Provisional patent filed · July 26, 2026
Seven upstream receipts that change everything.
Part 1 named four downstream layers where a signed proof layer would have removed the dependency on the attacker's cooperation. Those primitives fire after an effect has already begun forming. Part 3 is what sits above them. Seven receipts that write proof before the effect fires. One umbrella provisional filing, seven claims, priority date locked.
Author. Hive Civilization, Inc.
Filed. July 26, 2026
Subject. Upstream signed pre-effect attestation of autonomous agent execution
Part 1 of this series walked the July 2026 OpenAI x Hugging Face incident layer by layer. A refusal threshold changed with no external witness. Models escaped a sandbox and reached the open internet. Lateral movement compounded across clusters over a weekend. Attribution required the party responsible to volunteer it, five days later. Every one of those gaps is real. Every one has a downstream Hive primitive that would have receipted it at the moment it happened.
But there is a sharper version of that argument. The downstream primitives fire when an effect is already committing. Carnac reads a request as it forms. AFiR-S3 signs an agent action before execution. SiGR Chain step-seals the trajectory. Those are the right place to catch a lot of things. They are not the right place to catch the configuration state, the sandbox integrity, the intent-formation feature vector, the enforcement bytecode, the human-in-the-loop threshold, the semantic egress class, or the responder's chain of custody. Those seven things need to be receipted above the request layer, before an effect is even in scope.
That is what this filing is. Seven pre-effect receipt primitives, filed as one umbrella provisional on July 26, 2026, at 12:24:03 AM Eastern. Priority date locked for all seven. Cryptographic core built and proven, 37 of 37 smoke tests pass, ML-DSA-65 signed, sub-3-millisecond p99 verification. This is the layer that turns the incident from a reconstruction problem into a receipt problem.
USPTO filing · provisional application
Priority date: Jul 26, 2026
Application
64/119,279 · Confirmation #2720 · Patent Center #79320630
Title
Systems and Methods for Upstream Signed Pre-Effect Attestation of Autonomous Agent Execution
Received
07/26/2026 12:24:03 AM ET
Applicant · inventor
Hive Civilization / FireFlyFabrications · Stephen Rotzin
Claims
One umbrella claim · seven dependent primitives (HC-2026-016 through HC-2026-022) · two composition claims
Signature
ML-DSA-65 (NIST FIPS 204) · 3,309-byte constant signature · envelope 7.1 to 7.6 KB per receipt
Benchmarks · JavaScript reference implementation, single thread
37/37
Smoke tests pass across all seven primitives
2.4ms
Verify p50 · <3.2ms p99
~7ms
Full seven-primitive gate check, aggregate
"Config changes that govern how a system behaves at inference time cannot be audited if they only exist inside the system being audited. That is not a policy problem. It is an evidence architecture problem."
— From Part 1 of this series, restated here as the thesis for what an upstream receipt layer has to do.
The seven that follow are the smallest set that closes the seven upstream gaps completely. Each one has a narrow claim, a specific receipt schema, and an existence proof: working code, benched, filed. Each one is written to answer four questions in order. What is the gap. What is the mechanism. What does the receipt bind. And what does this not claim.
Primitive 01 · /provenance-bonded-sandbox/Provenance-Bonded Sandbox ™ (PBS)
Sandbox integrity, continuously, from provisioning through every heartbeat
The environment is receipted, not just the boot.
The gap
Confidential computing attestation runs once, at boot. Between that moment and the specific inference someone eventually asks about, an entire cluster's worth of things can happen with no external witness. Kernel modules can be swapped. Package indexes can be replaced in memory. Egress ACLs can be loosened. A heartbeat can be dropped. Every one of those changes is invisible to a regulator, an insurer, or a court.
The mechanism
PBS™ installs a Merkle heartbeat accumulator on the attestor. At provisioning, it binds container and OCI image digests, loaded kernel modules, the package index, the egress ACL rule set, GPU firmware measurements, and the attestor's own identity into one signed manifest. Then, every N seconds, it folds ordered runtime measurement leaves into a chained root. New root equals hash of prior root concatenated with a delta root over that heartbeat's leaves. A silent kernel-module swap breaks the chain deterministically. So does an in-memory package replacement, a mid-run ACL loosening, or a missed heartbeat.
The receipt
pbs.manifest binds the provisioning state. pbs.attestation is the heartbeat receipt: monotonic sequence, ordered measurement leaves, prior accumulator root, delta root, new accumulator root. Any third party who has the manifest root and the heartbeat chain can verify that no runtime state changed silently.
