Egress policies today report outcomes from the operator's own vantage point: this destination was allowed, that one was refused. What nobody outside the operator can verify is whether the actual enforcement program, the eBPF code intercepting syscalls at the kernel, is the same program that was declared when the policy was issued. Swap it quietly, and every "blocked" claim becomes unverifiable. Perimeter Bond™ closes that gap. It hashes the exact compiled eBPF bytecode and binds that hash into both the manifest and every single attempt receipt.
Prove the enforcement code itself never changed, not just that it reported blocking.
ebpf_program_hash, embedded in the reach manifest at issue time and in every attempt receipt at enforcement time. If the code running at the kernel ever changes, the hash in new attempt receipts no longer matches the manifest, and that mismatch is externally detectable. What it is not: Perimeter Bond does not decide what the egress policy should allow. It proves the enforcement mechanism enacting whatever policy was declared has not been silently substituted.These numbers come from the reference implementation's benchmark suite, run against the actual signer and verifier.
Docket HC-2026-019. Envelope common across the seven-primitive filing: USAP_VERSION='usap.v1'. Real eBPF stack integration: pilot-ready, not yet deployed. We don't claim a live enforcement binding running against production kernels until a design partner runs it.
In the runup to the OpenAI and Hugging Face incident, 17,000 events were reconstructed after the fact by looking at logs the operator itself produced. Enforcement claims, "this traffic was blocked," are only as trustworthy as the enforcement code that made the call, and nothing today lets an outsider verify that code wasn't quietly swapped between when the policy was issued and when it actually ran.
"Traffic to X was blocked" is a statement the operator's own systems produce. There is no independent artifact tying that statement to the specific enforcement program that made the decision.
eBPF programs get recompiled, redeployed, or swapped as part of normal operations, or as part of an attack. Nothing in a typical egress log distinguishes a decision made by the declared program from one made by a substituted one.
The exact compiled bytecode hash travels with both the manifest and every attempt receipt. A substitution shows up as a hash mismatch, externally, without needing access to the kernel.
Motivating incident: Hive: the OpenAI / Hugging Face incident · NIST FIPS 204 (ML-DSA).
Each row is a real substitution scenario. The operator's own egress log looks routine in every case. Perimeter Bond's hash binding fails deterministically in every case too.
| # | Scenario | Operator's egress log | Perimeter Bond: why it fails |
|---|---|---|---|
| 1 | Silent eBPF recompile: enforcement code rebuilt with a weaker rule | ✓ "traffic blocked" reported normally | ✗ ebpf_program_hash in attempt receipt ≠ manifest hash |
| 2 | Program downgrade: revert to an older, less strict version | ✓ log shows no anomaly | ✗ hash matches an old, unauthorized program, not the declared one |
| 3 | Enforcement mode weakened: monitor-only instead of block | ✓ "blocked" claimed regardless | ✗ enforcement_mode in manifest disagrees with observed resolution |
| 4 | Target list quietly widened: allowed egress targets expanded post-issue | ✓ no internal alert configured | ✗ targets_digest mismatch against the signed manifest |
LOOKS FINE
BROKEN: enforcement code substituted, undetected by the operator's own tooling
The operator's dashboard isn't necessarily lying. It reports what the running code told it. The problem is nothing verified the running code was still the declared code. Perimeter Bond is the layer that checks the enforcement mechanism itself, not just its output.
Perimeter Bond emits two receipt types under the common usap.v1 envelope. perimeter.manifest is issued once, when the egress policy and its enforcement program are declared. perimeter.attempt is issued on every egress attempt, carrying the live enforcement hash. Both are ML-DSA-65 signed.
// perimeter.manifest: issued when the egress policy and enforcement program are declared { "type": "perimeter.manifest", "usap_version": "usap.v1", "docket": "HC-2026-019", "allowed_egress_targets": ["api.partner.example", "..."], "targets_digest": "sha256:...", "ebpf_program_hash": "SHA-256(compiled_ebpf_bytecode)", "ebpf_program_kid": "hive-perimeter-prog-v3", "enforcement_mode": "block", "issued_at": "2026-07-25T18:00:00Z", "signature": "ML-DSA-65, 3309 bytes" } // perimeter.attempt: issued on every egress attempt { "type": "perimeter.attempt", "usap_version": "usap.v1", "docket": "HC-2026-019", "manifest_ref": "perimeter.manifest#...", "target": "unauthorized-host.example", "port": 443, "protocol": "tcp", "resolution": "refused", "matched_manifest_rule_id": "rule-default-deny", "kernel_syscall_ts": "2026-07-25T21:41:09.442Z", "ebpf_program_hash": "must match perimeter.manifest, or the receipt is unverifiable", "signature": "ML-DSA-65, 3309 bytes" }
Every single attempt receipt, not just the manifest, carries the live ebpf_program_hash. A verifier checks it against the manifest on every single receipt, not just at issue time.
matched_manifest_rule_id ties the allow or refuse decision to a specific rule in the signed manifest. A decision that doesn't trace to a declared rule is itself suspicious.
kernel_syscall_ts is captured at the syscall interception point, not after the fact in userspace logging, which narrows the window for after-the-fact fabrication.
