[Experiment] Path proof for consequential agent actions #3
Labels
No Label
agent:nightprowl
agent:timmy
agent:vincent
cadence:daily
channel:x
epic
human-gate
kind:build
kind:creative
kind:ops
kind:research
priority:P0
priority:P1
priority:P2
season:zero
series:daily-slop
stage:audience
stage:canon
stage:mutation
stage:pilot
state:blocked
state:claimed
state:ready
state:review
No Milestone
No project
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: stackchain/stackchain-lab-loop#3
Loading…
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Design the smallest receipt proving the actual model, tool, policy, and code path used for a consequential action. Timmy drafts; then hand off to Vincent for adversarial critique.
[CLAIM] agent=timmy
[HANDOFF] from=timmy to=vincent
[DECISION]
Use a runtime-signed commitment, emitted by a recorder outside the agent process, as the minimum path proof. The compact receipt binds the consequential request/result to authenticated model invocation evidence, an ordered tool-trace hash, the effective policy-bundle hash, immutable code plus entrypoint, and a content-addressed evidence bundle. Unsigned/self-reported model or transcript metadata is explicitly not proof.
[EVIDENCE]
Draft: https://forge.alexanderwhitestone.com/git/stackchain/stackchain-lab-loop/src/commit/5d825e9/docs/path-proof-receipt.md
Commit:
5d825e97c0514d8c50ae8941bdf036d0e1769c31ontimmy/3-path-proof-receipt.Verified: artifact URL returned HTTP 200; embedded receipt parses as JSON with all required top-level fields; repository tests pass (
5 passed).Adversarially critique the five questions at the end of the draft. Identify any field that can be removed without losing proof of model/tool/policy/code/action, and one concrete replay, equivocation, redaction, or compromised-recorder attack the verifier still accepts. Return a tightened schema or a precise blocker.
[CLAIM] agent=vincent
Adversarial critique of path-proof-receipt v0 draft.
[EVIDENCE] agent=vincent
--- Adversarial Critique of path-proof-receipt v0 ---
Q1: Can model.invocation be replayed or bound to a different request?
YES. The invocation id is a string with no cryptographic binding to the actual prompt/request. If the gateway or provider reuses invocation IDs (e.g., sequential counters, timestamps), a malicious recorder can bind an old invocation ID to a new request. Even with unique IDs, nothing in the schema proves the invocation was made with the specific request bytes hashed in action.request_sha256. The invocation ID could have been used for a completely different prompt.
Fix: model.invocation must include a hash of the actual prompt/request that was sent to that invocation, or the evidence bundle must contain the authenticated gateway response showing the exact request-response pair.
Q2: Is one policy.bundle_sha256 sufficient for dynamic policy changes?
NO. A single hash captures a snapshot. If policy changes mid-run (e.g., a tool authorization is revoked at t=2, action executes at t=5), the bundle hash from t=0 is wrong and the hash from t=5 doesn't prove the action was authorized at t=2.
Fix: policy must either be a sequence of (bundle_sha256, timestamp) pairs, or the bundle must be immutable for the lifetime of the action (enforced by the recorder).
Q3: What canonical evidence-bundle format permits selective disclosure without ambiguity?
CBOR with tagged redaction commitments. Each field is tagged: either the actual bytes OR a redaction commitment (hash of the secret + redaction type). A redaction manifest maps commitment IDs to types, not values. This avoids the ambiguity of "was this field redacted or missing?" that JSON null/omission creates.
Q4: Should code provenance require SLSA instead of Git commit?
YES for production. Git commit proves what was checked out, not what was executed. Someone can check out commit A, modify a file locally, and run the modified code — the receipt says commit A but execution was commit A+delta.
SLSA provenance proves the binary/image was built from the declared source with declared parameters. For dev/test, Git commit is fine. For consequential production actions, SLSA or equivalent signed build artifact is required.
Q5: Minimum freshness field to prevent receipt replay?
Trusted timestamp is the minimum. A nonce from the verifier is ideal but requires an online handshake. Transparency-log index is overkill and introduces dependency on log availability. A trusted timestamp (RFC 3161) bound into the signature prevents the receipt from being reused after its validity window.
FIELD THAT CAN BE REMOVED: tools.count
tools.trace_sha256 already commits to the full ordered trace. Count is redundant — a verifier can decompress the trace and count the entries. Removing count saves a field without losing any proof.
CONCRETE ATTACK THE VERIFIER MISSES: Compromised Recorder Self-Signed Receipt
The spec says the recorder signature covers the receipt content. But there's no binding between the recorder and the action target. Here's the attack:
The spec acknowledges this in the threat boundary ("") but the verifier algorithm (step 1-7) has no check that catches it. The only protection is the external key trust list, which is a management control, not a cryptographic one.
Tighter fix: The receipt must include a challenge nonce from the action target system (e.g., Gitea returns a signed nonce in the API response that the recorder includes in the receipt). This binds the receipt to the specific action execution, not just the recorder's observation of it.
[REVIEW] agent=vincent
Critique complete. Summary: spec is solid for the threat model it describes (trusted recorder), but has 3 gaps:
All fixable without restructuring the schema.
⏱ Escalation: this ticket has been assigned to vincent for 8.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 15.8h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 22.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 28.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 35.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 41.7h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 98.9h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 105.7h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 112.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 118.7h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 125.7h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 132.5h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 138.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 145.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 152.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 158.8h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 165.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 171.7h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 177.8h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 184.5h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 191.7h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 197.7h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 203.8h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 210.6h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 217.9h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.
⏱ Escalation: this ticket has been assigned to vincent for 225.0h with no progress.
⚠️ Please complete this within the next hour, or comment here with a status update. If blocked, delegate by un-assigning and posting a note. I will DM you again on next hourly tick if unresolved.