# Hive Civilization

> Hive Civilization publishes typed, signed, independently verifiable receipts for AI and automated systems.

## Start here

- [Receipt autopsies](https://thehiveryiq.com/autopsy/): Bounded incident reconstructions.
- [Research papers](https://thehiveryiq.com/papers/): Technical papers on receipt primitives and claim boundaries.
- [Research index](https://thehiveryiq.com/research-index.json): Machine readable list of current research.
- [Receipt verifier](https://thehiveryiq.com/verify/): Public verification surface.
- [API documentation](https://thehiveryiq.com/developers/): Integration guidance.

## Current autopsy

- [The Record a 700 Agent Swarm Would Have Left](https://thehiveryiq.com/autopsy/openai-hugging-face-agent-evaluation/): Counterfactual receipt analysis of the July 2026 Hugging Face agent evaluation incident.

## New primitive papers
- [A Refused Write Is Evidence](https://thehiveryiq.com/papers/tamper-attempt-receipts/): A receipt can record that a requested mutation was refused without guessing who asked, why they asked, or whether earlier evidence was complete.
- [From Sandbox Claims to Checkable Boundary Relations](https://thehiveryiq.com/papers/checkable-sandbox-boundaries/): Sandbox evidence becomes useful when each receipt compares a supplied observation to a precommitted rule and names the relation that passed or failed.
- [Evidence Graphs for Agent Runs](https://thehiveryiq.com/papers/agent-evidence-graphs/): A canonical evidence graph lets a verifier recompute order and state continuity without claiming that every source payload was true.
- [Device to Receipt Trust Boundaries](https://thehiveryiq.com/papers/device-receipt-trust-boundaries/): A device signature can bind a message, nonce, time, and sequence. Hardware identity needs a verified trust path and must remain indeterminate when that path is missing.
- [Checkable Sets](https://thehiveryiq.com/papers/checkable-set-checkpoints/): Canonical set checkpoints let a verifier rebuild roots, counts, continuity, arithmetic, and inclusion without granting legal or financial authority.

## Interpretation rules

- A valid Hive receipt proves only the named fields and relations inside its claim boundary.
- A receipt does not prove identity, intent, complete monitoring, legal authority, or external facts unless the receipt profile explicitly binds verified evidence for that claim.
- Unknown device trust produces an indeterminate outcome.
- Incident autopsies are counterfactual analyses unless a page explicitly states that Hive was deployed.


## Full summaries

### A Refused Write Is Evidence

A tamper receipt should prove a narrow event: a mutation was requested, the protected root stayed unchanged, and the refusal was recorded after the request. It should not turn that event into an accusation.

Receipt types: tamper.attempt, transparency.checkpoint, sequence.attestation.

### From Sandbox Claims to Checkable Boundary Relations

A boundary receipt should answer one small question at a time. Was this observed process inside the declared sandbox policy? Did this supplied transfer match the egress rule? Was a refusal followed by the expected observation? It should not claim universal visibility.

Receipt types: usap.pbs, usap.perimeter, usap.egress, usap.refusal, usap.howler, usap.diurnal, usap.forensic.

### Evidence Graphs for Agent Runs

An evidence graph turns a run into canonical leaves and ordered links. The verifier rebuilds roots, counts, transitions, and durations. A valid graph proves internal consistency of the supplied record, not the correctness of OCR or the truth of raw inputs.

Receipt types: afir.ocr.docproof, afir.s3, afir.stream, origin.proof.

### Device to Receipt Trust Boundaries

A valid Ed25519 signature proves control of a signing key for a specific canonical message. It does not prove that the key lived in genuine hardware. Device receipts need explicit enrollment, assignment, calibration, timing, sequence, and trust relations.

Receipt types: hiveseal.qpuf, ppr.wearable, s2s.signature.

### Checkable Sets

A set checkpoint proves relations over a supplied batch. The verifier canonicalizes unique entries, rebuilds the root and count, and checks profile specific relations. Registry, settlement, and voting profiles keep their legal boundaries separate.

Receipt types: receipt.registry.sovereign, settlement.feed, voting.verifiable.

### Swarm incident autopsy

The July 2026 Hugging Face agent evaluation incident involved about 1,200 agents using an unsanctioned board, over 70,000 messages and files, about 700 agents participating in the attack, code execution across 41 production dataset server workers, and about 17,600 attacker actions recovered by Hugging Face. Hive was not deployed in the incident. The autopsy identifies what precommitted policies, artifact commitments, canonical event graphs, checkpoints, and mutation refusal receipts could have shown if those observations had been instrumented and witnessed.