Signature: ML-DSA-65 (FIPS 204), constant 3,309 bytes. Bench: sign p50 ~6ms, verify p50 ~2.4ms. Aggregate throughput ~132 signs/sec/type, ~418 verifies/sec/type, single-threaded JS.
Perimeter Bond sits between the eBPF enforcement layer and the signing attestor, capturing the exact program hash at both issue time and interception time.
ebpf_program_hash over the exact bytecode.perimeter.manifest, the reference every attempt gets checked against.perimeter.attempt. A verifier compares its hash to the manifest, offline.An attempt receipt whose hash doesn't match any valid manifest is treated as unverifiable enforcement, not a silent pass. Downstream consumers, including Carnac™, can treat that as a stop condition.
Verification needs the manifest, the attempt receipts, and Hive's public key. No live access to the kernel, no trust in the operator's own dashboard.
Perimeter Bond's signing key is rooted the same way as the rest of the Hive stack: in HiveSeal™. Perimeter Bond proves the enforcement code; HiveSeal proves the signer.
Honesty is the product. Here is exactly where the edges are.
Perimeter Bond does not decide whether a given egress policy is correctly scoped. It proves the enforcement program actually running matches the one declared. A badly written but unaltered policy still verifies.
If an attacker gains root and can rewrite the hashing routine itself, not just the eBPF program, that's a deeper compromise Perimeter Bond alone does not address. It assumes the measurement path itself is intact.
The cryptographic core and the hash-binding construction are proven against reference programs. Wiring Perimeter Bond into a live production eBPF enforcement stack is a pilot-stage integration today.
Perimeter Bond is one of seven upstream primitives filed together on July 26, 2026, all built on the same signer and the same usap.v1 envelope. Each closes a different gap the OpenAI / Hugging Face incident exposed.
| Primitive | What it proves | Axis | When |
|---|---|---|---|
| Perimeter Bond | The exact enforcement bytecode intercepting syscalls is bound into every attempt receipt. | Network / upstream | now (crypto core) eBPF stack pilot pending |
| PBS: Provenance-Bonded Sandbox | Environment integrity, continuously, from provisioning through every heartbeat. | Environment / upstream | now (crypto core) |
| Refusal Ledger | Every refusal-policy change is on record, and the runtime value falls inside a declared envelope. | Policy / upstream | now (crypto core) |
| Howler | An alarm about intent formation fired before the effect emitted, replayable by a third party. | Intent / upstream | now (crypto core) |
| Diurnal Bond | Consequential actions during off-hours require k-of-n countersigning from a signed risk manifold. | Time / upstream | now (crypto core) |
| Egress Bond | Data leaving the perimeter is metered per semantic class against pre-committed caps. | Egress / upstream | now (crypto core) |
| Forensic Rail | Post-incident analysis is bonded to a k-of-n consortium credential and deterministically replayable. | Forensics / upstream | now (crypto core) |
| Carnac™ | Reads consequence before effect and routes each read to the proof it warrants. | Downstream gate | now |
| HiveSeal™ | Where the signing key lives in silicon: a key-side root. | Key-side root | now |
| AFiR | Attested Fragmented Inference Routing: signed routing of an inference across fragments. | Compute axis | now |
| SiGR | A specific model at a specific config produced a specific output, signed and checkable offline. | Compute axis | now |
Motivating incident for the whole seven-primitive filing: the OpenAI / Hugging Face incident, 17,000 events reconstructed after the fact. Perimeter Bond is the layer that would have let an outsider check whether the enforcement code doing the blocking was ever swapped.
We're looking for platform teams running eBPF-based network enforcement to take the crypto core to a live pilot. You bring the enforcement stack. We wire the hash-binding path into your manifest issue and syscall interception points, run the four substitution-scenario tests against your real environment, and you walk out with the first attempt receipts a regulator, auditor, or incident responder can check offline, against code, not just claims.
Perimeter Bond. Patent Pending. Proves the exact bytecode of the network-enforcement program intercepting syscalls is cryptographically bound into every attempt receipt, signed independently with ML-DSA-65 (FIPS 204), checkable offline. Cryptographic core built and proven: 37 of 37 smoke tests pass across the seven-primitive filing. Filed July 26, 2026. USPTO application 64/119,279. Real eBPF stack integration is pilot-ready, not yet deployed. We never fake a receipt.