Privacy-preserving action loop

Witnora provides independent assurance for covered action paths. It does not claim to control every action an agent can perform. A path is covered only when the write credential is isolated behind the registered Gateway and the target outcome is observed through a separately declared read path.

The loop

1. An Assurance Contract declares the capability, authority, exact effect, privacy boundary, evidence obligations, and revalidation triggers.
2. witnora contract compile deterministically produces policy, approval, grant-binding, probe, evidence, and privacy artifacts from one contract.
3. A Privacy Manifest denies undeclared egress. Raw prompts, source, credentials, arguments, results, and business identifiers remain local by default.
4. Resource and parameter values needed for equality checks leave the customer boundary only as purpose-separated tenant HMAC commitments.
5. A local resource-scope evaluator signs a minimal proof that the committed resource is allowed by the exact Contract scope.
6. A separately signed pre-execution read proves the declared preconditions before policy evaluation and dispatch.
7. Policy and human approval bind one canonical action digest.
8. A short-lived grant binds the same action. The local demo models the state transition; Hosted enforcement uses a Postgres row lock and conditional update for multi-instance atomic consumption. Redis locks are not the correctness boundary.
9. The controlled adapter executes with the write credential. An independent read path observes the target state, enforces eventuallyWithin, stableFor, chronology and freshness, and reconciles the target audit log.
10. The customer source, independently registered scope evaluator and outcome probe, and Witnora service sign separate portions of the packet.
11. witnora verify --offline verifies bindings, signatures, event continuity, artifacts, privacy commitments, outcome status, and evidence-strength claims without contacting Witnora.
12. Agent, policy, model, prompt, tool, probe, or contract scope changes require revalidation instead of silently preserving CURRENT.

Evidence strength

Evidence is not a scalar score. Witnora distinguishes:

• Reported: the agent or integration made a claim.
• Recorded: a registered collector preserved a signed, ordered event chain.
• Enforced: a controlled execution boundary redeemed the exact-action grant.
• Outcome verified: a separate read path observed the declared target state.
• Independently reviewed: a reviewer issued a scoped decision.

An execution can be enforced while its outcome remains INCONCLUSIVE. An HTTP 200 response is never treated as proof of business success.

Local quickstart

npx witnora@latest contract init
npx witnora@latest contract validate witnora.assurance-contract.json
npx witnora@latest contract compile witnora.assurance-contract.json
npx witnora@latest privacy init
npx witnora@latest privacy inspect witnora.privacy-manifest.json
npx witnora@latest import --format generic-eval eval-report.json --dry-run
npx witnora@latest demo assurance-loop
npx witnora@latest verify --offline .witnora/assurance-loop/witnora-evidence-packet.json \
  --trust .witnora/assurance-loop/witnora-trust-bundle.json

The reference target is a deterministic local sandbox record. It performs no payment, email, vendor, browser, or production write.

Run the four negative demonstrations:

npx witnora@latest demo assurance-loop --attack parameter-substitution
npx witnora@latest demo assurance-loop --attack replay
npx witnora@latest demo assurance-loop --attack false-success
npx witnora@latest demo assurance-loop --attack event-tamper

Each command exits non-zero and reports stable failure codes.

Privacy matrix

Explicit limitations

• The bundled demo uses local reference keys. Production verification requires caller-approved keys scoped to source, server attestor, outcome probe, and resource-scope evaluator roles, including historical validity and revocation.
• Existing Hosted generic collectors can still accept explicitly uploaded JSON and attachments. The new Privacy Manifest protects this assurance-loop path; it is not yet a universal content scanner for every legacy upload endpoint.
• The reference probe has a distinct signing identity but still runs locally in the same demo process. Production organizational independence requires that key and read credential to be operated outside the Agent and write Gateway process.
• Witnora cannot prevent writes performed with credentials outside the covered Gateway. Reconciliation can detect declared target-audit discrepancies, not prove the absence of every unknown path.