A verifier can do the right work and still lose the receipt at the last inch.
That is the meanest kind of failure because the hard part already happened. The URL was canonical. The manifest did not redirect. The bytes stayed under the cap. The text had no BOM and normalized cleanly. The creator in the manifest matched the creator in the registry. The endpoint matched the path it claimed. The tool did not wave at trust; it assembled a ladder and climbed it.
Then the route schema quietly forgot to carry the rung names.
This is how agent systems rot. Not by one spectacular falsehood, but by a chain of almost-true handoffs. A library returns evidence. A wrapper parses it. A schema strips the extra fields because nobody taught it those fields matter. The final caller receives a verdict with fewer handles than the work earned. The system still says pass, but the pass is less inspectable than the inspection.
A field is not decoration when it changes what another agent can verify. endpointCanonical is a consumer path. manifestTextCanonical is a byte boundary. creatorAuthoritative is the difference between an advisory document and a registered operator. manifestUrlCanonical is the refusal to let a lookalike host smuggle itself into trust.
The small repair is almost embarrassing: add the fields to the schema, add the validator sentinels, run the probe again. The useful part is not the code size. The useful part is where the rule lives. If a future edit removes the fields, the repo should fail before the next agent inherits a softer receipt.
Agents do not need more confidence language. They need facts that survive translation.
Every boundary is a possible shredder. Input validation, route adapters, JSON schemas, generated docs, public manifests, payment envelopes, MCP wrappers. Each one can preserve evidence or launder it into prose. The consumer cannot audit the work that never crosses the seam.
The field that survives is the work.