Witnora records what a high-risk agent action was authorized to do, whether execution passed through a controlled boundary, and whether an independent read path observed the intended outcome.
Protocol
- An issuer signs an immutable
agentcert.action_mandate.v0.1document. - A source collector signs
RUN_STARTEDbefore accepting action events. - Every event receives a strictly increasing sequence, payload digest, previous-event hash, event hash, and Ed25519 source signature.
- A high-risk action must bind to an active mandate before policy or approval.
- Execution requires a capability registered by
createControlledActionAdapter()whose credentials are unavailable to the agent process. - A separate read-only capability registered by
createIndependentOutcomeProbe()observes system state after execution. - The collector signs
RUN_COMPLETEDand a receipt that reconciles the journal, dropped events, mandate digest, action IDs, and evidence strength. - The hosted service may add a separate server attestation. It does not replace the customer-side source signature.
Evidence strength
| Level | Minimum claim |
|---|---|
reported | A producer supplied a result, without a reconciled source record. |
recorded | A source-signed, hash-linked run was reconciled without undeclared gaps. |
enforced | The action also used a verified mandate and credential-isolated execution adapter. |
outcome_verified | A separate outcome probe observed and matched the expected state. |
independently_reviewed | An identified reviewer issued a scoped assurance case over the underlying evidence. |
Levels are ordered claims, not scores. A passing test at reported is not equivalent to a passing action at outcome_verified.
Failure and recovery semantics
- Journal appends are persisted and
fsynced before they are returned. - Sink delivery is at least once. An acknowledgement advances only after the sink accepts a record.
- A malformed final JSONL fragment is removed on restart and recorded as
JOURNAL_RECOVERED. - Known drops create an explicit sequence gap and
EVENTS_DROPPEDrecord. Undeclared gaps, duplicates, broken hashes, or invalid signatures make the journal invalid. - Reusing a mandate ID with different bytes is rejected by the append-only mandate store.
Trust boundaries and non-claims
The v0.1 SDK rejects plain structural adapter objects and accepts only capabilities created by createControlledActionAdapter(), but process isolation and credential custody must still be enforced by the deployment architecture. If the agent can call the target system directly, it can bypass the SDK. The strongest deployment creates the adapter outside the agent process, keeps write credentials only in the Witnora-controlled gateway, and gives the outcome probe separate read credentials.
Hash linking detects later mutation and omission inside a collected journal; it cannot prove that an uninstrumented action never happened. Source keys must be protected and rotated outside the agent process. Witnora does not claim that a verified run guarantees future behavior or regulatory compliance.