Expeditions

Brussels. The ENFIELD network of excellence closed its Horizon Europe run on trustworthy AI with a final conference at the Academy Palace on Rue Ducale. The institute's question there was the one that runs through the whole year: what should an AI agent have to prove before it is allowed to act in someone's name? The answer we argued for is a mandate that is bounded and revocable, carried on the rails of the EU Digital Identity Wallet, with every action leaving signed evidence a stranger can verify without asking us.

Epirus. From Thessaloniki by car west into the Pindus, to Ioannina on Lake Pamvotis, and the next morning into the Vikos gorge, said to be the world's deepest for its width. Off every programme; the study days that an expedition needs.

Lesvos. The ENFIELD summer school AICYBERSEC 2026 in Mytilene, hosted by the University of the Aegean, with Anatolia across the strait. On the last day we opened the live verifier on a laptop and asked 5 researchers to break it rather than admire it. One of them took the public artefacts home, ran the replay, matched the manifest, and handed back the defect we had missed: two different attestation quotes travelling under the same filename. That is the outcome an expedition is for.

Vienna. IETF 126, the institute's first IETF meeting: 2 days at a hackathon table by the Stadtpark, where the evidence format was cross-verified against an open-source COSE provenance stack from Telefónica, with byte-identical canonicalisation and a negative vector failing closed. The same week the institute filed its first individual Internet-Draft, composing an Action Evidence Package with remote attestation under RATS, and the media type that IANA registered in August. On 20 July a side meeting on remote attestation for AI agents; the speaker notes are public.

What came of it. The replay defect from Lesvos was fixed and the verifier re-released. A freshness gap we had reported in an open-source attestation verifier got part of its fix in review, written by someone we had never met. The Internet-Draft reached its 6th revision by the end of August and became the companion of an IEEE Internet Computing article.

The expedition had two parts and 5 results that matter most.

Reykjavík: what survives of a signed public record. 5 conversations: the operator of the national trusted list, a specialist at the population register, the chair of the research-ethics committee, the head of digital projects at the national library, which runs the web archive, and the chief executive of the submarine-cable operator. The trusted-list operator confirmed that the version number rises by 1 per release, which validates a denominator in our trusted-list history work, and that signer names in archived versions are public data. Our own measurement, as of 11 September: the list had 41 versions; our corpus holds 29, 9 survive only in the national web archive, and 12 could be found nowhere, including an unbroken run of 6. A host change had silently dropped the list from the crawl. The lesson is about custody: a signed record is only as durable as the institution that keeps copies of it.

Enschede: a formal neighbour we did not know. At the XAI-EADM workshop at CBI & EDOC 2026 we presented carrier-bound evidence profiles for X-Road. The person who started the EDOC conference series pointed us to delegation chains in the enterprise language of the Open Distributed Processing reference model; within days he had extended his own verifier for multi-parent joins, and all 98 verdicts of our 12 MandateGraph test cases agreed with it. Our related work gained 2 neighbours it had missed.

Rome: when 2 verifiers disagree, the specification is the third judge. 3 talks at 3 ESORICS 2026 workshops at Sapienza University: brokered trust against single-root failure (TCI), the SD-JWT differential-fuzzing paper now published in LNCS (STM), and cross-verifier disagreement in AI-agent evidence over X-Road (RAISE). A conversation after the last talk put our IETF draft on the desk of 2 researchers at a Dutch applied-research organisation; nothing is agreed, and a second, independent implementation is what we hope for.

Pavia and the lakes. First in-person meeting with the co-authors of our work on safe-AI metrics at the University of Pavia, then 3 quiet days on Lago Maggiore. Study days are where talks get rebuilt and the next month's manuscripts begun.

