of the platform, the way an auditor is independent of the books, the way an escrow agent is independent of the deal. I published the definition dated, I checked the trademark register clean, and I am not filing anything. The category belongs in the commons, because a category like this owned by one company would have the exact defect it exists to fix.
I will not tell you nobody has built the layer. Absence is not provable, and asserting it is the fastest way to be handed a link. I will tell you what I told my own prior-art file: I went looking, at every scale, for five weeks, and each time I found the map drawn beautifully and the floor missing. If you have the counterexample, send it. I want to be wrong about a smaller market and right about a real one.
What I am doing about it
My side of this is small and concrete, which is the point. A local, hash-linked, human-signed record of what my agents do. A key that lives in my hand, derived from a passphrase, never on disk, so the one signature the system cannot forge is mine. Known limits published in the open, because a record that overstates itself is worse than no record. And now a portable export: the spine of an agent, signed, small enough to live in a QR code, readable by any runtime that cares to check it. The pieces are boring on purpose. Evidence should be boring.
The blank layer will get filled. The only open question is by whom, and that question has exactly two answers. Either the platforms fill it themselves, and we get receipts written by the party they describe, checked by nobody. Or it gets filled from outside, by neutral parties whose entire value is that they hold nothing else. Escrow for conduct. Audit for agents. The eviduciary.
Thirty-four days, seven arrivals, one hole in the same place every time. At some point a gap that consistent stops being an oversight and becomes a signal, the low tone under all this shimmer, the fundamental the whole chord is voiced around and nobody is playing. Put your hand on the speaker. The missing frequency is the one you feel in your chest. Somebody has to hold the floor while everything above it moves, somebody with no stake in the song, and the strange quiet truth of this whole loud month is that the most important layer in the stack is the one that does nothing but remember, and belongs to no one who could profit from forgetting.