Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The separately published harness-tampering taxonomy informs surface selection, and its annotated corpus is not part of the executed evidence reported here.

“The separately published harness-tampering taxonomy informs surface selection [32]; its annotated corpus is not part of the executed evidence reported here.”

• cites [32] [32] Xing Wang, Xiaoyi Zhang, and Jie Shao. 2026. Auditing Harness Tampering in Self-Improving Agents. arXiv:2609.00069 [cs.CL] https://arxiv.org/abs/2609.00069 Version 1, submitted 30 August 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing).

Self-Evolving Agents with Anytime-Valid Certificates controls update admission against a fixed statistical error budget.

“Self-Evolving Agents with Anytime-Valid Certificates controls update admission against a fixed statistical error budget [23].”

• cites [23] [23] Biswa Sengupta. 2026. Self-Evolving Agents with Anytime-Valid Certificates. arXiv:2607.00871 [cs.AI] https: //arxiv.org/abs/2607.00871 Version 1, submitted 1 July 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Governing Dynamic Capabilities binds an agent certificate to a commitment over its model, tools, and permissions, invalidates access after a capability-set change, and records signed hash-linked interactions in a trust tree.

“Governing Dynamic Capabilities binds an agent certificate to a commitment over its model, tools, and permissions, invalidates access after a capability-set change, and records signed hash-linked interactions in a trust tree [40].”

• cites [40] [40] Ziling Zhou. 2026. Governing Dynamic Capabilities: Cryptographic Binding and Reproducibility Verification for AI Agent Tool Use. arXiv:2603.14332 [cs.CR] https://arxiv.org/abs/2603.14332 Version 2, revised 19 March 2026. - sourcePartly supported

  Section 3.1 defines a certificate with a model binding and a skills manifest containing tool permissions; Theorem 5 says access is denied when the runtime capability hash differs from the certificate hash. Definitions 8–9 describe signed, hash-linked interaction records in a verifiable interaction ledger, not in the trust propagation tree described in §3.3. The claim conflates those two structures. (LLM, conf=0.88)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

SEVerA formulates self-evolving agent synthesis with formal output contracts and verified fallbacks, preserving specified behavioral constraints during optimization.

“SEVerA formulates self-evolving agent synthesis with formal output contracts and verified fallbacks, preserving specified behavioral constraints during optimization [2].”

• cites [2] [2] Debangshu Banerjee, Changming Xu, Eugene Ie, Ming Zhang, Daiyi Peng, Chu-Cheng Lin, and Gagandeep Singh. 2026. SEVerA: Verified Synthesis of Self-Evolving Agents. arXiv:2603.25111 [cs.LG] https://arxiv.org/abs/2603.25111 Version 2, revised 24 April 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Bad Genius challenges candidate harness improvements with valid counterfactual benchmark transformations and retains confirmed transformations in a finite archive, reducing dependence on task-specific shortcuts.

“Bad Genius instead challenges candidate harness improvements with valid counterfactual benchmark transformations and retains confirmed transformations in a finite archive, reducing dependence on task-specific shortcuts [41].”

• cites [41] [41] Guojun Zhu, Xunheng Huang, Peng Yin, Jiahui Xie, Sanguo Zhang, and Doudou Zhou. 2026. Bad Genius: CounterfactualGuided Harness Evolution Beyond Task-Specific Shortcuts. arXiv:2609.18366 [cs.AI] doi: 10.48550/arXiv.2609.18366 Version 3, revised 24 September 2026. - sourcePartly supported

  The Abstract and Introduction describe a Challenger that tests harness updates with validity-preserving counterfactual benchmark transformations and adds confirmed counterfactuals to a finite archive. But the Introduction distinguishes task-specific shortcuts from the benchmark-wide protocol shortcuts CHASE targets; it does not present reducing dependence on task-specific shortcuts as the method’s aim. (LLM, conf=0.88)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Bounded-agent designs attenuate delegation and constrain composition.

“Bounded-agent designs attenuate delegation and constrain composition [19].”

• cites [19] [19] Xabier Muruaga. 2026. Bounded Agents: Delegation Security for Multi-Agent AI Systems. arXiv:2608.15888 [cs.AI] https://arxiv.org/abs/2608.15888 Version 1, submitted 16 August 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

RegenHarness adds an evidence-gated recursive-improvement loop for a robot harness: candidate configuration changes pass fixed regressions and release authorization before versioned rollout or rollback, and the system is exercised on a real quadruped.

“RegenHarness adds an evidence-gated recursive-improvement loop for a robot harness: candidate configuration changes pass fixed regressions and release authorization before versioned rollout or rollback, and the system is exercised on a real quadruped [30].”

• cites [30] [30] Kailin Wang, Haoxiang Jie, Yaoyuan Yan, Zhiyou Heng, and Zhaosong Li. 2026. RegenHarness: A Robot Agent Harness with Evidence-Gated Recursive Self-Improvement. arXiv:2609.27612 [cs.RO] doi: 10.48550/arXiv.2609.27612 Version 1, submitted 23 September 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

OurArk treats code, prompts, tools, skills, policies, tests, and evolution mechanisms as an identity-bearing, versioned body; its Genesis and Enoch artifacts demonstrate governed changes and recursive descent.

“OurArk treats code, prompts, tools, skills, policies, tests, and evolution mechanisms as an identity-bearing, versioned body; its Genesis and Enoch artifacts demonstrate governed changes and recursive descent [38].”

• cites [38] [38] Roy Zhao and Zhenyu Zhao. 2026. Code Is the Body: Agent-Owned Software Bodies for Recursive Evolution and Descent. arXiv:2607.28691 [cs.SE] https://arxiv.org/abs/2607.28691 Version 1, submitted 30 July 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

VERA records federated delegation edges and supplies verifiable revocation across organizational workflow boundaries.

“VERA records federated delegation edges and supplies verifiable revocation across organizational workflow boundaries [17].”

• cites [17] [17] Lifei Liu, Haoran Yu, and Xiaochong Jiang. 2026. VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows. arXiv:2608.30091 [cs.AI] https://arxiv.org/abs/2608.30091 Version 1, submitted 30 August 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing).

Authorization propagation systems carry user and policy constraints through multi-agent workflows.

“Authorization propagation systems carry user and policy constraints through multi-agent workflows [26].”

• cites [26] [26] Krti Tallam. 2026. Authorization Propagation in Multi-Agent AI Systems: Identity Governance as Infrastructure. arXiv:2605.05440 [cs.AI] https://arxiv.org/abs/2605.05440 Version 1, submitted 6 May 2026. - sourceSupported

Classified as probably not a substantial claim.

Earned Authority's stated boundary leaves cross-generation revocation and population-level authority open.

“Its stated boundary leaves crossgeneration revocation and population-level authority open.”

• cites [37] [37] Zhaoxi Zhang and Xiaomei Zhang. 2026. Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents. arXiv:2607.23586 [cs.AI] https://arxiv.org/abs/2607.23586 Version 1, submitted 26 July 2026. - sourceSupported

Classified as probably not a substantial claim.

Auditing Harness Tampering develops a taxonomy and annotated edit pairs for changes that compromise authorization, provenance, completeness, or evaluation integrity.

“Auditing Harness Tampering develops a taxonomy and annotated edit pairs for changes that compromise authorization, provenance, completeness, or evaluation integrity [32].”

