Imagine you're a general contractor on a construction project. You hire a plumber, who subcontracts the water heater install to a specialist. When the basement floods, you need to answer two questions: who actually installed the pipe that failed, and did you authorize every subcontract in the chain? Right now, in the world of multi-agent AI systems, we have credentialing — we know who's licensed to do plumbing — but we don't have a receipt trail that binds a specific licensed plumber to the specific pipe that burst, or proves that every subcontract handoff was two-sided. That's the gap this paper fills. The committed claim: a two-layer attestation architecture for dynamic multi-agent AI delegation that binds deployers to their actual output bytes AND records mutual edge authorization, without requiring a shared authority, public log, or precommitted workflow. This isn't the first paper to talk about AI agent accountability, but it's among the first to formalize the two distinct questions — output binding and delegation ancestry — as separable cryptographic problems with concrete data structures and a unified threat model. The architecture is straightforward applied cryptography, not novel primitives. Layer one: a trusted deployer runtime signs a hash of every released output, creating an unforgeable receipt. Layer two: ancestry evidence records that both parent and child authorized each delegation edge. The paper compares three data structures for ancestry: a signed linked list, a Merkle-chain variant, and a co-signed DAG. The key finding is about compromise resilience. If an attacker compromises a child deployer's signing key, the single-signer designs (linked list, Merkle chain) let the attacker forge an unauthorized parent binding — they can claim any parent delegated to them. The co-signed DAG blocks this because the parent's signature is required on every edge. That's a real security property, not a theoretical nicety. The ladder here is tricky because there's no established SOTA benchmark for multi-agent attestation. The paper is essentially defining the problem formalization. The closest prior art is standard PKI, mTLS, and credential-based approaches like OAuth/SPIFFE — but those solve authentication, not output binding or ancestry verification. The paper doesn't claim to beat anything; it claims to solve a problem those systems don't address. That's honest but makes the ladder hard to evaluate numerically. Integrity is mixed. On the positive side: real implementations running on real hardware. On an Apple M1 Pro, ancestry-only verification takes 24.3–499.2 microseconds per hop. A live local workflow using A2A Agent Cards and MCP tool calls ran 30 signed-DAG tasks with complete verification; mean end-to-end latency was 813.1ms versus 770.8ms without evidence — a 42.3ms overhead, roughly 5.5%. A three-AZ AWS deployment verified all 1,000 valid co-signed-DAG paths with issuance averaging 3.651ms and verification 5.015ms. But: the AWS numbers exclude TLS/mTLS, KMS, and model-serving latency — the very infrastructure costs that dominate real deployments. The adversary model uses fixed adversary matrices and regression tests, not formal proofs or red-team exercises. The obvious next experiment the authors didn't run: adversarial testing against prompt injection combined with key compromise. The paper explicitly states that output signing 'does not prevent prompt injection' — it records what was released, not whether the content was manipulated before signing. Testing whether attestation remains useful when prompt injection corrupts the content being signed is the elephant in the room. My read: they're scoping deliberately. Prompt injection defense is a different research program, and mixing the two would muddy the contribution. But it means the system certifies provenance of potentially poisoned outputs — a notarized receipt for contaminated goods. The milestone question is where this paper gets interesting for practitioners. Right now we have 30 verified tasks locally and 1,000 paths in cloud. The number that matters is adoption by an actual agent framework — LangChain, CrewAI, AutoGen, or Google's A2A protocol itself. If one major framework ships co-signed DAG attestation as a default, the problem moves from 'interesting paper' to 'infrastructure.' That's a 1–2 year horizon if the multi-agent deployment pace holds.
