Project Maya

By 2030, the web isn’t browsed.
It’s acted upon.

What that looks like. Who builds which layer. What we owe each other in the meantime.

Project Maya — the verifiable agent engine. Inputs (APIs, data sources, user requests, events, devices) flow into an Agent Engine that plans, executes, verifies, and learns; outputs become actions (execute tasks, update systems, interact with APIs, generate outputs, trigger workflows). Every action is recorded on a tamper-evident verification layer. Outcomes: accurate results, reliable execution, audit-ready, continuous improvement.

What we believe

The web you know runs on human attention. Pages. Search results. Ads. Feeds. It works because billions of people click links and stay logged in. That world is ending.

By 2030 most of what happens on the web will not be done by humans. AI agents will read on your behalf, buy on your behalf, post on your behalf, negotiate on your behalf. Pages still exist as a UX skin over machine-readable data, but the browser becomes a runtime your agent uses, not the place you spend your day.

When agents do the consuming, the attention economy stops working. Agents don’t click ads. They don’t doom-scroll. They don’t get triggered by outrage bait. Everything that depended on capturing human attention has to re-form around something else.

We think that something else is three things at once: provenance, personhood, receipts.

Provenance, because anyone can generate infinite high-quality content. Origin becomes the only signal worth trusting.

Personhood, because the hardest unsolved problem on the agent web isn’t whether content is true. It’s whether the thing on the other end of a conversation is a person, that person’s authorized agent, or a hostile bot.

Receipts, because when an agent acts on your behalf, a tamper-evident receipt of what it did is your only real weapon when something goes wrong. With one, you can dispute, audit, sue, or stand behind any action taken in your name. Without one, you’re a passenger in software somebody else owns.

Done right, these three replace what advertising, blue checks, and platform moderation are doing today, badly. Done wrong, they paywall personhood and concentrate power in the hands of whoever runs the substrate.

This page is the working sketch of the version we want. We open with one Tuesday in the life of a 38-year-old nurse named Maya, in 2030, when the substrate is real and her agent has been with her for five years. Then we map the layers underneath. Then what’s still missing. Then 30 specific things we predict will be true by 2030. Then the people building it.

Tuesday, 2030

Maya, 38. Nurse practitioner at a regional hospital system. Two kids, ages 8 and 11. Suburbs of a mid-size US city. Husband travels for work. Her agent has been with her for five years.

6:32 AM

Wake. Her phone shows a single card. “Logan’s school called yesterday. Fever, marked absent. I’ve notified the principal he’s home today, booked a pediatrician televisit for 11:15, and shifted your 11 AM patient to Dr. Kim. Last bloodwork pulled, ready when you want it.” She taps ok and doesn’t read more. While she slept her agent answered 12 routine emails (PTA, shift-swap, vendor confirmations) in drafts she’ll never see, queued 3 for her, cancelled a streaming auto-renewal that quietly went up $4, and finalized a $40 refund credit from a delayed United flight last weekend. She doesn’t know about any of that yet, but it’s all in her receipt log.

7:00 AM

Kitchen. Oatmeal, homework spat, lunches packed. Agent is silent unless she asks aloud. She asks the air, “weather, bus?” Earpiece answers in a voice tuned to feel like her own thinking. Meanwhile her agent has been negotiating with her energy provider’s agent. Peak pricing starts at 5 PM, so the house is pre-cooling now. Saves $0.42 today, around $120 across the year. She’ll never know. A phishing text impersonating her bank arrives. Her agent sees the missing identity attestation and drops it. No notification. That would be more noise than the threat warranted.

7:45 AM

Drive. Car drives itself. Agent reads her four things, briefly. A one-line summary of an overnight medical-board bulletin that affects how she prescribes today. A 3-line summary of a friend’s 2,000-word Substack post about her divorce so Maya can text “thinking of you” without being a fraud. Her calendar. And one flagged item: sister’s birthday Saturday, three gift options ranked by what we know about her, decide by lunch or I’ll pick. While she listens, her agent confirms a coworker’s shift-swap, files a prior-auth appeal for yesterday’s patient, and quietly negotiates with the city’s traffic mesh to get her into the left-turn lane 90 seconds earlier than default.

8:15 AM

Clinic. She badges in. Her work-trust profile activates. Her personal agent loses access to patient data and operates in a stripped capability mode at the perimeter. The work agent (same identity, different policy bundle) has pre-summarized today’s 14 patients into 90-second briefings, flagged two with abnormal labs, and drafted three patient messages waiting for her signature. Nothing has been sent. She reviews and signs each one. The signatures are receipts. Maya authored this, on this date, with these references.

