WitnessLoop - Provable Autonomy for AI Agents at the Tool Boundary

Author : Gun Gun Febrianza

Email : gungunfebrianza@adaptive-institute.id

Whitepaper Skeleton v0.1 (Draft)

Status: Architecture and security-economics framing. No implementation results yet. Prototype ready, under testing.

Abstract

AI agents are being deployed into systems where actions have consequences, payments, filings, trades, collateral releases, but the evidence standard for machine action remains observability, not provability. Systems record what they claim happened; they cannot replay it, fork it, or prove why it happened. We present a trust architecture in which an agent's entire interface with the external world is converted into a causal, hash-chained, replayable event substrate. Three components are mutually dependent: browser/source instrumentation owns the boundary where intent meets reality; a local relay is the sole executor and sole custodian of secrets; the agent supplies adaptive judgment. Removing any one collapses the system. We define the attestation chain, effect tickets, two-phase commit for irreversible actions, and fork/replay semantics ("agent time travel"). We analyze the threat model honestly, including what the architecture cannot prove. As a reference application, we map the same architecture to continuous RWA collateral verification for tokenized bonds, defining a new standard, "continuous causal attestation and deriving its security-economics effects on fraud-window collapse, haircut compression, and verification as a priced, composable primitive.

1. Introduction

1.1 The problem? agency without evidence

Agents act, systems log. The log is a narrative, not a proof. The consequence, autonomy is capped by liability. Organizations either keep a human in the loop (killing throughput) or accept unaccountable action (killing trust). The missing primitive is a causal record of agent action strong enough for third-party verification, dispute resolution, and counterfactual audit.

1.2 The boundary thesis

Claim C1 (lead claim), agent trustworthiness can be reduced to properties of the tool boundary, not the model. If every externally meaningful act is requested, validated, executed, and recorded at one instrumented boundary, the interior of the agent which are "stochastic, opaque, unverifiable" stops being the trust surface.

Corollary, model improvements become orthogonal to trust improvements. This is the architectural bet of the paper.

1.3 Contributions (sharpened)

C1 - Boundary-as-evidence. Definition of an attested causal replay substrate for agent action: hash-chained transcript, effect tickets, two-phase commit, fork at event k with divergence measurement. New primitive: provable agent time travel.

C2 - The relay pattern. One local component that is simultaneously the sole executor, the sole secret custodian, and the transcript writer. Shows that auditable autonomy is achievable without a trusted cloud component ever seeing a credential.

C3 - Domain transfer to security economics. Same architecture, boundary relocated from web pages to registries/custodians/bank accounts, yields continuous RWA collateral verification. Defines the standard upgrade: periodic attestation → continuous causal attestation, with three derived economic effects (fraud window, haircut compression, priced verification).

1.4 What this paper is not (scope discipline)

Not a claim of ground truth, the chain attests what the source showed, not what reality is.

Not a legal framework, enforceability of the transcript is an open question

2. Background, Actors, and Threat Model

2.1 System actors

User / principal, owns credentials, sets policy, bears consequences.

Local relay, local process; sole executor, sole custodian, transcript writer, policy enforcer.

Agent, cloud or local model system; sees instrumented state; requests actions; never holds secrets.

Sources / tools, registries, custodian portals, bank APIs, browsers, payment rails — anything with an instrumented session.

Verifier, any third party given a transcript anchor; needs no trust in the agent vendor or relay operator.

2.2 Trust assumptions

The relay host is the root of trust (threat model covers its compromise in 4.2).

Sources may lie (bounded later in 4.3).

The model is untrusted in the security sense, its outputs are requests, never commands.

2.3 Threat model

T1 Prompt injection via instrumented content (page/registry data carries adversarial instructions).

T2 Stale-attestation replay (old evidence presented as current).

T3 Retroactive doctoring (any party edits the record after the fact).

T4 Relay host compromise.

T5 Collusion, agent vendor + relay operator + source, in pairs and triples.

T6 Policy bypass through semantic gap (structural validation passes, intent is wrong).

3. The Triad Architecture

3.1 Design principles

Principle 1 - Causal boundary

All externally meaningful interaction crosses exactly one instrumented surface.

Principle 2 - Custody separation

Secrets never enter the agent's trust domain.

Principle 3 - Attestation before effect

No irreversible action without a signed effect ticket already in the chain.

Principle 4 - Replay is the audit

If it cannot be re-executed, it is not evidence.

3.2 Instrumented Boundary

Generalized from DOM/network interception to any source like registry UI, custodian API, bank session, shell, payment rail.

What is captured per event like rendered state / response body hash, request parameters, timestamp, session identity, source fingerprint.

Why native? instrumentation owns the event loop boundary, observation and veto are the same act.

3.3 Local Relay

Components

Session broker (capability handles, no secret export), policy engine, transcript writer, effect dispatcher, two-phase commit coordinator.

Execution flow

Agent submits request → relay validates against visible state + policy + chain → dispatch via instrumented session → record result → release or hold effect.

Fail-closed default

Any validation gap holds, never releases.

3.4 Agent Loop

Intent in, requests out. The agent proposes, the relay disposes. For grounding, the agent sees only instrumented state and hallucinated selectors/requests die at validation.

3.5 The Attestation Chain

Append-only, hash-chained, co-signed (relay + instrumented session key).

Record types:

• MODEL (request/response),
• TOOL (call/result),
• STATE (environment snapshot hash),
• EFFECT (ticket: pre-commit → release/reject),
• POLICY (policy version at decision time).

External anchoring is a periodic anchoring of chain head to an external timestamping service [design choice: plain timestamping vs. blockchain anchoring, tradeoff discussion needed].

3.6 Fork and Replay

Fork at event k

Restore transcript snapshot, pin model version, replay cached generations where available, inject branch, resume in shadow environment.

