What has been demonstrated, and what has not

Every governed action is authorized before it executes, not observed after. The decision to allow, hold or deny is taken against the active policy inside the same write transaction that reserves the budget and consumes the approval, so a policy change lands entirely before or entirely after an action — never halfway through one.

An agent's identity and its accountable owner come from the authenticated credential and the agent directory. They are never read from the request body. A request whose body disagrees with its credential is refused, and the refusal itself is recorded as signed evidence.

Decisions are produced by explicit rules over an explicit policy document with a version, not by a model's judgement. The same request under the same policy version yields the same decision, and the policy version that governed each decision is recorded in the signed evidence.

An action held for approval produces no effect until a separately authenticated human with the required role approves that exact request. The approval is bound to the payload and the envelope, is consumed once, and cannot release a different action or the same action twice.

An authorized operator can revoke an agent. Its next request cannot execute, and an action it had already had approved but not yet dispatched cannot execute either — revocation reaches work already in flight, not only new requests.

Spend and action limits are reserved atomically inside the authorization transaction. A limit lowered below what is already spent stops further spend without rewriting history, and the change is recorded as a signed configuration record naming the principal who made it.

One MCP tool call reaches one governed action and nothing else. Altered arguments, replayed calls, forged identity arguments, revoked authority and attempts to reach the execution service directly all fail correctly, and the tool's provenance travels inside the signed envelope rather than in a log beside it.

Limitation · Demonstrated for the unix-socket transport and the service accounts the harness creates on one host. It states nothing about another deployment's accounts.

When a request was transmitted but the answer never arrived, the system records the outcome as unresolved and retains the budget. It does not retry blindly and it does not convert an unknown into a failure to make the state tidy. Reconciliation then determines what actually happened.

Processes killed before an effect, during dispatch, and between the execution commit and its ledger append all recover to a correct state. Executed actions stay executed, consumed approvals stay consumed, budget spend is preserved, and no restart produces a duplicate effect.

Limitation · Candidate, not proven: this passes its own gate on a development profile. Acceptance requires the full profile on a controlled machine, which has not been run.

Each decision, authorization, outcome, refusal and configuration change is written as a signed record in a hash-linked chain. The record carries the request identity, the policy version, the decision, the approver where one exists, timestamps and the execution result.

Evidence is verified by a portable verifier with no database, no signing key, no network and no product installation on the path. Deliberately altered evidence — an edited amount inside a signed body, a stripped signature, a broken chain link, a checkpoint re-signed by the writer's own key — is refused, and a verifier that cannot run reports an instrument failure rather than a refusal.

Limitation · The verifier was written by the same party as the system it checks. Verifying with it confirms signatures, linkage and key separation; it is not a substitute for an independent implementation of the documented record format.

Where evidence protection is required, a failure of the witness that attests the evidence chain blocks new protected dispatch rather than letting execution continue unwitnessed. Reconciling work that may already have had an effect is never blocked, because refusing to reconcile would leave a real-world action in an unknown state to protect a log.

Evidence records and the checkpoints that attest them are signed by different keys held by different service identities. An attacker holding the record-signing key can rebuild a shorter, internally consistent, correctly signed chain and is still detected, because they cannot mint a checkpoint.

Limitation · Different key ids prove key separation. They are not custody. Custody is a deployment fact, reported only when a custody report measured at the deployment is supplied.

Custody is measured rather than asserted. Permission probes run as each service account and record the actual uid, gid and supplementary groups of every running process. A probe that could not run is reported as an error and fails the report — it is never read as a control that held.

Limitation · This is one host. An attacker with root on that host defeats the separation. Independence means a second administrative domain, which is what external trust checkpoints address and which is not built.

Checkpoints anchored outside the host that produced the evidence, so that completeness can be established against a party the writer does not control.

Limitation · Until this exists, truncation is detectable only up to the newest verified checkpoint, and everything above rests on a single administrative domain.

A requirement-by-requirement map from EU AI Act obligations to the specific technical control and the specific evidence object that supports it, stating coverage and stating gaps.

Limitation · Candidate, not proven: the validator checks structure and traceability. It cannot check that a legal reading is correct, and this map has not been reviewed by anyone with legal competence. It is engineering evidence, not legal advice.

Per-check verdicts of pass, fail, not-exercised, inconclusive or void, with a controlled cause for every non-verdict, positive controls, must-fail vectors, the exact checker and corpus versions, and artifact digests — so that an all-green result means something only when the checker was demonstrably capable of failing.

Limitation · Reproducible by design. Not yet reproduced by an independent party, which is the only thing that would move this to proven.