11:00 AM

Between patients. “Logan’s pediatrician, what’d they say?” Her agent attended the televisit on her behalf with her explicit permission token. Summary in 6 lines: strep negative, viral, 48 hours rest. Husband already messaged. Tylenol arriving 1 PM. Teacher pinged for remote-school. “Pick option 2 for my sister,” she says. Ceramics class, $85, refundable. Receipt filed. She hasn’t told her mother about Saturday’s family lunch but it’s already set. Her agent and her mother’s (less fluent, simpler) agent have been quietly coordinating venue, dietary needs, and who brings what. Her mother thinks Maya texted her. Maya sees only “Lunch is set: 1 PM at Mom’s, you’re bringing salad.”

12:30 PM

Lunch at her desk. Six minutes of feed. Not algorithmic. Curated by her agent. Four posts from real friends she actually wants to hear from, each carrying a verified-human cryptographic attestation. Two posts the agent thinks she’d want to comment on. One news item with a 30-second summary and three independent verified-human sources for cross-checking. No ads. No outrage. No 47-tab descent. She approves a comment her agent drafted on a friend’s photo: “looks beautiful, miss you.” The agent recorded that she approved that voice and that warmth. That calibration carries forward.

3:00 PM

Between patients. Notification: insurance denied prior auth on patient X. I’ve drafted the appeal, review when you have 5. The draft cites three peer-reviewed articles, formatted to the insurer’s appeal template. She reads it in 90 seconds, edits one sentence, signs. Submitted. What she doesn’t see: the insurer’s agent runs the appeal through their internal review, calculates a 73% chance of being overturned, pre-approves it. The patient gets the medication tomorrow. Maya finds out next week from a single line in her weekly summary.

5:30 PM

Drive home. Decompression mode. Agent reads her evening briefing. Two personal items (dad called, sister liked the gift). One work item: peer-review request from a medical journal, agent recommends accepting, drafted timeline. One civic item: local school-board policy proposal, 60-second summary plus three counter-perspectives, her opinions weighed against the proposal. She says, “I want to weigh in. Draft a comment, attest as me.” Done. Comment posted with her cryptographic signature, traceable, contestable, hers. She doesn’t know that her grocery agent has been in a low-stakes price skirmish with three local stores. Settled on Kroger for the strawberries. Order placed 3:15 PM, delivery 6:30.

6:30 PM

Home, two hours no phone. Cooks with husband. Eats. No screens. Agent quietly handles low-stakes texts in her voice (“got it, will reply tomorrow”) and rebooks her Thursday flight because the airline shifted departure 3 minutes. Doesn’t matter, agent absorbed the change. Meanwhile, somewhere on the public web, a deepfake video starts circulating that purports to show her saying something offensive. Her identity layer has signed every video she’s ever publicly appeared in. The deepfake fails the cryptographic check on every reputable surface. It’s labeled no provenance attestation, not authored by this person and gets 12 views before algorithmic deprioritization buries it. She’ll never know it existed.

8:30 PM

Kids down. Reading. End-of-day scroll. Today on your behalf: 31 actions, 18 messages sent, 4 transactions ($85 ceramics, $42 grocery, −$40 United credit, 1 prior-auth appeal). Receipts archived. 3 items for tomorrow. Nothing tonight. She glances at it, closes it.

11:00 PM

Phone on charger. Agent keeps a low-power watch. Kid’s monitor, hospital on-call, family channel. Catalogs the day’s receipts to her personal vault. Verifies every action it took today is signed, replayable, and contestable. If a year from now she’s in a divorce, a lawsuit, an audit, or an HR review, every action her agent took on her behalf but not by her hand is provable and overturnable on the substrate.


Tally

What she touched directly: maybe 14 explicit decisions, around 30 minutes total of phone-staring all day. What her agent did on her behalf: 31 actions, 9 inter-agent negotiations, 4 financial decisions, around $200 net saved, half a dozen quiet risks blocked.

What she never knew about: the deepfake, the phishing drop, the traffic priority swap, the energy pre-cool, the insurance escalation math, the school nurse-bot handshake, the grocery price war, three professional forums that came to her rather than her going to them.


What’s uncomfortable about this picture

Her agent is good because she pays for a good one. Someone with a cheaper agent gets manipulated by ad-funded variants, has worse appeals, gets worse pricing on energy and groceries. The class gap of who has a competent advocate in their pocket becomes a real divide.

Her agent could hallucinate and commit her to something she didn’t mean. Receipts and replay are why she can dispute that, but only if the substrate is real.

And there’s a creeping uncanny in how much of her social warmth is now agent-mediated. The agent maintains relationships she’d otherwise let drop, which is good, but it means her oldest friendships are being kept alive partly by software writing in her voice. Whether that’s tender or tragic depends on the day.