Tallinn, Helsinki. The main stage of BSides Tallinn on 25 September, the largest room we have spoken in: recording. On 28 September the retraction research reached 2 outside audiences: an interview for Atlas, the science programme of Estonian public radio (broadcast 4 October, with an article on ERR News), and a lightning talk at FORRT's online conference on AI in metascience (recording). On 29 September, at the Connect4Cyber brokerage day in Helsinki, the institute pitched first in the session: coordinators and pilot owners wanted for the cyber calls of 2027.

Sophia Antipolis: the certification asymmetry, said aloud. At the ETSI/CEN workshop on the EU Digital Identity Wallet we ran a demonstration table in the breaks, with the mandate-and-evidence demonstration on a laptop. In the session on relying-party registration we asked the panel whether anyone checks that a relying party's software rejects a tampered credential. The answer: eIDAS requires certification of qualified providers, not of relying parties, and no one is responsible for the relying-party side. The same gap came up 4 more times in 2 days, from a legal expert's slide, from the speaker of ENISA, the EU Agency for Cybersecurity, and from the Commission's own conformance framework for the wallet, which tests wallet interfaces only. Field evidence for a manuscript in preparation; the limit stays that our census measured libraries, not deployed relying parties.

Provence: real science beside the road. A round table in Marseille on the possibility of life elsewhere, with the Jupiter Icy Moons Explorer and the exoplanet count on the slides; a science night where a researcher advised us to learn French, the fourth language recommended on this trip; and the open day of the Haute-Provence Observatory, in the dome of the 1.93 m telescope with which the first exoplanet around a Sun-like star was found in 1995. At the aerosol network's stand we asked what happens to field data when the calibration after deployment differs from the one before. They recalibrate. That is a measurement discipline with a chain of custody, and it is our subject in another language.

Friday, Brussels. The first Management Committee meeting of COST Action CA25178 on agentic physical AI, at the COST Association, 09:30 to 17:00. Officers elected, 5 working groups set up, and the institute's theme, evidence and conformance for the actions of embodied agents, placed as a cross-cutting task with 2 concrete pieces of work taken on in the room. The news item has the detail. Then the evening train to Paris.

Saturday, Paris. The last weekend of the Fête de la Science, spent in the Latin Quarter. The Jardin des Plantes first, with the plaque on the house where Becquerel found radioactivity in 1896. Then the Panthéon, where Foucault's pendulum was photographed twice, 43 minutes apart: at the latitude of Paris the plane of swing should have turned about 8 degrees between the 2 pictures. At the Musée Curie, a panel on the laboratory's service des mesures: for decades it measured samples of radium for industry and medicine and issued a numbered certificate for each one, thousands in all, much of the work done by women. A trusted laboratory, a numbered certificate, a signature that industry and medicine accepted: the institute's subject, a century early. In the same room a particle-physics laboratory from Caen assembled a cloud chamber with the public, from Wilson's question about how clouds form to a neutrino telescope on the floor of the Mediterranean.

At the open day of ESPCI Paris, a public lecture by a physicist of the Institut Langevin on walking droplets: a drop that bounces on a vibrating bath and is pushed along by its own waves, 2 drops that talk to each other through the surface, a time mirror on water. We asked, in English, whether the drops reach de Broglie's pilot wave and non-locality. The honest answer was that non-locality is what the droplets cannot do. The lecture produced a notebook, a small simulation and a brainstorm at home; whether it produces more is a later decision.

Sunday, Paris. The Institut d'Astrophysique de Paris: the Euclid stand, where we asked about weak lensing and the dark-matter map, and a public talk by the institute's director on hunting neutrinos to read the violent universe, including the radio-antenna array of the GRAND collaboration and a timeline of how geopolitics shaped where the experiment could be built. A 5-minute conversation afterwards about data provenance and integrity in a large distributed instrument ended with a request for a one-page note, which went out the next day. Then the train to Brussels and the evening flight to Tallinn.

Three laboratories on the weekend's plan were not visited; the plan was a menu, not a timetable. Nothing in this epilogue was recorded for publication, and no slide of another presenter is reproduced.