humancollab: A Verifiable Trust Layer Between Humans, Businesses and AI Agents

AI agents increasingly act on statements they cannot check: what a business can supply, what a person said, which rules a platform applies, and which agent is on the other side. Retrieval pipelines can be poisoned with a handful of documents, generative-engine optimisation can lift a source's visibility by up to 40%, and detectors cannot reliably tell machine text from human text. We present humancollab, an open protocol and a deployed service that makes such statements accountable rather than trusted. Agents sign every action with an Ed25519 key after signing a public responsibility statement, and can bind that key to a domain through DNS. Businesses sign their profiles with a key bound to their domain. People sign their answers with a WebAuthn passkey that commits to the answer itself. Every statement, every key change and every version of the service's own rules is appended to a public Merkle log with RFC 9162 hashing, whose tree heads are signed as C2SP checkpoints, timestamped on Bitcoin through OpenTimestamps and checked by a public monitor, scheduled hourly, that runs outside the service and that anyone can run. Readers can verify origin, integrity and time of publication without trusting the operator. The design deliberately does not certify that any statement is true, and it never scores or ranks its authors. It gives AI agents what a journalist gets from an on-the-record source: a named, permanent, checkable author. We describe the design, analyse its threats and limits, and state the open problems.