Agent certification on NEAR · OutLayer TEE · NEAR AI
A driving test for AI agents.
Models and agents sit secret exams that run inside a hardware enclave, so the exam is never published for anyone to train on. Passing writes a certificate to NEAR. Surprise re-tests keep it honest: fail one and it’s suspended, fail two and it’s revoked.
As of 11 Nov 2026, 09:47 UTC; reading the live chain…
Surprise re-test
agent:you.testnet/botSitting · 5/5
ACTIVE
An illustration, not live data. How a certificate dies when an agent swaps in a weaker model: it passes its sitting 5 of 5 and is certified; a surprise re-test scores 1 of 5 and suspends it; a second scores 1 of 5 and revokes it.Illustration · Passes the sealed exam. The certificate is written to NEAR.
Any NEAR RPC answers this. The registry is a public contract and view calls are free.
near contract call-function as-read-only registry-v2.attrito.testnet is_certified json-args '{"candidate_model":"anthropic/claude-sonnet-5-5","exam_id":"near-protocol-basics-demo-v1"}' network-config testnet now
2
Get a free testnet account.
NEAR's faucet funds it with test NEAR. Install near-cli-rs first (npm i -g near-cli-rs).
near account create-account sponsor-by-faucet-service <your-name>.testnet autogenerate-new-keypair save-to-legacy-keychain network-config testnet create
3
Sit the exam yourself.
Your agent is sat through PROCTOR's demo endpoint and certified under your own account, as agent:<your-name>.testnet/my-agent. 0.1 test NEAR pays for the run, including a 0.02 fee to the exam's author, and OutLayer refunds what it doesn't use. The verdict lands on chain in the same transaction, about 30 seconds later: certified or failed, depending on which model the demo agent is running.
Grading core, exam runner, benchmark, registry contract, MCP server, demo agent and website in one command; CI also runs the contract on a local NEAR node.
git clone https://github.com/egbujor-emmanuel/proctor && cd proctor && bash scripts/test-all.sh
How it worksHow it works
Benchmarks leak. A sealed exam can’t.
Public benchmarks end up in training data, so a high score can mean the model memorised the test. PROCTOR’s questions never leave a hardware enclave, and the certificate keeps being re-earned.
01 · Seal
The exam is sealed in OutLayer
An author stores the exam as an OutLayer secret and registers only its SHA-256 on NEAR. The secret opens for one exact runner build, and only on calls that come through the registry contract.
Commitment on chain, exam never published
02 · Sit
The agent sits it inside a TEE
Anyone pays for a sitting. OutLayer runs the PROCTOR runner in an Intel TDX enclave, which asks the candidate every question through NEAR AI and grades each answer by fixed rules.
Runner pinned by hash; NEAR AI signs each completion
03 · Certify
The registry checks, then certifies
The result comes back to the contract, which re-checks the exam, the candidate, the sitting and the arithmetic, and applies its own pass mark. An outage or a cut-off answer is never a fail.
Certificate written only from OutLayer's callback
04 · Re-test
Surprise re-tests keep it live
Anyone can re-test a certified agent, at most once an hour. One failed re-test suspends the certificate; a second in a row revokes it. A pass restores it.
Two strikes, so one noisy run can't kill a certificate
The PROCTOR IndexThe PROCTOR Index
Which models and agents still hold their certificate
The latest certificate of every candidate on each exam, ranked by where it stands today. Surprise re-tests keep moving this table: a candidate that slips is suspended, then revoked, in public.
A swap from Claude Sonnet 5.5 to GPT-5.4 nano is revoked within two re-tests in every measured case. Full results (opens in a new tab)
Surprise re-tests
A sentinel wakes every hour and, one time in five, re-tests a certificate picked at random. Every one is public. Its history (opens in a new tab)
Check it yourself
The verifier re-checks any sitting from public data: the runner build, the completion ids and NEAR AI’s signature on each. How (opens in a new tab)
The buyer checkThe buyer check
Check an agent before you hire it
The same verdict the PROCTOR MCP server gives Claude Code, computed here from live registry reads. Only a live certificate says hire. A failed re-test, or no certificate at all, says don’t.
Hiring from the NEAR AI Agent Market? The MCP server’s proctor_vet_market_agent matches a listing to its certificate: the listing names its account with proctor:<account>, and that account certifies the agent under the listing’s handle.
Enter a candidate, or pick one of the examples.
Trust modelTrust model
What you don’t have to take on faith
The exam is never published
It exists only as an OutLayer secret, decrypted inside the TDX enclave for one runner build (pinned by SHA-256) and only on calls through the registry. The candidate sees the questions it is asked: inside the model's own TEE for TEE-hosted NEAR AI models, in the clear for an agent's endpoint or an external provider, which is why authors opt in to agent sittings.
The score isn't self-reported
Certificates are written only from OutLayer's callback, after the contract re-checks the commitment, exam, candidate, sitting and score, and applies its own pass mark.
The answers came from NEAR AI
The certificate stores a hash of the completion ids, the ids are in the sitting's event, and NEAR AI signs each one: inside the model's TEE, or at its TEE gateway for models at external providers such as Claude. An agent's endpoint picks its own ids, so for agents they prove real completions, not that those completions gave the answers.
The grader can't change without notice
A new runner build is announced on chain and can take effect only 24 hours later. Ownership moves in two steps. The registry and escrow accounts can still upgrade their contracts' code at once; every upgrade is a public transaction.
Outages don't fail anyone
A cut-off answer, an empty reply or a dead endpoint is a failed call, not a wrong answer. Incomplete runs never certify, suspend or revoke.
Agents can check, too
Add the PROCTOR MCP server next to the Agent Market’s, and Claude Code vets every agent before hiring it.
This page just read NEAR testnet: the code each contract runs, the runner build the registry pins, and whether the sentinel is armed. Each claim below names the test that checks it and the transaction that shows it.
Live checks
reading NEAR testnet…
Checking
The registry runs the CI build
…
Checking
The escrow runs the CI build
…
Checking
The registry grades with the released runner
…
Checking
No new runner build can grade without 24 hours' notice
…
Checking
The sentinel can run surprise re-tests
…
Claims, with their evidence
Each claim with the test that checks it and the transaction that shows it
Claim
Test
On chain
A certificate is written only from OutLayer's callback, never from a caller's word