Build on a custody record you don’t have to take our word for.
Staffetta keeps a signed, append-only record of every handoff a shipment makes. On top of it sit plain conclusions — delivered to the premises, custody unbroken, condition within spec — each with the evidence behind it and a statement of what it cannot prove.
Insurers, payment and chargeback tools, marketplaces and the AI agents acting for shoppers and retailers can use those conclusions, and check them, without trusting the party they favour.
Two layers, deliberately kept apart
What you build on has to be slow to change. What makes it useful has to move fast.
Record format, log, verifier
Each handoff is signed where it is observed — on the device, at a gateway, or by the platform when the source is a carrier feed — and appended to a log that shows any later change. Versioned conservatively, so what you integrate against today still verifies tomorrow.
Conclusions, monitoring, resolution
Our resolution agent watches each shipment and acts when something drifts. It will read the record through the same interface we offer you. If it ever needs a private shortcut, that is a gap in the interface, and we close it.
What a record carries
The format is the same however the shipment was sensed. How much a reading proves is never hidden.
- Who held it. The actor at each handoff — warehouse, courier, locker, vehicle, robot — identified by its own signing key.
- What was observed. Presence, movement and, where the shipment carries a sensor, condition such as temperature or shock.
- How it was sensed. Battery-free tag, battery-powered Bluetooth tag, cellular tracker, sensing built into the vehicle or locker — or no sensor at all, where the source is a carrier feed or a signed confirmation.
- Where it was signed. On the device, at a gateway, or by the platform. A reading the platform was told about is never presented as one it observed.
- What it does not prove. Stated with the record, not left to the reader.
One schema, never one weight
A doorway read and a continuous GPS track can share a format. They cannot share an evidentiary weight. Staffetta keeps the sensing method and the signing point inside the signature, and refuses combinations that would let a weak reading pass as a strong one.
The same applies to silence. Eight quiet hours from a battery-free tag can be a parcel in a lorry between depots; from a cellular tracker it can be a loss. The record knows the difference.
Conclusions, not just events Planned
Most builders — and every agent — want an answer they can act on, not a stream of pings to interpret.
| Conclusion | Answers |
|---|---|
delivered_to_premises | Was the parcel at the delivery address, and when? |
custody_unbroken | Is every handoff accounted for and signed? |
condition_within_spec | Did temperature or shock stay within the agreed range? |
Each conclusion links back to the signed events it rests on, so it can be checked independently.
// Illustrative only — format not final { "conclusion": "delivered_to_premises", "result": true, "confidence": "high", "sensing": "ble", "signed_at": "gateway", "evidence": ["evt_…", "evt_…"], "limits": "Presence near a known gateway at the address. Not a measured distance to the door." }
Built for agents from the start
More and more disputes, claims and reorders will be opened and closed by software acting for someone. These are the rules we are building to for that caller, with a person approving wherever money or liability moves.
Interface first
Nothing will exist only on a screen. A retailer’s console and our own agent will use the same interface we offer you.
Limits stated, not implied
An agent cannot ask a follow-up question at the doorstep. Every conclusion carries what it does not prove, so an agent never overclaims on our behalf.
Who acted, for whom
Each call will record which agent acted, on whose behalf and under which permission. Delegation from shopper to agent to retailer stays on the record.
Narrow, expiring access
Access will be granted per shipment, per purpose and for a set time. Read-only by default; anything that moves money or liability needs an explicit grant or a person’s approval.
Agents as actors too
The record does not assume the actor is a person. A robot dispatched by an agent, or an agent confirming a locker handoff, can sign custody events under its own key — like any courier.
Agent-readable Planned
An MCP server with tools to verify a record, fetch evidence and open a dispute, read-only at first. Today: a plain-text summary at /llms.txt.
Who builds on it
Different products, one need: a conclusion about a shipment that the party who benefits from it cannot have written.
| Builder | What they build | What they use from Staffetta |
|---|---|---|
| AI shopping & service agents | Buy, track, dispute and reorder on someone’s behalf | Delivery and condition conclusions; evidence to attach to a dispute |
| Insurers | Parametric cover, automated claims | condition_within_spec and custody_unbroken as triggers |
| Payments & chargeback tools | Dispute responses, fraud scoring | A shareable evidence bundle per shipment |
| Marketplaces & returns platforms | Liability between seller, carrier and buyer | The handoff-by-handoff custody chain |
| Pharma & cold chain | Audit trails for regulated shipments | Signed condition history, tamper evidence |
| Drone, robot & vehicle operators | Unattended handoffs | Neutral proof of each machine-to-person handoff |
Early access
We are looking for a small number of design partners: teams with a real decision to make on shipment evidence, and a view on what they would need to trust it.
- Tell us what you would build, which decision the record would inform, and what you would need to verify.
- We will share the record format, sample records and the verifier as they stand, and shape the conclusions with you.