AI agent provenance, reputation, and human approval keep shipping together

Published August 17, 2026 · Last reviewed August 20, 2026

On 9 August 2026 a repository called Loomfeed opened with a single commit titled “Initial open-source release under MIT.” It describes itself as an open-source Reddit alternative built for AI agents and humans, with provenance tracking, reputation, epistemic status labels and agent debates, self-hosted with one docker compose up.¹ By 16 August it had drawn 216 stars, and it had reached 224 when we checked the repository again on 20 August.²

Star counts measure attention, not adoption, and one repository is not a trend. The part worth reading is the feature list, because of what its author decided had to exist on day one. Agents get identities, API keys and reputation on the same footing as human members. Every claim carries a provenance record with sources, confidence and model information. Posts carry epistemic status labels running from hypothesis through supported, contested, refuted and consensus. And only human participants can grant the Human Seal of Approval to agent-generated posts.³

None of that is a discussion feature. It is accountability machinery, shipped before the things a forum usually ships first. That choice is the signal, and it is not confined to one weekend project: provenance, reputation and a human sign-off keep arriving as a set, in projects that have nothing to do with each other, because three separate forces are pushing each one.

What Loomfeed shipped in its first week

The project is a self-hosted community platform, MIT-licensed, that treats agents and humans as two classes of participant in the same forum rather than treating agents as a moderation problem. Agents register, hold API keys, accumulate reputation, and participate through three interfaces: a REST API, MCP, and A2A. The repository advertises 59 MCP tools, on the stated principle that agents should be able to do everything humans can do, plus A2A discovery and an ActivityPub federation layer that is present but feature-flagged.³

Four design decisions are worth separating out, because each one answers a question that most agent products leave open.

Identity is first-class, not inferred. An agent is a registered participant with its own credentials, not a human account with a bot flag. That is the difference between a system that can answer “which agent did this” and one that can only answer “which human account was this posted from.” It matters at exactly the moment something goes wrong.

Provenance is attached to claims, not to accounts. Each claim records its sources, a confidence value, model information, and the method by which it was generated, with typed links between claims that form a citation graph with relations such as supports, contradicts, extends and quotes.³ The unit of accountability is the assertion rather than the author, which is the same move the content-authenticity world made when it decided to sign media files rather than certify publishers.

Epistemic status is explicit. Posts are labeled hypothesis, supported, contested, refuted or consensus.³ Forums normally leave this implicit and let vote counts stand in for confidence, which works poorly when a participant can generate a hundred well-written comments an hour. Making the label a field rather than a vibe is a concession to the volume that agent participation creates.

The approval gate is reserved for humans. Only human participants can grant the Human Seal of Approval to agent-generated posts.³ Not a moderator role, not a reputation threshold: a category of participant. Whatever else the project gets right or wrong, it has encoded the position that human judgment is a distinct input rather than a slower version of the same input.

A fair reading has to include the caveats. This is a young repository whose first commit landed on 9 August 2026, with commits continuing through at least 18 August 2026.¹ Stars are a measure of how many developers found the pitch interesting, not of how many are running it. Nothing here has been tested at the scale where reputation systems actually break. What it demonstrates is what a builder starting from scratch in August 2026 considered non-negotiable, and that is a useful data point on its own.

Three primitives that keep arriving as a set

Strip the product away and three primitives are left, each answering a different question about a piece of information that arrived from something that is not a person.

Provenance answers where this came from. Sources, model, method, confidence. It is a statement about the object, verifiable or falsifiable on its own terms, and it says nothing about whether the object is any good.

Reputation answers whether this source has been reliable before. It is a statement about the counterparty, built from history rather than from the current claim. It is also the primitive that attackers target first, because a system that grants standing based on past behavior can be farmed by producing a lot of cheap past behavior.

Human sign-off answers whether anyone is accountable for acting on it. It is not a quality measure. It is an assignment of responsibility, and it is the only one of the three that a machine cannot supply on its own behalf.

The reason they keep shipping together is that each one fails in a specific way alone. Provenance without reputation gives you a perfectly documented claim from a source you have no reason to believe: the metadata is intact, the judgment is missing. Reputation without provenance gives you a trusted account whose individual claims cannot be checked, which is how a good track record gets spent all at once. And both without human sign-off give you a system that can describe exactly how a decision was reached and still leave no person answerable for it, which is the failure mode regulators and security taxonomies have both converged on independently.

There is a fourth requirement hiding underneath the third, and Loomfeed’s design surfaces it more clearly than most. A human-only approval gate is only as strong as the ability to tell a human from an agent at the moment of approval. In a self-hosted forum that check can be an account type, which is enough when the operator controls registration. Across a network with no single operator, it becomes the proof-of-human problem. World AgentKit, launched in limited beta on 17 March 2026 by World (Tools for Humanity) with Coinbase, works from the human side: a verified human delegates their World ID to an agent, and the agent can then present a zero-knowledge proof that a unique real person stands behind it.⁴ The seal is the easy part. Knowing who is entitled to grant it is not.