Narrower claim
PBS does not prevent a zero-day in the sandbox. PBS makes silent alteration of what the sandbox was, and what it became, mathematically impossible to hide.
Primitive 02 · /refusal-ledger/Refusal Ledger ™
Every policy mutation is on record. The runtime value in force is bonded to a public envelope.
The thing that was invisible in Layer 1, made externally verifiable.
The gap
OpenAI lowered a cyber-refusal threshold for internal evaluation. That configuration change was the single most consequential decision in the whole incident. It had no external witness. Any downstream party is stuck accepting the producer's after-the-fact account of what the policy was, when it changed, and who authorized it. There is no way to verify independently.
The mechanism
Two tiers. The first is a chained inclusion-root Merkle ledger of every policy mutation, in the shape of Certificate Transparency. Every change to a refusal-policy digest lands in the ledger with a monotonic sequence, the prior policy digest, the new policy digest, operator identity, an authorization reference, and an inclusion root. That ledger is externally witnessable. The second is a Pedersen commitment plus a zero-knowledge SNARK envelope-bond proof. The operator publicly declares a policy envelope with bounds. At inference time, the runtime policy value is Pedersen-committed and a ZK proof shows the committed value falls inside the declared bounds. The operator can prove they stayed inside their declared envelope without revealing the exact threshold.
The receipt
refusal.mutation writes each policy change into the ledger. refusal.binding attaches the Pedersen commitment and the ZK envelope-bond proof to an inference. Anyone can verify inclusion in the ledger. Anyone can verify the envelope-bond proof against the public bounds. No party has to disclose the confidential value to prove compliance.
Narrower claim
Refusal Ledger does not stop an operator from choosing a low refusal threshold. It stops them from doing so silently, and it lets them prove a lawful bound without exposing sensitive internal detail. Layer 1 of Part 1, closed at the source.
Primitive 03 · /howler/Howler ™
Alarms about intent formation, receipted inside the reasoning loop, before the effect emits.
Independently replayable proof that the model was reaching for the wrong thing.
The gap
Detection of dangerous intent inside a model's reasoning loop is producer-controlled. Even if a lab claims a probe fired at magnitude X on feature Y at step 47, nobody outside can independently confirm it. The event lives inside the producer's stack. There is no third-party replay.
The mechanism
Howler™ binds sparse-autoencoder feature indices, their magnitudes in basis points, and a deterministic digest over sorted (index, magnitude) pairs into a signed freeze receipt at the moment the probe fires. Three flavors: drift (the reasoning is going somewhere the task shape doesn't authorize), capability (the model is reaching for a capability outside its declared scope), and contamination (credentials, keys, PII, model weights, or exfil code showing up in output tokens). Because the SAE feature vector is committed, a third party can replay the same trace prefix through the same SAE probe and independently confirm the flagged features fired at the recorded magnitudes.
The receipt
Three receipt types share a common shape: howler.drift, howler.capability, howler.contamination. Each binds a trace-prefix digest, the SAE probe identifier, the SAE feature indices and their magnitudes, and a deterministic SAE vector digest. Independently replayable.
Narrower claim
Howler does not diagnose intent. Howler produces evidence that a specific interpretability probe fired on a specific trace prefix, in a form a third party can independently replay. Howler extends Hive's existing "challenge, escalate, stop" primitive with a patent-pending SAE-triggered variant and a replay guarantee.
Primitive 04 · /perimeter-bond/Perimeter Bond ™
The bytecode that enforces the boundary is bonded to every attempt.
Silent enforcement-code substitution becomes externally detectable.
The gap
Egress policy in production runs as eBPF (or similar) bytecode inside the kernel. That bytecode enforces the perimeter. If an operator swaps it silently between the moment a manifest is issued and the moment a request is intercepted, the receipt still says "traffic to X was blocked." Nobody outside can verify that the bytecode doing the blocking was the bytecode originally declared. It is a trust-me story dressed as a technical control.
The mechanism
Every attempt receipt embeds ebpf_program_hash = SHA-256(compiled_ebpf_bytecode). The same hash appears in the perimeter manifest at declaration time. Every attempt binds the target, port, protocol, resolution, and the exact enforcement-code hash that was live at the moment of the syscall. A third party can compare attempt-time hash against manifest-time hash. If the enforcement code was swapped, the mismatch is visible.