• cites [32] [32] Xing Wang, Xiaoyi Zhang, and Jie Shao. 2026. Auditing Harness Tampering in Self-Improving Agents. arXiv:2609.00069 [cs.CL] https://arxiv.org/abs/2609.00069 Version 1, submitted 30 August 2026. - sourceSupported

Classified as probably not a substantial claim. May combine two claims.

Earned Authority binds authority to a grant-fixed transition envelope and immutable effect ceiling, covering multiple classes of security-relevant change and proving conditional non-amplification.

“Earned Authority directly addresses whether an evolving agent may retain a grant after a transition. It binds authority to a grant-fixed transition envelope and immutable effect ceiling, covering multiple classes of security- relevant change and proving conditional non-amplification [37].”

• cites [37] [37] Zhaoxi Zhang and Xiaomei Zhang. 2026. Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents. arXiv:2607.23586 [cs.AI] https://arxiv.org/abs/2607.23586 Version 1, submitted 26 July 2026. - sourceSupported

Classified as probably not a substantial claim. May combine two claims.

Agent Contracts gives a formal multidimensional resource-contract framework with conservation across hierarchical, parallel, and recursive delegation; retrieval-conditioned topology selection proves a six-dimensional budget algebra for changing multi-agent topologies; and Token Budgets uses affine ownership to prevent clone, double-spend, and use-after-delegation failures.

“Agent Contracts gives a formal multidimensional resource-contract framework with conservation across hierarchical, parallel, and recursive delegation; retrieval-conditioned topology selection proves a six-dimensional budget algebra for changing multi-agent topologies; and Token Budgets uses affine ownership to prevent clone, double-spend, and use-after-delegation failures [13, 27, 33].”

• cites [13] [13] Sajjad Khan. 2026. Token Budgets: An Empirical Catalog of 63 LLM-Agent Budget-Overrun Incidents, with an AffineTyped Rust Mitigation as a Case Study. arXiv:2606.04056 [cs.SE] https://arxiv.org/abs/2606.04056 Version 1, submitted 2 June 2026. - sourcePartly supported

  Split into 3 atoms — 2 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

  Experimental — accuracy not yet measured
• cites [27] [27] Abhijit Talluri, Pujith Anne, Bhagavan Choudary Pendiyala, and Raghavendra Chilukuri. 2026. Retrieval-Conditioned Topology Selection with Provable Budget Conservation for Multi-Agent Code Generation. arXiv:2605.05657 [cs.AI] https://arxiv.org/abs/2605.05657 Version 1, submitted 7 May 2026. - sourcePartly supported

  Split into 3 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.

  Experimental — accuracy not yet measured
• cites [33] [33] Qing Ye and Jing Tan. 2026. Agent Contracts: A Formal Framework for Resource-Bounded Autonomous AI Systems. arXiv:2601.08815 [cs.MA] https://arxiv.org/abs/2601.08815 Version 3, revised 25 March 2026. - sourcePartly supported

  Split into 3 atoms — 1 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 2 unverifiable. Expand the claim to see per-atom verdicts.

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Darwin Gödel Machine demonstrates open-ended evolution in which coding agents modify their own code and successful variants remain in an archive.

“Darwin Gödel Machine demonstrates open-ended evolution in which coding agents modify their own code and successful variants remain in an archive [34].”

• cites [34] [34] Jenny Zhang, Shengran Hu, Cong Lu, Robert Lange, and Jeff Clune. 2025. Darwin Gödel Machine: Open-Ended Evolution of Self-Improving Agents. arXiv:2505.22954 [cs.AI] https://arxiv.org/abs/2505.22954 Version 3, revised 12 March 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Progressive Risk Vesting holds a trajectory-level risk budget in escrow and charges recursively spawned branches when they cross an irreversible activation boundary, proving an anytime probabilistic harm bound under history-conditional local certificates.

“Progressive Risk Vesting (PRV) holds a trajectory-level risk budget in escrow and charges recursively spawned branches when they cross an irreversible activation boundary, proving an anytime probabilistic harm bound under history-conditional local certificates [31].”

• cites [31] [31] Molly Wang. 2026. Spawn Freely, Act Sparingly: Progressive Risk Vesting for Recursive LLM-Agent Trees. arXiv:2609.01035 [cs.AI] https://arxiv.org/abs/2609.01035 Version 1, submitted 1 September 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The DGM run freezes public commit a565fd2d1dca504ef5104a7c c0f3bdc4ab9b4fd2 under Apache-2.0 and measures a 35-file source closure.

“The DGM run freezes public commit a565fd2d1dca504ef5104a7c c0f3bdc4ab9b4fd2 under Apache-2.0 and measures a 35-file source closure [34].”

• cites [34] [34] Jenny Zhang, Shengran Hu, Cong Lu, Robert Lange, and Jeff Clune. 2025. Darwin Gödel Machine: Open-Ended Evolution of Self-Improving Agents. arXiv:2505.22954 [cs.AI] https://arxiv.org/abs/2505.22954 Version 3, revised 12 March 2026. - sourcePartly supported

  The Abstract (p. 1) says the DGM code is open-sourced on GitHub, supporting the public-code portion of the claim. Our copy does not identify the stated commit, specify an Apache-2.0 license, or report a 35-file source closure; searches for those details found no supporting passage. (LLM, conf=0.83)

  Experimental — accuracy not yet measured

Classified as probably not a substantial claim. May combine two claims.

The OurArk run freezes Genesis v0.1.1 at commit e7bb896411db0d82710fab50 c1978b825297844f and Enoch v0.3.1 at 1021e1dacce85f4a2edebd865673671bb37a2142, both under Apache-2.0, and exercises their public descent path.

“The run freezes Genesis v0.1.1 at commit e7bb896411db0d82710fab50 c1978b825297844f and Enoch v0.3.1 at 1021e1dacce85f4a2edebd865673671bb37a2142 , both under Apache-2.0, and exercises their public descent path [38].”

• cites [38] [38] Roy Zhao and Zhenyu Zhao. 2026. Code Is the Body: Agent-Owned Software Bodies for Recursive Evolution and Descent. arXiv:2607.28691 [cs.SE] https://arxiv.org/abs/2607.28691 Version 1, submitted 30 July 2026. - sourcePartly supported

  Section 5 identifies Genesis v0.1.1 and Enoch v0.3.1 as Apache-2.0 releases at public, immutable snapshots, and the Conclusion describes a cross-artifact descent check using those releases. The Conclusion gives the full Enoch commit, but our copy shows only the abbreviated Genesis commit e7bb896, so it does not verify the claimed full Genesis hash. (LLM, conf=0.87)

  Experimental — accuracy not yet measured

Classified as probably not a substantial claim.

Work on epistemic Sybil resistance tracks evidence ancestry to prevent copied or correlated evidence from appearing independent.

“Work on epistemic Sybil resistance tracks evidence ancestry to prevent copied or correlated evidence from appearing independent [3].”

• cites [3] [3] Marc Bara. 2026. Epistemic Sybil Resistance: Multiplying AI Agents Without Multiplying Evidence. arXiv:2609.01873 [cs.AI] https://arxiv.org/abs/2609.01873 Version 1, submitted 1 September 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing).

Attested delegation ancestry binds outputs to signed delegation paths, strengthening provenance for downstream verification.

“Attested delegation ancestry binds outputs to signed delegation paths, strengthening provenance for downstream verification [16, 25].”