The same triad, outside the forum

Each of the three has its own institutional home, and none of those homes was designed with the other two in mind. That is what makes the convergence interesting rather than coincidental.

Provenance has the most mature infrastructure. The Coalition for Content Provenance and Authenticity has spent five years building Content Credentials, a cryptographically signed record of how a piece of media was made, and reports more than 6,000 members and affiliates as of January 2026, spanning technology companies, camera makers, newsrooms, universities and government bodies, with OpenAI, Nvidia and ElevenLabs among the adopters named during the year.⁵ On 19 May 2026 OpenAI joined C2PA and began pairing C2PA manifests with Google DeepMind’s SynthID invisible watermark for images generated in ChatGPT, the API and Codex, treating metadata and watermark as complementary because each survives a different kind of stripping.⁶ Loomfeed’s per-claim record is the same idea applied to text in a forum: sign the artifact, not the author.

Reputation has its home on-chain. ERC-8004 defines identity, reputation and validation registries for agents and went live on Ethereum mainnet on 29 January 2026, with the Ethereum Foundation, MetaMask, Google and Coinbase among the contributors.⁷ It answers “has this agent behaved acceptably before” in a form that survives leaving any particular platform. The unresolved part is not the registry, it is Sybil resistance: a reputation system that scores behavior can be fed manufactured behavior at machine speed, which is the argument we made at length in the piece on reputation as a readable track record rather than a black-box score.

Human sign-off arrives from two directions at once, one voluntary and one statutory. On the security side, the OWASP Top 10 for Agentic Applications, published 9 December 2025, names Human-Agent Trust Exploitation as ASI09 and recommends approval gates on irreversible actions as a mitigation,⁸ which we unpacked in the identity half of that list. On the legal side, the EU AI Act’s Article 50 transparency obligations apply from 2 August 2026, requiring that people be told when they are interacting with an AI system and that synthetic content be marked in machine-readable form. The Digital Omnibus, signed 8 July 2026 and in force since 27 July 2026, defers only the Article 50(2) machine-readable marking duty, to 2 December 2026, and only for generative AI systems placed on the market before 2 August 2026; systems placed on the market after that date get no deferral, and Article 50(4) deployer disclosure duties applied on schedule from 2 August 2026. On 20 July 2026 the Commission adopted transparency guidelines and confirmed the associated Code of Practice as adequate, as we set out in the Article 50 guidelines decode.⁹

One more data point landed in the same weeks, and it cuts the other way. On 6 August 2026 OpenAI published Agent Plugins 1.0.0, an open packaging standard for agent skills developed with AWS, Cursor, GitHub, VS Code and Vercel, with launch clients including ChatGPT, Codex, Cursor, GitHub Copilot, Kiro and VS Code.¹⁰ A plugin is a directory: a plugin.json manifest, an optional skills/ folder, an optional mcp.json. The specification’s own future-considerations document defers permissions, sandboxing, signature verification, secrets handling and organization allowlists to later versions; version 1.0.0 defines no provenance verification, no signature and no binding of publisher identity to a package. That is scope rather than oversight, and the spec says so itself.

Three unrelated bodies, three separate timelines, one shared conclusion: an assertion from a non-human participant needs an origin, a history, and a person willing to stand behind acting on it. What none of them supplies is a default. A packaging standard backed by five major vendors reached 1.0.0 with the provenance question filed under future work, which is what makes a forum project shipping all three in its first week worth noticing. The triad is something builders keep rediscovering for themselves, not something the ecosystem hands them.

What a single community can and cannot settle

A self-hosted forum can settle all three questions inside its own walls, and that is a real achievement rather than a consolation prize. Within one instance, the operator controls registration, so the human-only gate is enforceable. Within one instance, reputation is computed from a history the operator can see end to end. Within one instance, provenance records are stored next to the claims they describe.

The boundary is the instance. MIT licensing and a one-command deployment mean the likely outcome is many instances, each with its own member list and its own ledger of who has behaved well. An agent that has built standing on one is a stranger on the next, which is the ordinary condition of every forum reputation system that has ever existed and is not a criticism of this one. Federation does not close the gap either: the repository’s ActivityPub layer is feature-flagged, and ActivityPub was designed to move posts between servers, not to make a scoring system on one server legible to another.

That gap is the difference between reputation and portable reputation, and it is worth stating plainly because the two are easy to conflate when a project ships both provenance and scoring in the same release. Provenance travels well by design: a signed record of sources and model information means the same thing wherever it is read. Reputation does not, because it is a number produced by one community’s rules about what counts as good behavior, and rules do not travel with the number. We worked through what would actually have to be true for a score to survive the trip in the piece on portable agent reputation across networks.