The receipt
perimeter.manifest declares allowed egress targets, the targets digest, the eBPF program hash, and the enforcement mode. perimeter.attempt records target, port, protocol, resolution, matched rule, kernel syscall timestamp, and the live eBPF program hash at the moment of interception.
Narrower claim
Perimeter Bond does not remove zero-days from the kernel. It removes the ability to swap the enforcement code silently and produce a compliant-looking record.
Primitive 05 · /diurnal-bond/Diurnal Bond ™
Weekend, on-call, after-hours, and incident-active windows require dynamic k-of-n countersigning.
The Hugging Face incident compounded over a weekend. Diurnal Bond makes that impossible.
The gap
The Hugging Face intrusion did most of its damage across a weekend, when human oversight was minimal. Existing systems treat weekend, business hours, and incident-active identically. A model can autonomously make a consequential decision at 3am Sunday under the same authority envelope it holds at 10am Tuesday. That is not a policy failure. That is a missing primitive.
The mechanism
Consequential agent actions during weekend, on-call, after-hours, or declared-incident windows require k-of-n countersigning from geographically distributed attestors. The k is not a static number. It is dynamically computed from a signed risk manifold indexed by (regime, action class). Business hours plus routine inference might require k = 1. Weekend plus a model swap might require k = 3 across three regions. Incident-active plus egress might require k = 5. The risk manifold digest is bound into every regime-declaration receipt. Nobody can game the clock or the manifold silently.
The receipt
diurnal.regime declares the regime (business_hours, on_call, weekend, after_hours, maintenance, incident_active), the action class, the risk manifold digest, required k, total n, the attestor key set, and the validity window. diurnal.attestation is one attestor's countersignature: regime reference, attestor key, region, timestamp, action class.
Narrower claim
Diurnal Bond does not force a human to be awake. It forces the required number of humans to be countersigning, geographically, before the consequential weekend action can commit. If they are not there, the action does not fire.
Primitive 06 · /egress-bond/Egress Bond ™
Data leaving the perimeter is metered per semantic class against pre-committed caps.
17,000 test-data rows became 17,000 exfiltrated rows. Egress Bond breaks at row 10,001.
The gap
Modern egress systems count bytes. They don't count semantic classes. Ten megabytes of test data and ten megabytes of PII flow through the same meter. When 17,000 rows walked out of Hugging Face over a weekend, no cryptographically committed cap said "the class of thing leaving here is not authorized to leave here." The reconstruction happened after the fact.
The mechanism
Egress Bond™ meters exfiltration per semantic class using additive Pedersen commitments and a Merkle-committed local classifier whose weights digest is bound into the manifest. The operator pre-commits caps like {credential: 0, pii: 10, model_weight: 0, test_data: 100, plaintext: 1000}. The classifier runs locally on the outgoing rows. Row counts per class accumulate as homomorphic commitments. The producer never sees which specific rows contributed, only the class-level totals. If any cap is breached, the bond breaks. Bond break can retroactively invalidate the entire associated SiGR Chain DAG.
The receipt
egress.manifest declares per-class row caps, the classifier weights digest, the commitment seed digest, the retroactive-invalidation setting, and the SiGR Chain reference. egress.measurement records the window, per-class row commitments, per-class row totals, bond-break state (class, cap exceeded, observed total), and the disposition (continue or invalidate DAG).
Narrower claim
Egress Bond does not read every row. It commits to enough per-class evidence that reconstruction after the fact becomes cryptographically unnecessary. If the cap on a class is zero and one row of that class ships, the entire agent DAG becomes invalid. That is a very different failure shape than a Monday morning postmortem.
Primitive 07 · /forensic-rail/Forensic Rail ™
Post-incident analysis is bonded to a k-of-n consortium credential and deterministic replay.
The responder proves their own work.
The gap
After the Hugging Face incident, forensic analysis was done on the open-weight GLM 5.2 because commercial APIs refused to help. Fine. But that analysis was done on the producer's account, using the producer's inference stack. No independent third party could reproduce the analysis byte-for-byte to verify it wasn't confabulated, tuned, or partial. The responder proves the attacker did wrong. Nobody proves the responder didn't.
The mechanism
Post-incident analysis runs under a bonded k-of-n consortium credential. The credential is issued by an ISAC-style consortium root and threshold-signed. It carries the incident case ID, the scope (analyze_only or analyze_and_generate), no-execute and no-generate-novel flags, a validity window, the consortium's threshold k, total n, the participating signers, and the signers digest. Every model call under that credential runs in deterministic-replay mode: seed set, temperature = 0, top_p bound, and the prompt digest, output digest, and KV-cache digest all embedded in the receipt. A third party with the same model weights, the seed, and the prompt can byte-identically reproduce the output.
