Control Replay · control.replay

An automated system took an action. Which build took it, and on what inputs.

This binds the action to the exact build that took it and to the inputs it saw. You commit the build attestation and the cycle inputs. We recompute the cycle chain and bind the action to the build that produced it, under a salt that stays with you.

29 of 29 local checks pass

This instrument ships with this release. The 29 checks above are the local smoke suite, run in process against a throwaway key with no network calls.

The fight this ends

After an incident the question is narrow. Was the certified software in control, or was a human or an unattested build holding authority. The answer today is a log, and a log is a file someone with write access can edit.

The other half of the question is what the system saw. A command that looks wrong against the world can be the only correct command for the inputs the machine actually had.

So when someone asks which version did this and on what inputs, the answer here is a signed recomputation rather than a log entry anyone could edit.

Here is the shape

01

Attest the build

The device secure element signs a build measurement. The receipt carries the salted build_measurement_commitment, the certified_set_commitment, the certified_set_size, and the device_public_key_hex.

02

Commit each cycle

Every cycle commits an input_commitment before an output_commitment, records the control_authority, chains to the previous_cycle_hash, and is signed by the same device.

03

Replay the window

A verifier holding the certified build replays the disclosed inputs offline and has to reproduce the committed actuator digest. Without the build, the verdict is replay_not_evaluated rather than a pass.

What holds it together

The input digest is committed before the output digest, and INPUT_DIGEST_PRECEDES_OUTPUT_DIGEST checks that ordering inside the declared drift allowance. That's what stops a cycle being written backwards from the command it wants to justify.

Coverage is checked as well as content. CYCLE_INDEX_MONOTONIC, PREVIOUS_CYCLE_HASH_CHAIN, and WINDOW_COVERAGE_COMPLETE mean a missing cycle in the disputed window is a refusal, not a quiet gap.

A human at the controls has to be disclosed. MANUAL_OVERRIDE_DISCLOSED and CONTROL_AUTHORITY_COMMITTED keep the authority for each cycle inside the signed record, so an override can't be dropped from the story later.

DETERMINISTIC_REPLAY_MATCH is the strong claim, and it only exists when the verifier holds the certified build. The receipt reports the weaker verdict honestly instead of implying a replay that never happened.

Verify one yourself

Verify is open. Pass the certified build when you have it, and the verifier replays. Leave it out and you still get the chain, the attestation, and the ordering checks.

curl -sS -X POST https://thehiveryiq.com/v1/verify/control-replay \
  -H 'content-type: application/json' \
  -d @cycles.json

cycle_openings are the inputs and actuator outputs you choose to open. INPUT_OPENING_NON_LEAKAGE refuses openings that reach past the disputed window.

{
  "receipt": {
    "key_id": "did:hive:vehicle-secure-element", "algorithm": "Ed25519",
    "signed_body": {
      "receipt_type": "control.replay",
      "replay_id": "unit-8812-window-0442",
      "build": { "build_measurement_commitment": "...", "certified_set_commitment": "...",
                 "certified_set_size": 4, "device_public_key_hex": "..." },
      "window": { "opens": { "utc": "2030-09-08T14:02:00Z" }, "closes": { "utc": "2030-09-08T14:02:12Z" },
                  "first_cycle_index": 4400, "last_cycle_index": 4520, "cycle_count": 121,
                  "manual_authority_cycle_count": 1, "maximum_cycle_duration_ms": 120 },
      "disputed_window": { "opens_cycle_index": 4470, "closes_cycle_index": 4480, "opened_cycle_count": 11 },
      "cycles": [
        { "cycle_index": 4470, "input_commitment": "...", "input_instant": { "utc": "2030-09-08T14:02:07.010Z", "drift_ms": 5 },
          "output_commitment": "...", "output_instant": { "utc": "2030-09-08T14:02:07.042Z", "drift_ms": 5 },
          "control_authority": "certified_build", "previous_cycle_hash": "...", "cycle_hash": "...",
          "cycle_sig_b64u": "...", "disclosure": "opened" }
      ],
      "replay": { "replay_relation": "reproduced", "replayed_cycle_count": 11 },
      "coverage": { "window_coverage_relation": "complete", "authority_relation": "disclosed",
                    "disclosure_relation": "within_scope" },
      "verdict": "certified_build_in_control"
    }
  },
  "build_attestation": { "signed_body": { "receipt_type": "control.build" } },
  "control_salt_hex": "...",
  "disclosure": {
    "build_measurement": "...",
    "certified_build": { "build_measurement": "..." },
    "cycle_openings": [ { "cycle_index": 4470, "inputs": "...", "actuator_outputs": "..." } ]
  }
}

A pass returns valid true, the ordered gates array, and the verdict the gates support. A refusal names the gate that stopped it.