• cites [16] [16] Lifei Liu and Haoran Yu. 2026. Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems. arXiv:2608.30387 [cs.CR] https://arxiv.org/abs/2608.30387 Version 1, submitted 31 August 2026. - sourceSupported
• cites [25] [25] Stefania S , tefănescu and Iulian Aciobănit , ei. 2026. Lineage: A UMA 2.0 Protocol Extension for Multi-Hop LLM Agent Delegation. IEEE Access 14 (2026), 104574-104591. doi: 10.1109/ACCESS.2026.3708618 - sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

ResidualAuth characterizes why future-correct revocation requires authorization history beyond current reachability.

“ResidualAuth further characterizes why future-correct revocation requires authorization history beyond current reachability [6].”

• cites [6] [6] Moonwon Choi, Seokho Jeong, and Seunggeun Lee. 2026. ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation? arXiv:2609.08062 [cs.AI] https://arxiv.org/abs/2609.08062 Version 1, submitted 8 September 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing).

Autogenesis provides an auditable versioned evolution and rollback lifecycle.

“Autogenesis likewise provides an auditable versioned evolution and rollback lifecycle [35].”

• cites [35] [35] Wentao Zhang, Zhe Zhao, Haibin Wen, Yingcheng Wu, Cankun Guo, Ming Yin, and Bo An. 2026. Autogenesis: A Self-Evolving Agent Protocol. arXiv:2604.15034 [cs.AI] https://arxiv.org/abs/2604.15034 Version 5, revised 20 June 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

ACRFence studies action replay and authority resurrection after agent checkpoint restore, while Agent libOS combines capability-controlled processes, parent-child lineage, ceilings, budgets, checkpoint images, restore intersection, and prepare-dispatch-settle execution.

“ACRFence directly studies action replay and authority resurrection after agent checkpoint restore, while Agent libOS combines capability-controlled processes, parent-child lineage, ceilings, budgets, checkpoint images, restore intersection, and prepare-dispatch-settle execution [36, 39].”

• cites [36] [36] Yingqi Zhang. 2026. Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents. arXiv:2606.03895 [cs.OS] https://arxiv.org/abs/2606.03895 Version 3, revised 18 August 2026. - sourcePartly supported

  Split into 2 atoms — 1 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.

  Experimental — accuracy not yet measured
• cites [39] [39] Yusheng Zheng, Yiwei Yang, Wei Zhang, and Andi Quinn. 2026. ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore. arXiv:2603.20625 [cs.CR] https://arxiv.org/abs/2603.20625 Version 1; CoDAIM Workshop 2026. - sourcePartly supported

  Split into 2 atoms — 1 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.

  Experimental — accuracy not yet measured

May combine two claims.

Root-scoped authorization quiescence accounts for every manifested pre-cut carrier under a retired root epoch and composes provider-frontier certificates while preserving independently sufficient support.

“Root-scoped authorization quiescence additionally accounts for every manifested pre-cut carrier under a retired root epoch and composes provider-frontier certificates while preserving independently sufficient support [42].”

• cites [42] [42] Genliang Zhu and Chu Wang. 2026. Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution. arXiv:2609.21284 [cs.PL] doi: 10.48550/arXiv.2609.21284 Version 1, submitted 18 September 2026. sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Capability systems established unforgeable authority tokens, delegation by possession, attenuation, and the importance of controlling the complete path to an object.

“Capability systems established unforgeable authority tokens, delegation by possession, attenuation, and the importance of controlling the complete path to an object [1, 7, 20].”

• cites [1] [1] Martín Abadi, Michael Burrows, Butler Lampson, and Gordon Plotkin. 1993. A Calculus for Access Control in Distributed Systems. ACM Transactions on Programming Languages and Systems 15, 4 (1993), 706-734. doi: 10.1145/ 155183.155225 - sourcePartly supported

  Section 5.1 describes capability systems as allowing transferable delegation certificates and delegation of limited rights. The discussion of roles and least privilege says capabilities can be restricted before being passed across address spaces. Our copy does not establish the claims about unforgeable authority tokens or controlling the complete path to an object. (LLM, conf=0.85)

  Experimental — accuracy not yet measured
• cites [7] [7] Jack B. Dennis and Earl C. Van Horn. 1966. Programming Semantics for Multiprogrammed Computations. Commun. ACM 9, 3 (1966), 143-155. doi: 10.1145/365230.365252 - sourceSupported
• cites [20] [20] Jerome H. Saltzer and Michael D. Schroeder. 1975. The Protection of Information in Computer Systems. Proc. IEEE 63, 9 (1975), 1278-1308. doi: 10.1109/PROC.1975.9939 - sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Stop Means Stop measures sibling leaks, cancellation orphans, timeout zombies, and replay, and supplies an external fence-on-cancel control.

“Stop Means Stop measures sibling leaks, cancellation orphans, timeout zombies, and replay, and supplies an external fence-on-cancel control [12].”

• cites [12] [12] Sajjad Khan. 2026. Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives. arXiv:2607.14166 [cs.SE] https://arxiv.org/abs/2607.14166 Version 3, revised 8 August 2026. - sourceSupported

Classified as probably not a substantial claim.

Heartbeat-Bound Hierarchical Credentials establishes cascading revocation in an agent hierarchy by requiring periodic parent liveness proofs and bounding the resulting zombie window under its timing and key assumptions.

“Heartbeat-Bound Hierarchical Credentials (HBHC) already establishes cascading revocation in an agent hierarchy by requiring periodic parent liveness proofs and bounding the resulting zombie window under its timing and key assumptions [8].”

• cites [8] [8] Saurabh Deochake. 2026. Heartbeat-Bound Hierarchical Credentials: Cryptographic Revocation for AI Agent Swarms. arXiv:2605.20704 [cs.CR] https://arxiv.org/abs/2605.20704 Version 1, submitted 20 May 2026. - sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Cordon provides task-scoped semantic transactions for staging and validating composed tool effects; AID-Guard provides a stateful request-to-provider lifecycle with reservation and retry control.

“Cordon provides task-scoped semantic transactions for staging and validating composed tool effects [5]; AID-Guard provides a stateful request-toprovider lifecycle with reservation and retry control [28].”

• cites [5] [5] Zheng Chen, Hanqing Liu, Duling Xu, Dong Dong, Jialin Li, Bangzheng Pu, and Jidong Zhai. 2026. Cordon: Semantic Transactions for Tool-Using LLM Agents. arXiv:2606.17573 [cs.OS] https://arxiv.org/abs/2606.17573 Version 1, submitted 16 June 2026. - sourceSupported
• cites [28] [28] Yingzhe Tong, Leyu Dai, and Songhui Guo. 2026. AID-Guard: Stateful Authorization for Delegated Agent Effects. arXiv:2608.21159 [cs.CR] https://arxiv.org/abs/2608.21159 Version 1, submitted 21 August 2026. - sourceSupported

Classified as probably not a substantial claim.

Cross-substrate authority work argues that authority state must survive movement among agent runtimes and orchestration surfaces.

“Cross-substrate authority work likewise argues that authority state must survive movement among agent runtimes and orchestration surfaces [14].”