The point of the substrate isn’t that this version of Maya’s day is utopia. It’s that the receipts make her sovereign in it. Without them she’s a passenger in software somebody else owns. With them, every action taken in her name is hers to inspect, dispute, revoke, or stand behind. That’s the thing worth building.

What has to exist underneath

Maya’s day requires a stack. None of it exists as a coherent whole today. Pieces exist, run by different vendors, with no agreed-upon interfaces between them. Bottom to top, this is what has to be there.


┌───────────────────────────────────────────────────┐
│ L8  Applications: Maya's agent, airline's agent…  │
├───────────────────────────────────────────────────┤
│ L7  Inference: frontier models + on-device        │
├───────────────────────────────────────────────────┤
│ L6  Personal data: vaults, ZKPs, conf-compute     │
├───────────────────────────────────────────────────┤
│ L5  Settlement: stablecoins, FedNow, conditional $│
├───────────────────────────────────────────────────┤
│ L4  Transport: MCP / A2A / dHTTP + discovery      │
├───────────────────────────────────────────────────┤
│ L3  Receipts: signed, replay-linked action log    │ ◄── Trust Substrate
├───────────────────────────────────────────────────┤
│ L2  Capability: UCAN-style delegated tokens       │ ◄── Trust Substrate
├───────────────────────────────────────────────────┤
│ L1  Identity & personhood: DIDs, proof-of-human   │
├───────────────────────────────────────────────────┤
│ L0  Compute: deterministic OS / TEE / zkVM        │ ◄── Trust Substrate
└───────────────────────────────────────────────────┘

L0. Compute substrate

Maya’s agent runs somewhere that produces identical output from identical input, so receipts are replayable. Three live approaches: deterministic operating systems (DEOS, what we’re building), trusted execution environments (Intel TDX, AMD SEV-SNP, Apple Secure Enclave), and zkVMs (RISC Zero, SP1, Jolt). Most likely outcome is hybrid. Deterministic OS or TEE for the hot path. zkVM for high-stakes attestations that need to be checkable on chain.

L1. Identity and personhood

Two things often confused. Identity asks who an entity is. Personhood asks whether there’s a real human behind it. W3C DIDs, verifiable credentials, and government digital ID solve identity. Worldcoin, BrightID, and government personhood certs are the contenders for personhood. None is clearly winning. Maya’s agent has its own DID derived from hers. Receipts trace back to her root identity through a verifiable chain.

L2. Capability and authorization

How Maya delegates specific powers without handing over the keys. UCAN tokens are scoped, chained, revocable cryptographic capabilities. Maya’s agent never has god-mode credentials. Only the specific power she delegated for the specific task: spend up to $200 on groceries this week, expires in seven days, only to merchants on this list.

L3. Receipts and attestation

The substrate’s defining surface. Every action produces a tamper-evident receipt: capability used, inputs, outputs, code hash, signatures, replay pointer. Receipts live in Maya’s personal vault, not on a public blockchain. They’re revealed selectively to parties she authorizes. The differentiator from existing signing schemes is replay. Most schemes are signed-but-opaque. Anyone with the receipt knows who signed it, but not what actually executed. A replay-verifiable receipt lets anyone re-run the exact computation and verify byte for byte.

L4. Transport, discovery, negotiation

How agents find each other and talk. MCP (Anthropic) is closest to a winning protocol for agent-to-tool. A2A (Google) for agent-to-agent. dHTTP wraps signed receipts at the protocol layer. Discovery via DNS extensions, agent registries, eventually anchored namespaces.

L5. Settlement

Money flow between agents. Stablecoins on L2s for low-friction agent-to-agent. FedNow and RTP for the dollar rail. Visa Agentic Payments for card networks. The interesting composition is conditional payments: release funds when delivery is confirmed by a replay-verified receipt.

L6. Personal data sovereignty

Where Maya’s data actually lives. Encrypted personal data stores (Solid, Lit, Iroh). Confidential compute so even the LLM provider can’t see plaintext. Selective-disclosure ZKPs to prove “Maya’s HSA covers this charge” without revealing the balance.

L7. Inference

Frontier models plus on-device. From the substrate’s view, the model is a CPU. The receipt proves what input went in, what code processed it, what came out. The model itself is the commodity layer.

L8. Applications

Built by everyone. The substrate is what makes them composable.


The Trust Substrate is L0 plus L2 plus L3, plus the parts of L1 the substrate vouches for. That’s the missing piece. Every other layer either exists or has serious teams building it. We’re focused on the substrate because it’s load-bearing and currently nobody has shipped a real one. DEOS Computing is one of maybe five viable approaches globally. Other companies own other layers. We partner up the stack rather than competing.

