Control Replay · control.replay
This binds the action to the exact build that took it and to the inputs it saw. You commit the build attestation and the cycle inputs. We recompute the cycle chain and bind the action to the build that produced it, under a salt that stays with you.
29 of 29 local checks pass
This instrument ships with this release. The 29 checks above are the local smoke suite, run in process against a throwaway key with no network calls.
After an incident the question is narrow. Was the certified software in control, or was a human or an unattested build holding authority. The answer today is a log, and a log is a file someone with write access can edit.
The other half of the question is what the system saw. A command that looks wrong against the world can be the only correct command for the inputs the machine actually had.
So when someone asks which version did this and on what inputs, the answer here is a signed recomputation rather than a log entry anyone could edit.
The device secure element signs a build measurement. The receipt carries the salted build_measurement_commitment, the certified_set_commitment, the certified_set_size, and the device_public_key_hex.
Every cycle commits an input_commitment before an output_commitment, records the control_authority, chains to the previous_cycle_hash, and is signed by the same device.
A verifier holding the certified build replays the disclosed inputs offline and has to reproduce the committed actuator digest. Without the build, the verdict is replay_not_evaluated rather than a pass.
The input digest is committed before the output digest, and INPUT_DIGEST_PRECEDES_OUTPUT_DIGEST checks that ordering inside the declared drift allowance. That's what stops a cycle being written backwards from the command it wants to justify.
Coverage is checked as well as content. CYCLE_INDEX_MONOTONIC, PREVIOUS_CYCLE_HASH_CHAIN, and WINDOW_COVERAGE_COMPLETE mean a missing cycle in the disputed window is a refusal, not a quiet gap.
A human at the controls has to be disclosed. MANUAL_OVERRIDE_DISCLOSED and CONTROL_AUTHORITY_COMMITTED keep the authority for each cycle inside the signed record, so an override can't be dropped from the story later.
DETERMINISTIC_REPLAY_MATCH is the strong claim, and it only exists when the verifier holds the certified build. The receipt reports the weaker verdict honestly instead of implying a replay that never happened.
Verify is open. Pass the certified build when you have it, and the verifier replays. Leave it out and you still get the chain, the attestation, and the ordering checks.
curl -sS -X POST https://thehiveryiq.com/v1/verify/control-replay \ -H 'content-type: application/json' \ -d @cycles.json
cycle_openings are the inputs and actuator outputs you choose to open. INPUT_OPENING_NON_LEAKAGE refuses openings that reach past the disputed window.
{
"receipt": {
"key_id": "did:hive:vehicle-secure-element", "algorithm": "Ed25519",
"signed_body": {
"receipt_type": "control.replay",
"replay_id": "unit-8812-window-0442",
"build": { "build_measurement_commitment": "...", "certified_set_commitment": "...",
"certified_set_size": 4, "device_public_key_hex": "..." },
"window": { "opens": { "utc": "2030-09-08T14:02:00Z" }, "closes": { "utc": "2030-09-08T14:02:12Z" },
"first_cycle_index": 4400, "last_cycle_index": 4520, "cycle_count": 121,
"manual_authority_cycle_count": 1, "maximum_cycle_duration_ms": 120 },
"disputed_window": { "opens_cycle_index": 4470, "closes_cycle_index": 4480, "opened_cycle_count": 11 },
"cycles": [
{ "cycle_index": 4470, "input_commitment": "...", "input_instant": { "utc": "2030-09-08T14:02:07.010Z", "drift_ms": 5 },
"output_commitment": "...", "output_instant": { "utc": "2030-09-08T14:02:07.042Z", "drift_ms": 5 },
"control_authority": "certified_build", "previous_cycle_hash": "...", "cycle_hash": "...",
"cycle_sig_b64u": "...", "disclosure": "opened" }
],
"replay": { "replay_relation": "reproduced", "replayed_cycle_count": 11 },
"coverage": { "window_coverage_relation": "complete", "authority_relation": "disclosed",
"disclosure_relation": "within_scope" },
"verdict": "certified_build_in_control"
}
},
"build_attestation": { "signed_body": { "receipt_type": "control.build" } },
"control_salt_hex": "...",
"disclosure": {
"build_measurement": "...",
"certified_build": { "build_measurement": "..." },
"cycle_openings": [ { "cycle_index": 4470, "inputs": "...", "actuator_outputs": "..." } ]
}
}
A pass returns valid true, the ordered gates array, and the verdict the gates support. A refusal names the gate that stopped it.