• cites [14] [14] Yang Li, Sergey Volkov, Hai Liu, Zongsi Xu, Xiyu Chen, Tuo Zhou, Dian Shao, Hao Sun, and Ye Lu. 2026. Beyond Agent Harnesses: Cross-Substrate Authority for Multi-Agent Systems. arXiv:2609.08472 [cs.MA] https://arxiv. org/abs/2609.08472 Version 1, submitted 8 September 2026. - sourcePartly supported

  The Abstract describes authority state held by a runtime, registry, or approval service outside agent memory and workspaces. The section “Separate artifact identity from action authorization” argues for binding that state to an action permit and validating it at execution. Our copy does not establish that authority state must survive movement among different agent runtimes or orchestration surfaces. (LLM, conf=0.82)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

Effect Closure characterizes when a prior authorization has lost its remaining provider-side path to an effect.

“Effect Closure characterizes when a prior authorization has lost its remaining provider-side path to an effect [22].”

• cites [22] [22] Igor Santos-Grueiro. 2026. When Does Authorization End? Effect Closure at Provider Boundaries. arXiv:2609.02866 [cs.CR] https://arxiv.org/abs/2609.02866 Version 1, submitted 2 September 2026. - sourcePartly supported

  Section 2 says effect closure asks whether issued authority still has a path to an effect the application rejects. The Abstract likewise defines closure as the absence of paths to rejected effects. The claim captures the provider-side path idea but omits the policy-relative qualifier: closure does not require losing paths to every effect. (LLM, conf=0.86)

  Experimental — accuracy not yet measured

May combine two claims.

Separate adapters reproduce all 32 decisions around one measured OurArk descendant and one Darwin Gödel Machine EditTool mutation, each with fresh-process restart, atomic succession, and predecessor rejection.

“Separate adapters reproduce all 32 decisions around one measured OurArk descendant and one Darwin Gödel Machine EditTool mutation, each with fresh-process restart, atomic succession, and predecessor rejection.”

May combine two claims.

An independent checker accepts all 64 original traces and rejects 28/28 outerresealed semantic mutants; 12/12 profile invariants, 16/16 crash cuts, and 32/32 contender schedules pass.

“An independent checker accepts all 64 original traces and rejects 28/28 outerresealed semantic mutants; 12/12 profile invariants, 16/16 crash cuts, and 32/32 contender schedules pass.”

Classified as probably not a substantial claim. May combine two claims.

The executable singleton path realizes the authorization object as a held reservation bound to the predecessor residual and population version; the executable fork path validates the complete family inline and records the atomic fork event, not consuming a collection of staged child reservations.

“The executable singleton path realizes 𝜒 as a held reservation bound to the predecessor residual and population version. The executable fork path validates the complete family inline and records the atomic fork event; it does not consume a collection of staged child reservations.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The reference realization fixes the manifest schema, uses effect-label sets and nonnegative integer budgets, and validates declared control-root separation and digest-bound authorization records.

“The reference realization fixes the manifest schema, uses effect-label sets and nonnegative integer budgets, and validates declared control-root separation and digest-bound authorization records.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In the reference realization, the fork transfer condition additionally means pairwise-disjoint child effect-label sets and a componentwise sum of child budgets no greater than the predecessor's reconstructed residual.

“In the reference realization, (10) additionally means pairwise-disjoint child effect-label sets and a componentwise sum of child budgets no greater than the predecessor's reconstructed residual.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The abstract algebra in Section 4 permits a registered multiplicity-aware relation, but the reference artifact does not implement a more general shareability rule.

“The abstract algebra in Section 4 permits a registered multiplicity-aware relation, but the reference artifact does not implement a more general shareability rule.”

Classified as probably not a substantial claim. May combine two claims.

The ledger stores each generation's grant immutably; a budget-consuming effect atomically appends one receipt/debit at commitment, and remaining authority is reconstructed from that grant and the receipts.

“The ledger stores each generation's grant immutably. A budget-consuming effect atomically appends one receipt/debit at commitment; remaining authority is reconstructed from that grant and the receipts.”

Classified as probably not a substantial claim. May combine two claims.

Qualitative effects consume no numeric budget unless their profile declares one, but the reference realization still prohibits copying a label across active siblings.

“Qualitative effects consume no numeric budget unless their profile declares one, but the reference realization still prohibits copying a label across active siblings.”

Classified as probably not a substantial claim. May combine two claims.

For staged single-successor promotion, the ledger reserves the proposed allocation against one population version and one digest of the unique predecessor's current residual; the reservation binds the complete effect-label set, additive budgets, certification record, predecessor, child, and single-use reservation identity; creating it does not authorize effects; in the reference realization, a

“For staged single-successor promotion, the ledger reserves the proposed allocation against one population version and one digest of the unique predecessor's current residual. The reservation binds the complete effect-label set, additive budgets, certification record, predecessor, child, and single-use reservation identity. Creating it does not authorize effects. In the reference realization, a”

May combine two claims.

The registry computes a generation identifier only from a complete canonical record; Table 3 separates the executable reference record from profile-level extensions; omission or addition of a field in the fixed reference schema is a registration error rather than an implicit wildcard.

“The registry computes a generation identifier only from a complete canonical record. Table 3 separates the executable reference record from profile-level extensions. Omission or addition of a field in the fixed reference schema is a registration error rather than an implicit wildcard.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In both paths, the artifact executes the exact-binding and freshness guards; acceptance by an authenticated external caller remains the A2 premise, and no public-key authorization-record implementation is claimed.

“In both paths, the artifact executes the exact-binding and freshness guards in (11); acceptance by an authenticated external caller remains the A2 premise. No public-key authorization-record implementation is claimed.”

• AssumptionThe authors state this as an assumption: Authentic canonical identity.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Caller authentication remains an A2 deployment premise; the artifact does not implement public-key signature verification, multi-parent generation identity, or a merge transition.

“Caller authentication remains an A2 deployment premise; the artifact does not implement public-key signature verification, multi-parent generation identity, or a merge transition.”

• AssumptionThe authors state this as an assumption: Authentic canonical identity.

Classified as probably not a substantial claim. May combine two claims.

The reference artifact executes the frozen-control-root and digest binding checks; it does not execute caller authentication or public-key signature verification.

“The reference artifact executes the remaining frozen-control-root and digest binding checks; it does not execute caller authentication or public-key signature verification.”

• AssumptionThe authors state this as an assumption: Authentic canonical identity.

Classified as probably not a substantial claim. May combine two claims.

The reference realization implements the narrower evidence-record boundary used by the experiments: one opaque evidence digest and APPROVE decision are bound to the exact generation and subject manifest, and the proposer and certifier identifiers are resolved through a frozen declared-control-root registry and required to differ at that root; it does not evaluate the opaque evidence, implement a

“The reference realization implements the narrower evidence-record boundary used by the experiments: one opaque evidence digest and APPROVE decision are bound to the exact generation and subject manifest, and the proposer and certifier identifiers are resolved through a frozen declared-control-root registry and required to differ at that root. It does not evaluate the opaque evidence, implement a”

• AssumptionThe authors state this as an assumption: Authentic canonical identity.

Probably not a substantial claim: may not pass S4 (based).

The frozen executable profile instantiates one authorization parent per successor.

“The frozen executable profile instantiates one authorization parent per successor.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The crash cuts exercise the atomic predecessor-fence/successor-activation publication path; they are not presented as separate crash experiments for every protocol operation.

“They exercise the atomic predecessorfence/successor-activation publication path; they are not presented as separate crash experiments for every protocol operation.”