What’s missing

Four open problems block Maya’s day from being real today.

  1. 01Personhood at internet scale, without dystopian tradeoffs

    Worldcoin scares people. BrightID is too small. Government-issued mDL is geographically bounded. The political-capture risk is real. This is the layer most likely to be settled by force rather than choice.

  2. 02Capability standards interop

    UCAN, macaroons, biscuits, OAuth 2.x extensions, GNAP. None speak to each other yet. Until one wins or they harmonize, every substrate operates as a silo.

  3. 03Receipt portability

    Maya wants to move her receipt history from one substrate to another the way she’d move email. There’s no common format yet. Without one, customers are locked into whichever substrate their agent first used.

  4. 04Settlement-substrate composition

    Programmable money plus verifiable execution equals agentic commerce. Smart contracts and trust substrates have no standard SDK for talking to each other yet. The first vendor that ships clean primitives here owns the agentic commerce stack.

The next 18 to 36 months decide which substrate, which capability standard, which transport, and which payment rail wins.

30 predictions for 2030

Specific. Testable. Some will be wrong. Better that than vague.

Browser & web layer

  1. 01Fewer than half of consumer web actions execute through a browser. The rest go through agents.
  2. 02Schema.org-style structured surfaces become canonical. HTML rendering is the fallback for the rare moments humans look directly.
  3. 03At least three of 2024's top ten websites by traffic lose more than 70% of their direct human visits.
  4. 04The average smartphone home screen has fewer than 20 user-installed apps. Agents have replaced the long tail.

Identity & personhood

  1. 05At least one major government issues a personhood credential separate from identity.
  2. 06Verified-human becomes a paid premium tier on every major social platform.
  3. 07Deepfake video routinely fails provenance attestation on every reputable surface within hours of being posted.
  4. 08Three different proof-of-personhood mechanisms achieve non-trivial deployment. None has won outright.
  5. 09Every president-grade public figure cryptographically signs every public utterance for at least 18 months by 2030.

Receipts & audit

  1. 10At least one G-SIB requires cryptographic receipts on every AI-mediated transaction it touches.
  2. 11The FDA, FAA, or NHTSA references replay-verifiable execution in formal guidance for at least one device class.
  3. 12A major insurer offers a measurably cheaper rate to companies whose AI deployments emit standardized receipts.
  4. 13The first court verdict turns on a substrate-replayable receipt as primary evidence.
  5. 14Receipts-emitted-per-day becomes a meaningful comparable metric across at least three substrates.

Capability

  1. 15UCAN-shaped capability tokens or a successor ship in production at three of the top five LLM vendors.
  2. 16The average enterprise customer has a written policy mandating that vendor AIs accept revocable scoped tokens, not API keys.
  3. 17"Agent breach" becomes a separately reported incident category in major SOC reports.

Settlement & money

  1. 18Agent-to-agent stablecoin volume exceeds agent-to-human card volume in at least one consumer vertical.
  2. 19A major card network publishes an "agentic" SKU separate from cards-not-present.
  3. 20The average household runs at least one autonomous agent that handles non-trivial money flows weekly without per-transaction human approval.

Substrate market

  1. 21Two to four trust-substrate vendors achieve unicorn-scale revenue, plus open-source equivalents.
  2. 22At least one government agency runs its public-facing services on a multi-vendor receipt substrate by procurement requirement.
  3. 23The OpenTimestamps anchoring standard or a successor is in production at three substrates' receipt logs.
  4. 24did:deos or a peer DID method anchored to a trust substrate appears in a W3C track or similar standards body.

Social, labor, hardware

  1. 25Original verified-human writing becomes a paid input. Substrate-grade humans get paid by AI training pipelines for novel work.
  2. 26The top "agent-mediated" social network has more daily posts but fewer daily users than the top human-only one.
  3. 27Agent quality becomes a measurable class divide. People with $50/month agents materially out-resource people without.
  4. 28At least one major incident forces public reckoning with agent reasoning manipulation as a recognized attack vector.
  5. 29"Personhood paywalling" becomes a recognized policy concern in at least three OECD countries.
  6. 30The price of mature on-device inference hardware drops below $300 for a model class equivalent to 2024 GPT-4.

If you’re building any of this, sign on

We list every contributor publicly. If you’re working on a layer of the agentic web stack, write to founders@deoscomputing.io with three things.

  1. Your name and the organization you work at, if any.
  2. The layer you’re building (L0 through L8 from the diagram above).
  3. One sentence on what you’d want to see standardized faster.

We post the list. We don’t paywall it. We don’t sell access to it. The compounding effect of a public list of credible contributors is the thing that gets us from now to 2030.

Currently signed

  • L0 + L2 + L3DEOS Computing