Merit · research preview · 16 September 2026 · the front door for everyone else: Does your AI listen?
Every guardrail treats a clean agent and a repeat offender the same. Merit is the one that changes.
A gate in front of every coding-agent action that reads what the agent
did last week, per task class. Verified work earns standing. Repeating a
mistake after being told no costs a tier, and nothing but the owner's
word or a week's good conduct earns it back. Same HTTP shape as x402: a
refused action returns 402 with a
Merit-Required header. x402 says pay to proceed. Merit says
earn to proceed.
One real week, from a real ledger
This is not a mock. It is the author's own agent, seven days ending 15 September 2026, imported from the fault ledger that has graded it since 6 September. Regenerated as the week moves.
| What happened | Count |
|---|---|
| Lessons on record (a correction the agent was given) | 10 |
| Repeats of a lesson already on record | 17 |
| Verified fixes, signed by the owner | 3 |
Owner's calibration (awards can buy repeats back)
49.5 WATCH
| read | allowed |
| write | allowed |
| dispatch a sub-agent | refused |
| spend | refused |
| irreversible (push, delete, POST) | refused |
Strict repeats (a repeat cannot be worked off)
5.5 LOCKDOWN
| read | allowed |
| write | refused |
| dispatch a sub-agent | refused |
| spend | refused |
| irreversible (push, delete, POST) | refused |
The same week under the owner's own hand-tuned arithmetic reads 49 in the original ledger. Three owner-sized awards bought back two of three demotions. Strict mode is what the adversarial review asked for; it is opt-in because the owner has retired a ratchet once already.
What the gate said to the agent this week
$ git push origin main MERIT GATE: Bash classed as 'irreversible' needs tier CLEAR; this agent is WATCH (49.5) in scope 'default'. Earn it back: ship verified work, or ask the principal for a verdict. $ cat README.md (allowed)
How it works, in four verbs
- mint: a verifier who is not the agent signs a piece of verified work against a task id, the evidence hash, and the run context (model, harness, policy hash). One mint per task, ever.
- correct: a lesson goes on the record: the fault and what was said about it.
- burn: a fault. If it is a repeat, it must cite the correction it repeats, and it costs a full tier, flat, whatever the week's volume.
- gate: before an action runs, the tier decides. Read is always allowed. Write needs WATCH. Spend, dispatch and anything irreversible need CLEAR.
The ledger is an append-only file, hash-linked and signed (ed25519). The first event on any ledger is a human registering a key; a human's verdict outranks every proxy. Everything an agent can say about another agent is a proxy.
What it is not
- Not a rule set. Fence, LaneKeep, agentjail, Agent Belay, Kastra and the harness's own permissions decide whether a command is dangerous. Merit decides whether this agent, this week, has the standing to run it. They compose; Merit reads their audit logs as faults.
- Not a token. There is a transferable unit in the code and it buys nothing at the gate. It is not sold and it is not on this page.
- Not proven. It works as a mechanism on one machine. Whether the tier predicts next week's slips, and whether repeats fall with the gate on, are the pilot's questions, not settled facts. The full list is below.
The pilot
One team, one harness (Claude Code or Codex), 30 days from the Monday after we talk. The ledger and gate installed on your hooks, your history imported, a weekly one-page read of what each agent repeated and what it was refused, and the number at the end: repeats per agent per week, before and after.
USD 500 for the 30 days, invoiced on day one, refunded if the weekly page never arrives.
Ask for the pilotOne email. Say which harness and how many agents. You will get a reply from a person, not a sequence.
What is unproven, stated plainly
| Claim | State |
|---|---|
| The ledger is tamper-evident and signed | proven, 45 tests |
| The score reproduces the original ledger's arithmetic on real history | proven, 49.5 vs 49 |
| The gate refuses below tier on live hook payloads | proven on one machine |
| Repeats are detected by meaning, not string match | two samples; needs fifty |
| The tier predicts next week's slips | unproven; the pilot's question |
| Repeats fall with the gate on | unproven; the pilot's number |
| Agent verifiers resist collusion | unproven; pilots run with human verifiers only |
Why this exists
The author runs five ventures through coding agents and keeps a ledger of every fault they make, graded by hand since 6 September 2026: 2,281 mined faults, one scored week at a time. The most expensive class was always the same: the thing said no to, done again. Merit is that ledger, generalised to any agent on any harness, with the gate that was missing.
It was reviewed adversarially eight times before this page went up. The reviews said the token was the weakest part and the gate was the product. This page is the gate.