The verifier runs every gate in order and stops at the first failure, then tells you which one stopped it. A later gate never reads a field an earlier gate already showed to be untrustworthy.
| Gate |
|---|
| SCHEMA |
| ISSUER_KEY_MATCH |
| ENVELOPE_SIGNATURE |
| SALT_PRECOMMITMENT |
| BUILD_MEASUREMENT_SIGNATURE |
| BUILD_MEASUREMENT_MATCHES_CERTIFIED_SET |
| BUILD_ATTESTED_BEFORE_WINDOW |
| INPUT_DIGEST_PRECEDES_OUTPUT_DIGEST |
| CYCLE_TIMING_BOUND |
| CYCLE_INDEX_MONOTONIC |
| CYCLE_SIGNATURE |
| PREVIOUS_CYCLE_HASH_CHAIN |
| CONTROL_AUTHORITY_COMMITTED |
| WINDOW_COVERAGE_COMPLETE |
| INPUT_OPENING_NON_LEAKAGE |
| INPUT_DIGEST_RECOMPUTE |
| OUTPUT_DIGEST_RECOMPUTE |
| MANUAL_OVERRIDE_DISCLOSED |
| DETERMINISTIC_REPLAY_MATCH |
| VERDICT_RECOMPUTE |
| BOUNDARY_CONSTANT |
Field names come from the published schema:
https://thehiveryiq.com/.well-known/schemas/control-replay-v1.json. It ships with this release alongside the routes below, and the
developer docs carry the schema catalog.
This is the honesty boundary carried inside every
control.replay receipt, verbatim from the signed body.
This receipt attests only that a set of signed control cycle records, an attested control software build measurement, and a disclosed set of cycle input and actuator openings satisfy the stated deterministic replay and ordering procedure over the named disputed window. A verdict of certified_build_in_control means only that, for every opened cycle, the certified build supplied to the verifier reproduced the committed actuator output digest from the committed cycle inputs, that each input commitment instant preceded its output commitment instant within the declared drift allowance, and that the cycle chain and index sequence were unbroken across the window. A verdict of replay_not_evaluated means the verifier did not hold the certified build and therefore concluded nothing whatever about whether the certified build produced the disclosed actuator commands. This receipt does not establish that the sensor and command inputs committed at capture time reflected physical reality, so it does not exclude spoofing, jamming, or a faulty sensor upstream of the commitment. It does not establish that the certified build was correct, safe, adequate, or fit for the conditions it encountered, and it does not establish that a certified build that was in control behaved reasonably. It does not establish that the secure element that produced the build measurement and the cycle signatures was uncompromised at or before the first cycle of the window. It does not establish that the disclosed window is the operationally relevant window, that undisclosed cycles are unremarkable, or that any actuator command caused any outcome. This receipt decides no contractual, statutory, regulatory, evidentiary, certification, airworthiness, roadworthiness, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, grounding, or remedy.
Hive never receives the corpus, the deleted object, the raw meter data, the analysis inputs, or the control inputs. Every value is a commitment the holder computed locally, and all this service can do is recompute the arithmetic between those commitments and refuse when it does not hold.
| Route | What it does |
|---|---|
| POST /v1/mint/control-replay | Issue a replay receipt over cycles and a build attestation you hold. Needs Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed without it. |
| POST /v1/verify/control-replay | Recompute the cycle chain, the build binding, the ordering, and the replay. Open, no auth. |
Control replay answers what a machine did. Corpus commitment answers what a model read, and the erasure receipt answers what your systems no longer hold.
The other four instruments in this release: corpus commitment, erasure receipt, meter witness, analysis replay. For the receipt that fixes a recording instead of a computation, see capture commitment. For the written papers, see papers.
Patent pending. Hive Civilization, The Hivery, Inc.