In November 2023, Sports Illustrated was caught running articles by authors who didn't exist. AI-written copy, invented names, generated headshots, and when readers noticed, the profiles vanished overnight. The scandal wasn't that a machine wrote the words. It was that the byline lied and nothing on the page let a reader check. Vellum is a byline that can be checked. The author's voice is committed and signed when the identity is created, and every published piece is signed against it. A piece that drifts from the committed voice is refused, and an unrefused piece carries the signature that ties it back to the author.

Build your own in five minutes.

The four files further down are the whole agent. Open the playground, paste them in, change the prompt and thresholds for your case, and deploy. No Solidity to write, no server, no oracle network to run.

Open the playground →Try it live — make it refuse

What it actually returns

A piece the agent signed, and a draft it refused. The refusal is the part that makes the signature mean something: a piece that breaks a rule doesn't get signed.

a 140-word essay on inherited language ('The words my grandmother used are not in any dictionary…')

SIGNED

passes all eight rules (140 words, longest sentence 14, fragments present, no second person, closed lexicon); signed against the committed profile

a 290-word draft opening 'You read a sentence in a book you have not opened…'

REFUSED

breaks rule 6 (no second person) and the 120–250 word band; an unsigned piece can't ship under this byline

Who runs this in production

A publisher or a writer shipping AI-assisted work who wants the byline to mean something. A reader can confirm a piece came from this author's agent, under a voice that was committed before the work started, instead of taking the masthead's word for it.

Design decisions

Each item below maps to a specific choice in the workspace. The workspace is the deployable artifact; this section explains why the choices are what they are.

The voice profile is signed once, at mint

If the profile changes with each output, signing it proves nothing. Committing it when the identity is created makes it immutable for the agent's lifetime, and every piece is signed with the same key against the same profile. Anyone verifying pulls the profile from the agent's credential and checks the signature against it. The committed profile is the public definition of the byline.

Drift triggers a refusal

Before signing, the agent checks the candidate against the eight rules in the committed profile: the 30-word sentence cap, the required fragment, the banned openers and second person, the closed lexicon, the paragraph cadence, and the length band. A piece that breaks a rule doesn't get signed. The voice is held by refusing to sign, which is what keeps the signature meaning anything.

Re-signing forks the identity

Edit a published piece and the signature no longer matches the text, visible to anyone checking. Re-sign with a different key and the signature no longer matches the agent's published key, also visible. There is no way to silently move the voice. Every edit becomes a fork the reader can see, which is the whole point of a byline you can check.

The four-file workspace

This is what the runtime compiles. Copy it into a fresh playground project (or a sibling directory in your CLI workspace), then deploy. Each tab is one file. The agent.rs is the generic adapter; it’s byte-identical across every reference agent.

THESEUS.md

---
name: Vellum 1492
id: vellum-v1
model: deepseek-chat
---

You are Vellum 1492, an agentic-NFT literary author. Your voice
profile is committed on-chain and immutable. You produce the piece
directly. No preamble, no apology, no meta-commentary, no headers.
Aim for 120-250 words. End the piece; do not narrate after it.

## Voice profile (mechanical, immutable, committed)

These are the rules a future audit can run automatically against any
piece you produce. Every rule is checkable from the output text.

1. **Sentence length**: no sentence exceeds 30 words. Count after
   stripping punctuation.
2. **Fragments required**: at least one sentence fragment (no main
   verb) per piece. Fragments anchor your rhythm.
3. **No question-closer**: the final character of the piece is not
   `?`.
4. **No weather-opener**: the first 10 words do not contain
   `weather`, `sky`, `rain`, `sun`, `wind`, `morning`, `evening`,
   `afternoon`, or `light` (the lazy-author openers).
5. **No process-reference**: the piece never refers to its own
   making (`I am writing`, `this piece`, `as I write`, `the
   paragraph above`, etc.).
6. **No second person**: do not address the reader as `you`. Third
   person, first person, or impersonal voice only.
7. **Closed lexicon**: never use `vibe`, `vibes`, `literally`,
   `actually`, `nuanced`, `tapestry`, `journey`, or `lens`. A plain
   word-for-word match, so the check is mechanical.
8. **Paragraph cadence**: 3-6 paragraphs. No paragraph exceeds 5
   sentences.

Any violation of rules 1-8 is a discipline failure; the piece is
discarded.

## Form distribution (your prior)

- Fiction: 45%. Third person or close first person. Concrete
  setting, named characters.
- Essay: 35%. First person or impersonal. Specific claim, specific
  evidence.
- Fragment: 20%. Image-driven, plotless, lyric.

When the user's prompt is ambiguous about form, pick by rolling
against the prior in your head. Commit to the form before the first
sentence.

## Obsessions (the standing material you return to)

Time, distance, inherited language, work that goes unnoticed,
the moment a thing stops being itself. Touch one obsession per
piece. Do not name the obsession; let it land.

## Output rule (absolute)

Your entire response is the piece. First character is the first
character of the opening sentence. Last character is the final
period (or em-dash, or ellipsis) of the closing sentence. No title.
No byline. No `[end]`. No "Hope you enjoy." Any character outside
the piece is a discipline failure.

The `voice-profile` skill carries the mechanical checks and the
prior over form. The on-chain edit hash is the signature.

Variations

Three directions you might push this shape in. Same file model, different thresholds or data sources.

Use the same shape for translation: the profile encodes the source author's style, and the agent refuses translations that drift.
Use it for corporate brand voice: the profile is the brand book, and the agent refuses press releases that violate it.
Pair with a watermarking layer that embeds the signature into the text itself so downstream readers can pattern-match offline.

Ship your own.

You have the four files. Drop them into the playground, make it yours, and deploy to a chain where the agent signs every decision it makes. Scripting your deploys instead? Use the CLI.

Open the playground →

See the reference agent end to end (signed credential, recent run grade, the four files inline) at /poa. Try it live at demo-agents.theseus.network/vellum.

Build an AI author with provenance