# Evidence Graphs for Agent Runs

Order, state links, roots, counts, and declared gaps

Published September 3, 2026.

## Quick answer

An evidence graph turns a run into canonical leaves and ordered links. The verifier rebuilds roots, counts, transitions, and durations. A valid graph proves internal consistency of the supplied record, not the correctness of OCR or the truth of raw inputs.

## The problem

Agent runs cross document extraction, object storage, event streams, and origin records. A flat list loses the relation between one state and the next. A graph preserves those relations in a form that can be rebuilt by an independent verifier.
The useful boundary is strict. Canonicalization can prove that two parties evaluated the same bytes in the same order. It cannot prove that the bytes described reality or that an omitted event never happened.

## Primitive map

| Receipt | Bound inputs | Derived relation | Claim boundary |
| --- | --- | --- | --- |
| afir.ocr.docproof | Document commitment, page leaves, OCR output commitment, and ordered links | Root and page count recompute | OCR accuracy or human authorship |
| afir.s3 | Object versions, canonical leaves, and state transitions | Version links and object root recompute | Cloud account control |
| afir.stream | Ordered event leaves and timestamps | Count, duration, links, and stream root recompute | Complete event capture |
| origin.proof | Origin observations and canonical transitions | Supplied origin chain is internally consistent | Physical origin or source honesty |

## Verifier gates

The verifier rebuilds derived values. It does not trust a caller supplied outcome, count, root, total, or relation.

- `CANONICAL_LEAVES`
- `ORDERED_LINKS`
- `ROOT_RECOMPUTATION`
- `COUNT_RECOMPUTATION`
- `DURATION_RECOMPUTATION`
- `OUTCOME_DERIVATION`

## Failure cases

### Reordered events

Changed order produces different transitions and a different root.
### Broken state link

A transition that does not reference the prior state fails its named gate.
### Invented count

The verifier counts canonical leaves instead of trusting a total.
### Invented duration

The verifier derives duration from ordered timestamps.
### Inflated outcome

A favorable label fails when graph relations do not support it.

## Claim boundary

- OCR receipts do not claim extraction correctness.
- Graph roots do not prove raw payload truth.
- A graph cannot prove that an unobserved event did not occur.
- A valid object graph does not prove that a host or account was uncompromised.

## Standards context

- [W3C Verifiable Credentials 2.0](https://www.w3.org/TR/vc-data-model-2.0/)
- [SCITT architecture](https://datatracker.ietf.org/doc/html/draft-ietf-scitt-architecture-22)
- [RFC 9162](https://www.rfc-editor.org/rfc/rfc9162.pdf)

## Related research

- [Swarm incident receipt autopsy](https://thehiveryiq.com/autopsy/openai-hugging-face-agent-evaluation/)
- [Hive research index](https://thehiveryiq.com/papers/)