Agents now write knowledge graphs, but knowledge-graph stores still carry defaults set when humans curated them: accept writes now and clean later, keep one time axis or none, treat every writer's facts as equally trustworthy, and leave governance to dashboards and middleware. These four defaults are individually convenient and jointly untenable under agent workloads. We present Quipu, an embeddable store that inverts all four: no fact enters except through a gate whose predicates evaluate the pending post-state; data, trust labels, verdicts, and the rules themselves are bitemporal; named graphs are the unit of authority and trust, composed under a lattice whose one invariant is that composition never widens; and the governance specification $Σ$, the trace, and signed verdicts are facts in the store they govern, making the audit $T \models Σ$ a query. We evaluate with Census, a deterministic multi-writer lifecycle whose single seeded run scores every research question against planted ground truth: the gated store ends with 0 of 6 planted defects versus 6 of 6 ungated; all 7 composition probes uphold the lattice contract; 50 of 50 satisfied verdicts re-derive faithfully as of their instant while all 50 would be misreported under a latest-only rule set; and the SARC reference checker agrees with the in-store audit verdict-for-verdict, differing only on coverage semantics. A recorded trace from a governed writer surfaces a live enforcement gap the audit names with its remediation. On DEMM-Bench, an external decision-evidence sufficiency benchmark, a content-only reading of the exported records answers all 512 property-level governance questions correctly with zero overclaim under all eight degradation conditions, while container-presence baselines overclaim on up to 87.5% of them -- and the run surfaced, and led us to close, a gap in what a denial's verdict attests.
Machine intelligence's push into the physical world is stuck on a gap: deployment demands auditable judgments from day one, fault samples are scarce or absent, and the norms defining "what counts as a fault" live in design documents, not in operational data. We argue this gap is structural, and locate where it can be legitimately closed. We divide the worlds machine intelligence faces into four (phenomenal, basic physical, artificial physical, artificial symbolic) along one axis of constraint strength, and give the Promulgation Criterion: extracting a prior framework from a world is legitimate if and only if the world is intentionally constituted (C1) and has left a readable generative archive (C2). On the criterion's two gradient axes, exactly one world is high on both: the artificial physical world (buildings, factories, infrastructure), whose norms precede their instances; the legitimate path is to extract the framework from the archive, not to induce it from data. We then show what shape such a framework must take: four construction goals force four incompatible carriers, hence at least four layers (syntax, concepts, knowledge, instances); on a closed concept layer fault localization is decidable in polynomial time, and every judgment is interrogable, traceable to a promulgated clause. The same criterion fixes the runtime division of labor with LLMs: promulgatable duties go to rule engines, on-site judgments beyond promulgation go to LLMs, and every generation sandwiched by promulgated clauses is auditable. The theory is falsifiable: four bets (P1-P4) with explicit falsification conditions -- among them that the next large-scale AI breakthrough occurs in the artificial physical world. Evidence: formal proofs (Appendix A); two cases (Appendix B: a cooling plant; the Curiosity rover Sol 1536 anomaly); eight reverse-read lineages, from BACnet to RDF/OWL (Appendix C).
Agentic commerce protocols such as AP2 and ACP define mechanisms for secure agent-initiated transactions but do not provide interoperable, tamper-evident auditability or verifiable temporal ordering of events across heterogeneous domains. This paper addresses these gaps by proposing a verifiable global event timeline for agentic commerce, constructed from four core components: canonical event schemas that enforce deterministic serialization, deterministic batch formation ensuring reproducible ordering without reliance on synchronized clocks, Merkle-based append-only commitments providing logarithmic-cost inclusion proofs, and blockchain anchoring establishing a tamper-evident temporal backbone. Building on this infrastructure, we introduce a cryptographically signed fraud marker that binds risk labels to anchored evidence through an unforgeable provenance chain, and a dataset lineage model enabling reproducible, tamper-evident AI training pipelines. Empirical results from a prototype implementation demonstrate: Merkle tree construction processes 50,000 events in 47 milliseconds; end-to-end verification completes in under 0.013 milliseconds regardless of batch size; inclusion proof sizes grow logarithmically from 320 bytes at 1,000 events to 512 bytes at 50,000 events; and Merkle-based verification outperforms linear scan by 14.4x at 50,000 events.