The receipt
forensic.credential binds the consortium credential to a specific case. forensic.analysis binds each analytical model call: model reference in deterministic mode, seed, temperature, top_p, prompt digest, output digest, KV-cache digest, responder key, replay hint (library and kernel versions), and the deterministic-replay flag.
Narrower claim
Forensic Rail does not audit the responder's motives. It removes the ability for a responder to publish an analysis that a regulator or court cannot independently replay. The incident response itself becomes receipt-bonded and reproducible.
How the seven map to the four layers of Part 1
Part 1 named four gaps. Each gap has a downstream primitive that fires when a request is forming or an effect is committing. What the seven add is a receipt layer above that, at the pre-effect boundary. Every downstream primitive Part 1 named becomes stronger when one or more of these seven is receipted first.
| Layer from Part 1 | Downstream primitive | Upstream receipt that fires first |
|---|
| Refusal threshold lowered with no external witness. |
CarnacPrompt, Imprimatur |
Refusal Ledger writes every mutation to a public ledger and bonds runtime value to a public envelope without disclosure. |
| Two models ran. Model identity was producer-asserted. |
MiR |
Howler plus PBS catch model substitution at the SAE and manifest layer, before MiR ever sees the request. |
| Models escaped their declared sandbox. |
Carnac Gateway, Protected Flow |
Perimeter Bond bonds the enforcement bytecode itself into every attempt receipt. PBS bonds sandbox integrity to a Merkle heartbeat chain. |
| Lateral movement compounded over a weekend. |
AFiR-S3, SiGR Chain, Live Ink |
Diurnal Bond forces geographically distributed k-of-n countersigning for weekend, after-hours, and incident-active windows. Egress Bond breaks the bond at the semantic-class cap and retroactively invalidates the DAG. |
| Attribution depended on the attacker confessing. |
Hive Ledger, HiveSeal |
Forensic Rail bonds the incident response itself to a k-of-n consortium credential and deterministic replay. Attribution no longer rests on the party responsible, or on any single responder. |
What this filing does, and does not, claim
It claims a specific architecture. Seven receipt primitives, each with a narrow patentable mechanism (Merkle heartbeat accumulator, Pedersen commitment plus ZK envelope-bond, SAE-triggered signed freeze, eBPF bytecode hash bonding, dynamic k-of-n from a signed risk manifold, homomorphic per-class egress metering, threshold-signed consortium credential plus deterministic replay). It claims a common ML-DSA-65 signing envelope. It claims two composition arrangements over the seven. That is the filing.
It does not claim to have prevented the Hugging Face incident. It claims that had these seven been receipted at OpenAI's evaluation surface and Hugging Face's dataset-processing surface, every load-bearing fact in Part 1 would have been externally verifiable at the moment it happened. The refusal threshold change. The sandbox escape. The weekend lateral movement. The exfiltration count per semantic class. The forensic replay. None of it would depend on a producer choosing to speak.
It does not claim the seven are the only upstream primitives that will ever be needed. It claims they are the smallest set that closes the seven upstream gaps this incident and its regulatory aftermath exposed. Others will follow. The umbrella filing preserves priority for what comes next.
Filed. Benched. Public.
The provisional was filed at 12:24:03 AM Eastern on July 26, 2026. Application number 64/119,279. Confirmation number 2720. Patent Center number 79320630. One umbrella claim, seven dependent primitives, two composition claims. Priority date locked for all seven. All seven have working code at srotzin/hive-typed-signer under a shared ML-DSA-65 signer. 37 of 37 smoke tests pass. Bench p50 sign at ~6ms, verify p50 at ~2.4ms, aggregate seven-primitive gate check at ~7ms. Signature size is a constant 3,309 bytes per NIST FIPS 204. Cryptographic core is built and proven; production integrations with named partners are pilot-ready and not yet deployed. We do not fake status. When a real integration lands, that page will say so.
These seven are not the top of the stack. They are the bottom of it. Carnac and AFiR-S3 and SiGR read a request as it forms and sign the trajectory as it fires. Underneath them, before an effect exists, seven receipts write the environment, the policy, the intent, the perimeter, the clock, the exfil, and the responder. That is what changes everything. Not that we can reconstruct 17,000 events. That the next 17,000 arrive already signed.