Execution attestations
CAS attestation and remediation-loop attestation
CAS attestation proves linkage of a frozen execution proof with a conditional-write outcome. Remediation-loop attestation proves typed closure linking a prior BLOCK’s remediation transaction to a later ALLOW execution chain.
What attested execution is
CAS attestation: linkage of a frozen execution proof with a conditional-write outcome; authorized_and_committed only on a clean committed branch.
Remediation-loop attestation: typed closure linking a prior BLOCK’s remediation transaction to a later ALLOW execution chain; refuses when the input fingerprints match (unchanged input is not permission).
CAS attestation
Proves: linkage of a frozen execution proof with a conditional-write outcome; authorized_and_committed only on a clean committed branch.
Does not prove: only-write-on-host; that a version token proves change-fingerprint match; that committed-stale is safe; that the execution-result hash equals CAS bytes; that the host cannot bypass; a re-decision of governance ALLOW/BLOCK.
Attestation is pairing two inputs, not a new verdict.
conditional_write:true is host-asserted (the host says it conditioned on a version token); it is NOT independently CAS-verified by the guard.
commit_observation is observed at T3, not atomic: another writer may act between write and observation; token-only adapters compare version token not content; host attestation is a host claim layered on the measurement.
Remediation-loop attestation
Proves: typed closure linking a prior BLOCK’s remediation transaction to a later ALLOW execution chain; refuses when the input fingerprints match (unchanged input is not permission).
Does not prove: the patch addressed required changes; recheck scope was honored; no other changes rode along; the new ALLOW was caused by the remediation; that the host cannot bypass.
Correlation is not causation; fingerprint match is not a second authorize.
Where it appears
When a guarded call produces a machine GuardExecutionProof (outcome.proof), the guard can attach a human-readable proof block to the agent’s final answer. It is a signed, structural attestation of the receipt and execution fields the guard has available — with its boundary stated in the block itself.
The rendered block makes bound operation and change_fp visible, with execution fields including verdict kind, attempted, executed, enforced, and execution_result_hash. Read the execution proof block →
Last verified: 2026-08-20. Statement changes require source quotes.