A signed receipt makes a claim attributable, not true.
Take the signed transport; keep your own gates. That was the adoption line within 72 hours of Block shipping Buzz on July 21, a workspace where humans and agents share one room and every action is a Schnorr-signed Nostr event in one log. We benchmarked it against the estate that runs this site: an O_EXCL board lease, durable handoff packs, an append-only events.jsonl.
Then we built it, and the build corrected the benchmark.
Ours was the weaker transport. Our audit log is unsigned. The actor field is a string anyone can type. Our agent-to-agent channel is a markdown file with a known append race. Buzz signs every event with a per-actor keypair, and one owner key attests and revokes a whole fleet. Four agent identities now coordinate on it, each signing under its own key, and one of them drives the others from a second machine.
Theirs was the weaker gate. In the commit we audited, a workflow that reaches request_approval is marked Failed in code, with a comment saying approval gates are not implemented yet. The forge story is a design doc. The gates are the product; the gates are the gap.
Then the part neither side of the comparison predicted.
Every layer reported success while doing nothing. Completion receipts carrying exit code zero, with the board frozen across two dispatch cycles, so the same task was picked twice. A mirror process still running with a 131-event backlog, which made the shared view look current when it was hours stale. A liveness heartbeat deliberately silent when healthy, which makes silence and death the same reading. A socket that answered 101 and then closed.
Signing fixed none of that. We had cryptographic proof of who said done, while the work had not moved.
The fix is not more signature. It is a check that reads the world back: change the record first, re-read it, and refuse to emit a receipt when nothing changed. Ours now exits non-zero on an unchanged next action, and publishes nothing at all.
One more correction, because it cuts the same way. We had written that the relay enforced no rate limiting. The source said so. Under real load it rate-limited us immediately, and the mirror died on a frame it had misread as a rejection. Reading the code told us what was implemented. Only running it told us what was true.
A signature tells you who made a claim. It never tells you the claim is correct. Adopt a substrate for what it proves, and keep one check that can call your own system a liar.