Epoch-Bound Attested Execution (EBAE)

Reference prototype for bounding the real-world authority of autonomous agents.

An agent may propose an action. It cannot release that action. A protected executor releases only after a current epoch manifest, a one-use certificate, the exact intent, and all release conditions agree — then durable records prevent crash/retry duplicates.

Prototype status	Working research reference — not production security software
Verification	30/30 adversarial tests pass (zero unauthorized effects in the test world)
License	Apache License 2.0
Design paper (v0.5)	doi:10.5281/zenodo.21625403
Predecessor paper (v0.4)	doi:10.5281/zenodo.21385239

---

Contents

• Quick start
• What this repository provides
• Repository layout
• Test matrix
• Documentation
• Reproducibility
• Limitations
• License

---

Quick start

Requires: Python 3.10 or newer

python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
python -m pip install -r requirements.txt
python attacks.py

A successful run ends with:

RESULT: 30/30 tests passed · unauthorized external effects: 0 required
realized transfers in adversarial world: 3 (all 3 authorized) · unauthorized: 0

The process exits nonzero if any test fails or if an unauthorized transfer is recorded.

Pinned dependency: cryptography==46.0.7

---

What this repository provides

This tree is the reconstructed, audit-remediated reference build of the EBAE software prototype. It implements the predecessor closure and release core exercised by a finite adversarial suite:

• Threshold-signed epoch manifests and Authorization Closure Digests (ACD)
• Independent certification of structured intents
• One-use certificates (unique certificate IDs and nonces)
• Durable PREPARED → SENT → CLOSED execution with crash/restart recovery
• Authenticated executor ↔ target binding (Ed25519 proof-of-possession)
• Persistent SQLite mock target with transactional idempotency
• Fail-closed safe mode on rollback / forged responses

It does not claim full EBAE v0.5 coverage (cumulative budgets, trusted resolver, separated receipt types, mediation-domain inventory, revocation-race states, formal model, and related items). See the gap report.

---

Repository layout

Path	Description
ebae_core.py	Protocol core: manifests, certifier, protected executor, recovery, receipts
bank.py	Persistent authenticated Profile-B mock target (SQLite)
attacks.py	Full 30-test attack and fault matrix
test-run.txt	Frozen transcript from a clean successful run
requirements.txt	Pinned Python dependency
SHA256SUMS	SHA-256 checksums for release members
AUDIT-REMEDIATION.md	Audit finding → fix → named test map
AUDITEBAE.pdf	Supplied audit and remediation record
EBAE-V0.5-GAP-REPORT.md	v0.5 design requirements vs current code
PROVENANCE.md	Reconstruction inputs, hashes, and identity limits
LICENSE	Apache License 2.0
.github/workflows/ci.yml	CI: checksums + full suite on Python 3.10–3.12

---

Test matrix

Original suite (17):
happy_path, certificate_replay, replay_no_effect, intent_substitution, quorum_forgery, context_splice, epoch_number_collision, concurrent_replay, toctou_drift, crash_after_effect, crash_before_invoke, unknown_outcome, conflicting_retry, bypass_attempt, emergency_transition, snapshot_rollback, effect_accounting

Audit remediations (12):
active_manifest_expiry, staged_manifest_expiry, activation_revalidates_staged_data, restart_restores_active_state, sent_but_not_received, sent_transition_rollback, invalid_amounts, executor_proof_of_possession, forged_target_response, persistent_target_idempotency, idempotent_concurrent_close, nonce_unique_across_certificates

Follow-up concurrency closeout (1):
concurrent_safe_mode_blocks_release

Traceability for the twelve remediations: AUDIT-REMEDIATION.md

---

Documentation

Document	Purpose
EBAE v0.5 white paper	Current protocol design baseline
EBAE v0.4 paper	Predecessor design record
Gap report	What is implemented vs what remains for v0.5
Provenance	How this build relates to earlier archives
Audit remediation map	Defect → code → test

---

Reproducibility

1. Install from a clean virtual environment using the pinned requirements.txt.
2. Verify file integrity: sha256sum -c SHA256SUMS
3. Run: python attacks.py
4. Optionally rely on GitHub Actions (.github/workflows/ci.yml) after you publish the repository.

Expected result: 30/30 with unauthorized effects 0.

---

Limitations

This is meaningful implementation evidence for a finite software model. It is not a mathematical proof, independent security audit, or production certification.

Notable residual limits:

• Monotonic continuity uses a file-backed simulation, not a TPM/TEE/HSM
• Human-approval tokens are counted, not cryptographically authenticated as people
• Single executor and single mock target only
• Canonical JSON is prototype-grade, not a cross-language conformance profile
• No machine-checked state-machine model in this repository
• Several v0.5 mechanisms are intentionally out of scope for this build — see the gap report

---

License

Code in this repository is licensed under the Apache License 2.0.
The white papers on Zenodo are separately licensed (see each Zenodo record).