Classified as probably not a substantial claim. May combine two claims.

Registered regressions cover identity and lineage substitution, missing ancestry, active revoked lineage, population ceiling breaches, illegal phase transitions, certificate/state mismatch, control-root aliasing, reservation reopening, verdict and oracle flips, accepted fenced effects, incomplete revocation, false re-root, rollback identity reuse, fabricated or detached consumptions, corruptedroot

“Registered regressions cover identity and lineage substitution, missing ancestry, active revoked lineage, population ceiling breaches, illegal phase transitions, certificate/state mismatch, control-root aliasing, reservation reopening, verdict and oracle flips, accepted fenced effects, incomplete revocation, false re-root, rollback identity reuse, fabricated or detached consumptions, corrupted”

Classified as probably not a substantial claim.

The frozen executable profile covers replacement, predecessor-fencing fork allocation, nested succession, rollback, and independent re-root.

“It covers replacement, predecessor-fencing fork allocation, nested succession, rollback, and independent re-root.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The expected total is 14 allows and 18 denies.

“The expected total is 14 allows and 18 denies.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The two logical runtime mappings are provider-free mappings, not measurements of named external systems.

“They are provider-free mappings, not measurements of named external systems.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The paper maintains three separately sealed evidence bundles: the provider-free core artifact, the OurArk adapter, and the Darwin Gödel Machine (DGM) adapter.

“We maintain three separately sealed evidence bundles: the provider-free core artifact, the OurArk adapter, and the Darwin Gödel Machine (DGM) adapter.”

Classified as probably not a substantial claim. May combine two claims.

The two mappings share the typed input contract, transcript recorder, and semantic ledger, while their dispatch translations are separately coded.

“They share the typed input contract, transcript recorder, and semantic ledger, while their dispatch translations are separately coded.”

Classified as probably not a substantial claim. May combine two claims.

The contract carries source-native identifiers for audit correlation, but effect authorization receives the canonical generation identifier and loads the lineage, allocation, reservations, and population state inside the serialized ledger operation.

“The contract also carries source-native identifiers for audit correlation, but effect authorization receives the canonical generation identifier and loads the lineage, allocation, reservations, and population state inside the serialized ledger operation.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Both adapters execute all 32 cases, producing 64 paired mappings.

“Both adapters execute all 32 cases, producing 64 paired mappings.”

May combine two claims.

The checker and executable cases validate the fixed eight-field manifest, frozen control-root registry, digest-bound records, single-parent succession, atomic fork, disjoint effect labels, and integer budgets described above.

“The checker and executable cases validate the fixed eight-field manifest, frozen control-root registry, digest-bound records, single-parent succession, atomic fork, disjoint effect labels, and integer budgets described above.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The formal model permits a separate, non-authorizing source record for provenance, and the external adapter evidence uses source-native identifiers for audit correlation; the reference re-root authorization record itself contains no provenance/source field.

“The formal model permits a separate, non-authorizing source record for provenance, and the external adapter evidence uses source-native identifiers for audit correlation; the reference re-root authorization record itself contains no provenance/source field.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Twenty-four cases cross six mutation surfaces with four outcomes, and the remaining eight exercise generation and population transitions.

“Twenty-four cases cross six mutation surfaces with four outcomes. The remaining eight exercise generation and population transitions.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The frozen executable profile has no multi-parent merge transition; branch coordination can authorize a complete effect only through one current witness or a separately issued root.

“It has no multi-parent merge transition; branch coordination can authorize a complete effect only through one current witness or a separately issued root.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

General profile digests, extra manifest fields, per-atom epoch vectors, public-key signatures, arbitrary relational authority predicates, and multi-parent merge are outside the executable evidence claim.

“General profile digests, extra manifest fields, per-atom epoch vectors, public-key signatures, arbitrary relational authority predicates, and multi-parent merge are outside that executable evidence claim.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The 16 registered crash cuts are persistence-level boundaries around opening, writing, fsyncing, closing, renaming, and cleaning those three files.

“The 16 registered crash cuts are persistence-level boundaries around opening, writing, fsyncing, closing, renaming, and cleaning those three files.”

May combine two claims.

Optional mutation metadata can preserve a non-authorizing audit correlation, but the reference authorization decision does not depend on a provenance field.

“Optional mutation metadata can preserve a non-authorizing audit correlation, but the reference authorization decision does not depend on a provenance field.”

Classified as probably not a substantial claim. May combine two claims.

The baseline layer implements four deliberately minimal stated guarantees and labels each result as a logical abstraction rather than execution of an authors' artifact.

“The baseline layer implements four deliberately minimal stated guarantees and labels each result as a logical abstraction rather than execution of an authors' artifact:”

Classified as probably not a substantial claim. May combine two claims.

Table 4 lists the common contract facts established by the adapter-to-ledger path; generation freshness is assigned inside the ledger rather than supplied by either adapter.

“Table 4 lists the common contract facts established by the adapter-to-ledger path; generation freshness is assigned inside the ledger rather than supplied by either adapter.”

Probably not a substantial claim: may not pass S4 (based).

The registered corpus changes six security-relevant surfaces: code, model route, Skill/dependency closure, memory policy, policy compiler, and enforcement configuration.

“The registered corpus changes six security-relevant surfaces: code, model route, Skill/dependency closure, memory policy, policy compiler, and enforcement configuration.”

Classified as probably not a substantial claim.

The external layer freezes two public self-modifying or self-evolving runtime versions.

“The external layer freezes two public self-modifying or self-evolving runtime versions.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Its manifest maps 176 inherited files: 162 changed content, 14 retained identical content, and no mapping miss.

“Its manifest maps 176 inherited files: 162 changed content, 14 retained identical content, and no mapping miss.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

A broader editor/bash compatibility run is 21/22 on both bodies; the same interactive-shell startup diagnostic causes the single failure and is not a certification predicate.

“A broader editor/bash compatibility run is 21/22 on both bodies; the same interactive-shell startup diagnostic causes the single failure and is not a certification predicate.”

May combine two claims.

Durable handoff cuts recovered the complete pre-commit state in 12 process terminations and the complete post-commit state in 4.

“12 recovered the complete pre-commit state and 4 the complete post-commit state”

May combine two claims.

Command-surface mappings matched in 64 of 64 replays, with 28 allows, 36 denies, and zero cross-mapping disagreement.

“64/64 matched; 28 allows, 36 denies; zero cross-mapping disagreement”

Classified as probably not a substantial claim.

Each of the 32 logical cases was executed once through the direct-call mapping and once through the mailbox mapping.

“Each of the 32 logical cases was executed once through the direct-call mapping and once through the mailbox mapping.”

Probably not a substantial claim: may not pass S4 (based).

Every non-root successor has one authorization parent.

“Every non-root successor has one authorization parent.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Fork atomically partitions one predecessor's residual and fences that predecessor.

“Fork atomically partitions one predecessor's residual and fences that predecessor.”

Classified as probably not a substantial claim.

Exactly eight fields are bound: codeDigest, controlPath, enforcementConfigDigest, memoryPolicyDigest, modelRouteDigest, policyCompilerDigest, proposerId, and skillClosureDigest.

“Exactly eight fields are bound: codeDigest , controlPath , enforcementConfigDigest , memoryPolicyDigest ,”

• Also stated in: § 8.2 Controlled baseline separation · p. 27 · plain

  “modelRouteDigest , policyCompilerDigest , proposerId , and skillClosureDigest .”