Divergence measurement

Fork is valid until measured divergence from recorded chain exceeds threshold [TBD, requires prototype for divergence metric definition].

Hard limit

Irreversible real-world effects cannot be un-executed, forks are valid for evaluation, audit, and pre-release simulation, not for undoing consequences (4.3).

4. Security Analysis

4.1 The proof boundary: what the chain proves

Proves:

• what was requested, by which model version, under which policy, against which source state, and what was executed.
• non-repudiation across agent vendor, relay operator, and source.

Does not prove:

• That the source told the truth, that the world matches the record and legal enforceability.

4.2 Attack walkthroughs

4.2.1 T1 (injection)

Page/registry content smuggles instructions → agent misreads as intent → relay validates structure, not semantics → executes. Mitigation direction: semantic intent contract at the relay [open problem; see 9]. Honest status still unresolved, bounded by effect gating.

4.2.2 T2 (stale replay)

Mitigated structurally, every effect ticket binds to a fresh STATE record; a replayed old attestation fails freshness checks.

4.2.3 T3 (doctoring)

Mitigated structurally, hash chain + co-signing + external anchor; any edit invalidates all descendants.

4.2.4 T4 (relay compromise)

Chain falls with the host. Mitigation direction, relay in TEE / remote attestation and hardware key for co-signing [roadmap item].

4.2.5 T5 (collusion)

Pair collusion is defeated by co-signing separation; triple collusion (agent vendor + relay + source) reduces to the ground-truth problem, the honest bound of the system.

4.3 Fundamental limits

Ground truth limit

Attestation is only as good as the source. A compromised registry produces a perfectly attested lie.

Physical limit

Released effects cannot be rewound; forks prove intent, not restore consequences.

Semantic limit

Structural validation cannot fully capture user intent, the injection surface never fully closes.

5. Security Economics

5.1 The fraud window

Attack economics = exploit value × time undetected.

Periodic attestation (monthly) gives a ~30-day window by construction; continuous attestation compresses detection toward the event.

[TBD — requires prototype like detection latency distribution vs. oracle baseline.]

5.2 Haircut compression and cost of verification uncertainty

Overcollateralization is the market price of unverifiable collateral.

Provable continuous verification converts uncertainty into measured, legible risk → haircuts shrink, spreads tighten, capital efficiency rises.

[TBD — quantitative model like haircut as function of attestation freshness/frequency and compare against periodic attestation.]

5.3 Verification as a priced, composable primitive

Attestation grade becomes an on-chain legible parameter, so its real-time, replayable, composable by other protocols.

Direction mean as an attestation standard (record format, freshness semantics, verification API) as the deliverable that outlives any single implementation.

6. Reference Application - Continuous RWA Collateral Verification

6.1 Why RWA is the canonical fit

The asset is off-chain, the liability is on-chain. The trust gap between token and reality is exactly the boundary the architecture instruments.

6.2 Role mapping

Relay → verification custody relay

Holds registry/custodian/bank credentials, brokers all reads and custody breach structurally impossible by design.

Instrumentation → source instrumentation

Every read of lien filings, custodian portals, account statements is a signed event.

Agent → covenant verifier

Continuous reconciliation of on-chain bond state against attested evidence, breach and margin-call triggers as events, not month-end reports.

6.3 The standard upgrade

Incumbent

Periodic attestation, monthly custodian PDF, trusted by reputation.

Proposed

Continuous causal attestation, hash-chained evidentiary transcript from source to on-chain posting, replayable and forkable.

Properties

Freshness by construction, non-repudiation across parties, replayable provenance.

6.4 RWA-specific failure modes

Registry lies (ground-truth limit bites hardest here).

Legal enforceability where on-chain proof of off-chain lien requires the legal system to honor the transcript.

Oracle-vs-attestation confusion, markets must not treat an attestation price feed as equivalent to a market price feed.

7. Implementation Roadmap

Phase 1

Relay + instrumented browser session + transcript chain, single-tool scenario (e.g., attested web form submission). Deliverable is replayable demo.

Phase 2

Fork/replay engine, divergence metric, policy language v1. Deliverable is counterfactual audit of a scripted incident.

Phase 3

RWA reference build e.g. one custodian API + one lien registry + on-chain posting. Deliverable is continuous collateral attestation pilot.

Phase 4

TEE-hardened relay, external anchoring and standard proposal.

Evaluation harness

Replay fidelity, attestation overhead (latency/storage), detection latency vs. oracle baseline, red-team results on T1–T6.

8. Related Work Positioning (to be expanded)

Accountable / auditable agents

Agent logs, OpenTelemetry-style tracing, observability, not provability.

Verifiable compute and TEEs

Protect execution, we protect the boundary. Complementary, not competing (relay hardening).

Oracle design (Chainlink, etc.)

Price and data feeds and we provide provenance and replay, not price discovery.

Browser automation (Playwright and kin)

Supply the instrumented substrate; not custody, not attestation, not counterfactual audit.

RPA audit trails

Replay of fixed scripts; no open-ended agency, no fork semantics.

Positioning sentence (draft)

"Prior work secures the model, the execution environment, or the data feed. This work secures the boundary where all three meet and makes that boundary the unit of audit."

9. Open Problems (research agenda)

1. Semantic intent contracts, can the relay learn a cheap-to-specify, tight semantic contract of user intent that rejects adversarially injected instructions?
2. Ground truth, multi-source cross-attestation to bound single-source lying — cost and latency?
3. Minimal agent state checkpointing, what subset of model context makes branching exact rather than approximate?
4. Legal operability, can the transcript be made admissible enforcement evidence without reintroducing a trusted intermediary?
5. TEE-bound relays, does remote attestation of the relay meaningfully raise the bar against host compromise without destroying the local-custody property?