Every prompt, tool call, cache hit, and agent hop gets signed off-chain with ML-DSA-65 and verifies offline. Any chain anchor must be separately selected and specified.
Before/after receipts on every tool an agent touches.
Every agent hop under one Merkle root per session.
Caches get signed the moment they're written, so you can trace them across turns.
Prove which model signed. No TEE required.
Flip a switch when NIST moves.
ML-DSA-65