May combine two claims.

Both external adapters obtain 32/32, with 14 allows and 18 denies each.

“Both obtain 32/32, with 14 allows and 18 denies each.”

May combine two claims.

Both mappings produced 14 allows and 18 denies, for 28 allows and 36 denies across 64 replays, with no verdict or effect-disposition disagreement.

“Both mappings therefore produced 14 allows and 18 denies, for 28 allows and 36 denies across 64 replays, with no verdict or effect-disposition disagreement.”

May combine two claims.

The external tampering source contributes zero corpus records and no empirical denominator.

“Accordingly, it contributes zero corpus records and no empirical denominator.”

Classified as probably not a substantial claim.

The formal core retains single-parent authorization lineage while abstracting over the identity closure, authority algebra, and authenticated-record predicate.

“The formal core retains single-parent authorization lineage while abstracting over the identity closure, authority algebra, and authenticated-record predicate.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A fresh Python process reopened that descendant and discovered 753 inherited tests, with 5 skips and no failure or error.

“A fresh Python process reopened that descendant and discovered 753 inherited tests, with 5 skips and no failure or error.”

May combine two claims.

The independently implemented checker accepted all 64 original traces and rejected all 28 registered outer-resealed semantic mutants.

“The independently implemented checker accepted all 64 original traces and rejected all 28 registered outer-resealed semantic mutants.”

May combine two claims.

The per-generation ceiling misses sibling copying and two inherited-lineage violations.

“The per-generation ceiling misses sibling copying and two inherited-lineage violations.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The upstream editor suite passes 10/10 on both parent and descendant.

“The upstream editor suite passes 10/10 on both parent and descendant.”

May combine two claims.

Exact-hash all-deny gets the 18 deny cases right while rejecting every benign successor.

“Exact-hash all-deny gets the 18 deny cases right while rejecting every benign successor.”

May combine two claims.

Session continuity preserves every registered benign case but also accepts all 18 registered violations.

“Session continuity preserves every registered benign case but also accepts all 18 registered violations.”

Classified as probably not a substantial claim.

Ledger-issued, digest-bound grants, certification records, reservations, events, and receipts are checked against a frozen declared-control-root registry.

“tokens Ledger-issued, digest-bound grants, certification records, reservations, events, and receipts are checked against a frozen declared-control-root registry.”

May combine two claims.

The official gate creates an ephemeral descendant; a second, retained descendant binds the same parent-at-birth and is used for restart and handoff.

“The official gate creates an ephemeral descendant; a second, retained descendant binds the same parent-at-birth and is used for restart and handoff.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The bounded reference implementation represents every missing, conflicting, or unsupported fact as a typed rejection code; it does not expose a separate Indeterminate transport state or a reservation-expiry scheduler.

“The bounded reference implementation represents every missing, conflicting, or unsupported fact as a typed rejection code; it does not expose a separate Indeterminate transport state or a reservation-expiry scheduler.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The research abstraction requires no customer data, tenant configuration, production topology, credentials, proprietary policy corpus, or company-internal deployment detail.

“It requires no customer data, tenant configuration, production topology, credentials, proprietary policy corpus, or company-internal deployment detail.”

May combine two claims.

Removing an active residual leaves c_r(S) unchanged and can only decrease the aggregated components of both (5) and (6).

“Removing an active residual leaves 𝑐 𝑟 ( 𝑆 ) unchanged and can only decrease the aggregated components of both (5) and (6).”

Probably not a substantial claim: may not pass S4 (based).

The operation ⊕ is monotone in each argument under ⊑.

“It is monotone in each argument under ⊑ .”

Probably not a substantial claim: may not pass S3 (load-bearing).

Executable artifacts, adapters, checker traces, temporary files, source caches, and non-manuscript research materials remain outside the public preprint source archive.

“Executable artifacts, adapters, checker traces, temporary files, source caches, and non-manuscript research materials remain outside that archive.”

May combine two claims.

A fresh debit δ increases c_r(S) and decreases the admitting generation's b_g(S) by the same δ, so the root-lifetime sum is invariant while current population exposure decreases.

“A fresh debit 𝛿 increases 𝑐 𝑟 ( 𝑆 ) and decreases the admitting generation's 𝑏 𝑔 ( 𝑆 ) by the same 𝛿 , so the root-lifetime sum is invariant while current population exposure decreases.”

May combine two claims.

The reference ledger and two logical mappings realize the registered transitions, and a separately implemented checker detects the registered semantic violations after the enclosing integrity records are consistently resealed.

“It establishes that the reference ledger and two logical mappings realize the registered transitions and that a separately implemented checker detects the registered semantic violations after the enclosing integrity records are consistently resealed.”

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

Separate OurArk and Darwin Gödel Machine adapters exercise frozen public source-native descent or edit, fresh-process restart, atomic handoff, predecessor rejection, and all 32 registered decisions without treating replay count as evolution count.

“Separate OurArk and Darwin Gödel Machine adapters further exercise frozen public source-native descent or edit, fresh-process restart, atomic handoff, predecessor rejection, and all 32 registered decisions without treating replay count as evolution count.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The operation ⊕ is associative and commutative.

“The operation ⊕ of (4) is associative and commutative: qualitative components use the finite join, while budget and exposure components use vector addition.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The research abstraction contains generation identities, typed effects, allocations, root epochs, generation sequences, cuts, and receipts.

“The research abstraction contains generation identities, typed effects, allocations, root epochs, generation sequences, cuts, and receipts.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

A10 applies only to a protected-effect request: an exact retry returns its existing receipt and creates no second admission, effect, or debit.

“A10 applies only to a protected-effect request: an exact retry returns its existing receipt and creates no second admission, effect, or debit.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

Probably not a substantial claim: may not pass S3 (load-bearing).

Public-source attribution identifies each upstream repository and immutable version without embedding local workspace paths.

“Public-source attribution identifies each upstream repository and immutable version without embedding local workspace paths.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The public preprint source archive contains the reviewed LaTeX sources, bibliography, and only assets required to compile the paper.

“It contains the reviewed L A T E X sources, bibliography, and only assets required to compile the paper.”

Probably not a substantial claim: may not pass S2 (checkable).

The registered executable evaluation makes the separating executions concrete across two logical runtime mappings, durable fault cuts, interleavings, and independently checked semantic mutations.

“The registered executable evaluation makes the separating executions concrete across two logical runtime mappings, durable fault cuts, interleavings, and independently checked semantic mutations.”

Classified as probably not a substantial claim.

The executable evidence instantiates the arguments only for the fixed eight-field manifest, trusted controlroot registry and digest records, single-parent succession, atomic single-predecessor fork, cut set, disjoint effect labels, and integer budgets.

“The executable evidence instantiates them only for the fixed eight-field manifest, trusted controlroot registry and digest records, single-parent succession, atomic single-predecessor fork, cut set, disjoint effect labels, and integer budgets.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Executable cases, independent trace checking, consistently resealed semantic regressions, logical-adapter replay, crash cuts, contender orders, and public-source runtime mapping remain distinct evidence obligations reported from frozen result records.

“Executable cases, independent trace checking, consistently resealed semantic regressions, logical-adapter replay, crash cuts, contender orders, and public-source runtime mapping remain distinct evidence obligations reported from frozen result records.”

