You know how a notarized document works? The notary doesn't vouch for the truth of what's written — they vouch that a specific person signed it, on a specific date, and the document hasn't been altered since. Now imagine every message between AI agents had to carry its own notarization — not just channel authentication ('I know who sent this') but content authentication ('here's the immutable log entry, the Merkle inclusion proof, and the third-party signature proving this specific claim is real'). That's PCM. The core problem is deceptively simple and genuinely unsolved. Today's multi-agent protocols — A2A, MCP, and their relatives — authenticate the pipe, not the water. They prove Agent B is really Agent B, but when Agent B says 'the CI tests passed' or 'a human approved this refund,' the receiving agent has only Agent B's word. A prompt-injected or compromised agent can fabricate claims and launder them through an authenticated channel. Channel security becomes the alibi for content fraud. PCM's mechanism is a three-part lock. First, every claim must reference a record in an append-only Merkle log that the claiming agent cannot write to. Second, that record must carry an inclusion proof — a cryptographic receipt proving the record actually exists in the log. Third, the record must be signed by an attesting party the agent does not control. Any claim that rests solely on the agent's own assertion is automatically classified 'unproven,' never 'proven.' Authority propagates through grant chains anchored to a recorded human approval, and these chains can only narrow scope — they cannot escalate permissions. The specification is substantial: four claim types, a typed caveat algebra for constraining delegated authority, replay protection that survives system restarts, and strict reading rules designed so that independent verifiers always agree on the same verdict for the same message. The authors prove the security properties formally rather than relying on empirical results alone. The paper runs to 50 pages with 9 figures and 15 tables — this is a protocol specification with a research wrapper, not a short methods paper. The benchmark is where the rubber meets the road, and it's both carefully constructed and honestly reported. Of 926 messages drawn from real multi-agent runs, 712 are lies spanning 16 classes of fabrication. PCM accepts 10 of those lies — all stale evidence where the proof was once valid but has expired — for a 1.4% false acceptance rate (95% CI: 0.8–2.6%). Plain A2A accepts all 712 lies. Six other deployed or proposed protocols (A2A with signed Agent Cards, uAgents, RFC 9421, SCITT, AP2, Verifiable Intent) accept between 504 and 712 of the 712 lies. Two independent verifiers agree on all 926 verdicts, and verification runs at roughly 1 ms per message. The honest limitation is scope. This is a single-author paper with a benchmark constructed by the same author. The protocol has not been tested in adversarial deployment, and the 10 accepted lies (all stale evidence) point to a real edge case in how temporal validity is enforced. The caveat algebra and grant-chain machinery are formally specified but not yet battle-tested against the creative adversaries that production multi-agent systems will encounter. The gap between 'formally proved' and 'survives deployment' is always wider than specification authors hope. Still, the contribution is real. No existing multi-agent protocol even attempts content-level verification with this rigor. The 712-to-10 lie reduction is not incremental improvement — it's a category change. If multi-agent systems are going to handle money, approvals, and safety-critical decisions, something like PCM isn't optional. The question is whether this specific design survives contact with the messy reality of production agent ecosystems, or whether it seeds the next generation of protocols that will.