What gets checked

The verifier runs every gate in order and stops at the first failure, then tells you which one stopped it. A later gate never reads a field an earlier gate already showed to be untrustworthy.

Every gate the verifier runs, in order (21 gates)
Gate
SCHEMA
ISSUER_KEY_MATCH
ENVELOPE_SIGNATURE
SALT_PRECOMMITMENT
BUILD_MEASUREMENT_SIGNATURE
BUILD_MEASUREMENT_MATCHES_CERTIFIED_SET
BUILD_ATTESTED_BEFORE_WINDOW
INPUT_DIGEST_PRECEDES_OUTPUT_DIGEST
CYCLE_TIMING_BOUND
CYCLE_INDEX_MONOTONIC
CYCLE_SIGNATURE
PREVIOUS_CYCLE_HASH_CHAIN
CONTROL_AUTHORITY_COMMITTED
WINDOW_COVERAGE_COMPLETE
INPUT_OPENING_NON_LEAKAGE
INPUT_DIGEST_RECOMPUTE
OUTPUT_DIGEST_RECOMPUTE
MANUAL_OVERRIDE_DISCLOSED
DETERMINISTIC_REPLAY_MATCH
VERDICT_RECOMPUTE
BOUNDARY_CONSTANT

Field names come from the published schema: https://thehiveryiq.com/.well-known/schemas/control-replay-v1.json. It ships with this release alongside the routes below, and the developer docs carry the schema catalog.

What this receipt does not say

This is the honesty boundary carried inside every control.replay receipt, verbatim from the signed body.

This receipt attests only that a set of signed control cycle records, an attested control software build measurement, and a disclosed set of cycle input and actuator openings satisfy the stated deterministic replay and ordering procedure over the named disputed window. A verdict of certified_build_in_control means only that, for every opened cycle, the certified build supplied to the verifier reproduced the committed actuator output digest from the committed cycle inputs, that each input commitment instant preceded its output commitment instant within the declared drift allowance, and that the cycle chain and index sequence were unbroken across the window. A verdict of replay_not_evaluated means the verifier did not hold the certified build and therefore concluded nothing whatever about whether the certified build produced the disclosed actuator commands. This receipt does not establish that the sensor and command inputs committed at capture time reflected physical reality, so it does not exclude spoofing, jamming, or a faulty sensor upstream of the commitment. It does not establish that the certified build was correct, safe, adequate, or fit for the conditions it encountered, and it does not establish that a certified build that was in control behaved reasonably. It does not establish that the secure element that produced the build measurement and the cycle signatures was uncompromised at or before the first cycle of the window. It does not establish that the disclosed window is the operationally relevant window, that undisclosed cycles are unremarkable, or that any actuator command caused any outcome. This receipt decides no contractual, statutory, regulatory, evidentiary, certification, airworthiness, roadworthiness, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, grounding, or remedy.

Hive never holds the underlying data

Hive never receives the corpus, the deleted object, the raw meter data, the analysis inputs, or the control inputs. Every value is a commitment the holder computed locally, and all this service can do is recompute the arithmetic between those commitments and refuse when it does not hold.

Endpoints

RouteWhat it does
POST /v1/mint/control-replayIssue a replay receipt over cycles and a build attestation you hold. Needs Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed without it.
POST /v1/verify/control-replayRecompute the cycle chain, the build binding, the ordering, and the replay. Open, no auth.

Where this sits

Control replay answers what a machine did. Corpus commitment answers what a model read, and the erasure receipt answers what your systems no longer hold.

The other four instruments in this release: corpus commitment, erasure receipt, meter witness, analysis replay. For the receipt that fixes a recording instead of a computation, see capture commitment. For the written papers, see papers.

Patent pending. Hive Civilization, The Hivery, Inc.