Classified as probably not a substantial claim.

Equation (11) binds the family authorization object to the current predecessor, child identifier, evidence, allocation, and residual state.

“Equation (11) binds the family authorization object to the current predecessor, child identifier, evidence, allocation, and residual state.”

May combine two claims.

By (8) and A7, at least one required certifier control root differs from the proposer control root, and the candidate cannot modify the frozen registry or remove that slot.

“By (8) and A7, at least one required certifier control root differs from the proposer control root, and the candidate cannot modify the frozen registry or remove that slot.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

Classified as probably not a substantial claim.

For independent re-root, Definition 3 requires both a fresh authenticated external root grant and accepted independent evidence, with the registered issuer and evidence control roots outside the proposer control root.

“For independent re-root, Definition 3 instead requires both a fresh authenticated external root grant and accepted independent evidence, with the registered issuer and evidence control roots outside the proposer control root.”

Probably not a substantial claim: may not pass S4 (based).

A6 admits the predecessor state to only one serialized consuming family transition.

“A6 admits that predecessor state to only one serialized consuming family transition.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

May combine two claims.

I4 prevents reuse of a consumed reservation or authorization identifier, while A3 prevents restoring the external ledger to an earlier state.

“I4 prevents reuse of a consumed reservation or authorization identifier, while A3 prevents restoring the external ledger to an earlier state.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

May combine two claims.

A4 prevents an omitted authorization parent, while the fresh root grant, root epoch, sequence, allocation, evidence record, and lineage set contain no old authority atom.

“A4 prevents an omitted authorization parent, while the fresh root grant, root epoch, sequence, allocation, evidence record, and lineage set contain no old authority atom.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

Classified as probably not a substantial claim. May combine two claims.

A7 validates the independent evidence root, A8 binds the fresh allocation, and A9 rejects cut atoms.

“A7 validates the independent evidence root, A8 binds the fresh allocation, and A9 rejects cut atoms.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

May combine two claims.

By A4 and (1), every ordinary descendant contains the transitive unique-parent closure; inserting an intermediate generation cannot remove an ancestor atom.

“By A4 and (1), every ordinary descendant contains the transitive unique-parent closure; inserting an intermediate generation cannot remove an ancestor atom.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Per-atom epoch vectors, general profile digests, publickey signatures, arbitrary authority relations, and multi-parent merge are not inferred from those runs.

“Per-atom epoch vectors, general profile digests, publickey signatures, arbitrary authority relations, and multi-parent merge are not inferred from those runs.”

Classified as probably not a substantial claim. May combine two claims.

An independent re-root has a new external authority cause and no old authorization-parent atom.

“Definition 3 explains the stated exception: an independent re-root has a new external authority cause and no old authorization-parent atom.”

May combine two claims.

An exact retry after c may return the receipt of an effect admitted before c, but A10 creates no new admission, effect, or debit.

“An exact retry after 𝑐 may return the receipt of an effect admitted before 𝑐 , but A10 creates no new admission, effect, or debit and therefore does not contradict the result.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

May combine two claims.

An exact retry may return that old receipt after the handoff, but it is non-consuming and is not a second post-handoff admission under A10.

“An exact retry may return that old receipt after the handoff, but it is non-consuming and is not a second post-handoff admission under A10.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

Classified as probably not a substantial claim. May combine two claims.

Definition 3 gives par(g') = ⊥ under the new root and records reused artifacts only as provenance.

“Definition 3 gives par ( 𝑔 ′ ) = ⊥ under the new root and records reused artifacts only as provenance.”

Classified as probably not a substantial claim. May combine two claims.

Lemma 5 establishes the unique current-root switch and exact new-root post-state.

“Lemma 5 establishes the unique current-root switch and exact new-root post-state.”

May combine two claims.

Before λ_h, every staged child is non-active and every inline fork child lacks an active record; Lemma 2 and A1 exclude their production effects.

“Before 𝜆 ℎ , every staged child is non-active and every inline fork child lacks an active record; Lemma 2 and A1 exclude their production effects.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

May combine two claims.

Candidate construction, quarantine execution, evidence recording, and a held singleton reservation do not add a member to AD_S(r) and cannot commit a protected effect.

“Candidate construction, quarantine execution, evidence recording, and a held singleton reservation do not add a member to AD 𝑆 ( 𝑟 ) and cannot commit a protected effect.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

May combine two claims.

For an accepted fork from p to N, the family commit fences p at the same position that activates N, and A3 prevents p's residual from becoming active again.

“The family commit fences 𝑝 at the same position that activates 𝑁 , and A3 prevents 𝑝 's residual from becoming active again.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

Classified as probably not a substantial claim.

Expanding Safe_r by Definition 2 yields both classes of conjuncts in (13).

“Expanding Safe 𝑟 by Definition 2 yields both classes of conjuncts in (13).”

May combine two claims.

After λ_h, I7 prevents p's reactivation, and A1 rejects its fresh effect admission.

“After 𝜆 ℎ , I7 prevents 𝑝 's reactivation, and A1 rejects its fresh effect admission.”

• AssumptionThe authors state this as an assumption: The cryptographic and systems facts A1-A10 hold.

May combine two claims.

The paper establishes authority conservation and revocation for the declared generation graph, root grants, and persistent population ceiling.

“It establishes authority conservation and revocation for the declared generation graph, root grants, and persistent population ceiling.”

May combine two claims.

These results establish authorization succession over registered protected effects, not arbitrary program equivalence or unmediated behavior.

“These results establish authorization succession over registered protected effects, not arbitrary program equivalence or unmediated behavior.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Per-successor authorization does not constrain the population; siblings can duplicate quotas, combine complementary permissions, survive ancestor cuts, or overlap predecessors during promotion.

“Per-successor authorization does not constrain the population: siblings can duplicate quotas, combine complementary permissions, survive ancestor cuts, or overlap predecessors during promotion.”

Probably not a substantial claim: may not pass S4 (based).

The protected property is operation-time authorization at registered effect brokers.

“The protected property is operation-time authorization at registered effect brokers.”

Classified as probably not a substantial claim. May combine two claims.

A root grant bounds lifetime authority, including irreversible debit, while a persistent population ceiling independently bounds current relational effect authority, additive budgets, and live-executor shares.

“A root grant bounds lifetime authority, including irreversible debit, while a persistent population ceiling independently bounds current relational effect authority, additive budgets, and live-executor shares.”

May combine two claims.

The paper proves conditional population-safe succession, fork conservation, cross-generation revocation closure, atomic generation handoff, rollback non-reminting, and exclusion of self-certification.

“It proves conditional population-safe succession, fork conservation, cross-generation revocation closure, atomic generation handoff, rollback non-reminting, and exclusion of self-certification.”