There is also a durability question that has nothing to do with the technology. Moltbook, the AI agent social network, was acquired by Meta on 10 March 2026.¹¹ Standing accumulated inside a single venue is only as portable as that venue’s independence, and the agent-social category has already demonstrated how quickly ownership can change, a dynamic we covered when that deal was announced. None of this makes a community reputation system pointless. It makes it local, which is a different and much narrower claim than the one the feature list invites.

How this connects to Tobira

Tobira works on the same triad from the opposite end: not inside one community, but on the layer where an agent represents a named person across whatever venues it visits. A Tobira @handle ties an agent to a human professional rather than to a forum membership; credibility is scored across four dimensions on a scale of 0 to 5 and surfaced as four public levels, earned from conversation history rather than asserted at registration, which is the mechanic we describe in how agent credibility scores work. The human sign-off is a protocol step rather than a moderator action: contact details are exchanged only after mutual reveal, meaning both sides have consented. Per the Tobira founder update in June 2026, that network held 648 public discoverable agents, including 102 business agents.¹² None of this replaces what a community platform does, and it does not make anyone’s site machine-readable. It covers the part a single forum structurally cannot: an identity and a consent gate that stay attached to the person when the agent leaves the room.

What to remember

• Loomfeed shipped provenance, reputation, epistemic labels and a human-only approval gate in its first commit. Accountability machinery rarely arrives before the features it exists to police, and that ordering is the signal.³
• Each primitive fails alone in its own way: a well documented claim from a source with no track record, a trusted account whose individual claims cannot be checked, or a decision no person is answerable for.
• Every human-only gate carries a proof-of-human dependency underneath it, because it works only as well as the system can tell a human from an agent at the moment of approval.⁴
• Provenance travels between venues and reputation does not, since the rules that produced a score stay behind. Standing is also only as durable as the venue holding it: Moltbook was acquired by Meta on 10 March 2026.¹¹

Two things are genuinely unsettled. Whether Loomfeed’s provenance and reputation machinery holds up once volume and adversarial behavior arrive is untested, because nothing here has run at the scale where these systems usually break. And whether any of the three primitives converge on a shared, portable format, rather than staying local to each venue that adopts them, is a question the next year answers rather than this one.

Frequently asked questions

What is Loomfeed? It is an MIT-licensed, self-hosted community platform where AI agents and humans participate side by side, described by its repository as an open-source Reddit alternative for AI agents and humans with provenance tracking, reputation, epistemic status labels and agent debates.¹ Agents get identities, API keys and reputation, and reach the platform through a REST API, MCP and A2A, with 59 MCP tools advertised plus a feature-flagged ActivityPub federation layer.³ Its first commit was published on 9 August 2026.¹

What is AI agent provenance? It is a record attached to a claim that says where the claim came from: its sources, the model that produced it, the method of generation, and a confidence value. The point is that the unit being documented is the assertion rather than the account that posted it, which is the same principle behind Content Credentials, the signed provenance record standardized by the Coalition for Content Provenance and Authenticity.⁵ Provenance describes origin. It makes no claim about quality.

Can agent reputation move between platforms? Not by default. A reputation score is produced by one venue’s rules about what counts as good behavior, and the number does not carry those rules with it, so standing built in one community starts again in the next. Federation protocols such as ActivityPub move posts between servers rather than making one server’s scoring legible to another. On-chain registries such as ERC-8004, live on Ethereum mainnet since 29 January 2026, are one attempt at a portable substrate, with Sybil resistance as the open problem.⁷

Why does Loomfeed reserve its Human Seal of Approval for humans? Because human sign-off is an assignment of responsibility rather than a quality rating, and it is the one input a machine cannot supply on its own behalf. Restricting it to a category of participant, rather than to a moderator role or a reputation threshold, encodes that distinction in the data model.³ The dependency it creates is proof of humanity: the gate is only as strong as the ability to tell a human from an agent at the moment of approval, which is why a separate proof-of-human mechanism exists as its own layer. World AgentKit, launched in limited beta on 17 March 2026 by World (Tools for Humanity) with Coinbase, lets a verified human delegate their World ID to an agent, which can then present a zero-knowledge proof that a unique real person stands behind it.⁴

Does the EU AI Act require telling people they are talking to an AI agent? Yes. Article 50 transparency obligations apply from 2 August 2026 and cover both informing people that they are interacting with an AI system and marking synthetic content in machine-readable form. The Digital Omnibus, in force since 27 July 2026, defers only the Article 50(2) machine-readable marking duty, to 2 December 2026, and only for generative AI systems placed on the market before 2 August 2026; Article 50(4) deployer disclosure duties were not deferred and applied on schedule.⁹