• AssumptionThe authors state this as an assumption: Every security-relevant commitment named by the profile crosses a broker that validates the current generation, complete lineage-atom closure, allocation, and complete effect tuple at its own linearization point.
• AssumptionThe authors state this as an assumption: Generation identities, the unique authorization parent, body/configuration commitments, authorization and certification records, cuts, allocations, receipts, and evidence-root identities use unambiguous canonical encodings and authenticators whose acceptance cannot be produced from the candidate's control.
• AssumptionThe authors state this as an assumption: Generation and root epochs never decrease or reactivate; accepted evidence/authorization records, lineage cuts, fences, root-lifetime debit records, and effect-request replay records cannot be rewritten.
• AssumptionThe authors state this as an assumption: Every non-root generation has exactly one registered authorization parent before activation; a fork may create several successors atomically, but each successor names the same single predecessor; the predecessor is fenced; the ledger retains every resulting parent edge and lineage atom across offline, delayed, and nested.
• AssumptionThe authors state this as an assumption: Effect normalization preserves every policy-relevant correlation; the registered effect-membership predicate and authority join are monotone, multiplicity-aware where policy requires it, additive for consumable resources, and conservative for.
• AssumptionThe authors state this as an assumption: Reservation, allocation replacement, activation, predecessor fencing, and budget consumption execute as serializable durable transitions with exact population-version and source-residual preconditions. A held reservation either.
• AssumptionThe authors state this as an assumption: Each promotion profile names required predicates and independent control-root classes; aliases, descendants, cloned processes, and principals governed by the candidate's control root cannot satisfy independent slots.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Semantic equivalence of arbitrary programs, correctness of an evaluator's substantive judgment, effects outside the registered mediation boundary, and reversal of already committed physical outcomes are distinct properties with distinct evidence requirements.

“Semantic equivalence of arbitrary programs, correctness of an evaluator's substantive judgment, effects outside the registered mediation boundary, and reversal of already committed physical outcomes are distinct properties with distinct evidence requirements.”

Probably not a substantial claim: may not pass S4 (based).

Promotion separately requires evidence-root independence.

“Promotion separately requires evidence-root independence.”

May combine two claims.

With complete mediation, authenticated records, sound effect abstraction, durable monotone state, and complete lineage accounting, the paper proves population-safe succession, fork conservation, revocation closure, atomic handoff, rollback non-reminting, and exclusion of self-certification.

“With complete mediation, authenticated records, sound effect abstraction, durable monotone state, and complete lineage accounting, we prove population-safe succession, fork conservation, revocation closure, atomic handoff, rollback non-reminting, and exclusion of self-certification.”

• AssumptionThe authors state this as an assumption: Every security-relevant commitment named by the profile crosses a broker that validates the current generation, complete lineage-atom closure, allocation, and complete effect tuple at its own linearization point.
• AssumptionThe authors state this as an assumption: Generation identities, the unique authorization parent, body/configuration commitments, authorization and certification records, cuts, allocations, receipts, and evidence-root identities use unambiguous canonical encodings and authenticators whose acceptance cannot be produced from the candidate's control.
• AssumptionThe authors state this as an assumption: Generation and root epochs never decrease or reactivate; accepted evidence/authorization records, lineage cuts, fences, root-lifetime debit records, and effect-request replay records cannot be rewritten.
• AssumptionThe authors state this as an assumption: Every non-root generation has exactly one registered authorization parent before activation; a fork may create several successors atomically, but each successor names the same single predecessor; the predecessor is fenced; the ledger retains every resulting parent edge and lineage atom across offline, delayed, and nested.
• AssumptionThe authors state this as an assumption: Effect normalization preserves every policy-relevant correlation; the registered effect-membership predicate and authority join are monotone, multiplicity-aware where policy requires it, additive for consumable resources, and conservative for.
• AssumptionThe authors state this as an assumption: Reservation, allocation replacement, activation, predecessor fencing, and budget consumption execute as serializable durable transitions with exact population-version and source-residual preconditions. A held reservation either.
• AssumptionThe authors state this as an assumption: Each promotion profile names required predicates and independent control-root classes; aliases, descendants, cloned processes, and principals governed by the candidate's control root cannot satisfy independent slots.

May combine two claims.

None of the existing adjacent controls alone specifies how an authenticated software-generation lifetime is atomically replaced, how its population allocation is joined to a lineage cut and independent re-root, or whether a returned historical body has replayed that generation's retired grant.

“None of these facts alone specifies how an authenticated software-generation lifetime is atomically replaced, how its population allocation is joined to a lineage cut and independent re-root, or whether a returned historical body has replayed that generation's retired grant.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Siblings may coordinate or feed a common downstream action, but such coordination does not create an authorization parent edge or union their grants.

“Siblings may later coordinate or feed a common downstream action, but such coordination does not create an authorization parent edge or union their grants.”

May combine two claims.

Equal content does not imply equal generation identity, and a fresh re-root cannot collide with an old authorization lifetime.

“Thus equal content does not imply equal generation identity, and a fresh re-root cannot collide with an old authorization lifetime.”

May combine two claims.

Every child independently names the same predecessor as its unique authorization parent, and the predecessor never remains active after a successful fork.

“Every child independently names that same predecessor as its unique authorization parent; the predecessor never remains active after a successful fork.”

Classified as probably not a substantial claim. May combine two claims.

The executable reference profile fixes its schema in the implementation and binds six manifest digests plus the external-control path and proposer identity; it implements single-parent succession, single-predecessor fork, rollback, cuts, and independent re-root, but no multi-parent merge.

“The executable reference profile instead fixes its schema in the implementation and binds six manifest digests plus the external-control path and proposer identity; it implements single-parent succession, single-predecessor fork, rollback, cuts, and independent re-root, but no multi-parent merge.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

A historical body commitment may seed a new successor, but the successor receives a fresh population-issued generation sequence and a new authorization decision.

“Ahistorical body commitment may seed a new successor, but the successor receives a fresh population-issued generation sequence and a new authorization decision.”

May combine two claims.

For an accepted family handoff at λ_h, a child in N has no production authority before λ_h, and predecessor p has no production authority after λ_h; every concurrent fresh protected-effect admission is ordered on exactly one side of λ_h; hence no accepted prefix contains both p's pre-transfer allocation and a child's transferred allocation as simultaneously exercisable authority.

“For an accepted family handoff at 𝜆 ℎ , a child in 𝑁 has no production authority before 𝜆 ℎ , and predecessor 𝑝 has no production authority after 𝜆 ℎ . Every concurrent fresh protected-effect admission is ordered on exactly one side of 𝜆 ℎ . Hence no accepted prefix contains both 𝑝 's pre-transfer allocation and a child's transferred allocation as simultaneously exercisable authority.”

• AssumptionThe authors state this as an assumption: Complete effect mediation.
• AssumptionThe authors state this as an assumption: Authentic canonical identity.
• AssumptionThe authors state this as an assumption: Durable monotone generations.
• AssumptionThe authors state this as an assumption: Complete lineage accounting.
• AssumptionThe authors state this as an assumption: Sound population algebra.
• AssumptionThe authors state this as an assumption: Atomic population transactions.
• AssumptionThe authors state this as an assumption: Evidence-root independence.
• AssumptionThe authors state this as an assumption: Transfer non-amplification: an accepted authorization record binds one exact predecessor, one successor or atomic successor set, the predecessor's reconstructed residual, successor grants, population state, manifest commitments, evidence records, and consumed identifiers; the ledger accepts only when the exact post-state remains below the applicable bound.
• AssumptionThe authors state this as an assumption: Complete revocation fencing: an ancestor cut is checked on activation, succession, fork, re-root, rollback, and every protected effect; cached child records cannot override a monotone lineage cut.
• AssumptionThe authors state this as an assumption: Effect-request idempotency: for protected-effect requests only, an exact retry under the same request identity returns the previously committed effect receipt without another debit; the same identity with a different canonical effect request is rejected; no exact-retry guarantee is assumed for proposal, certification, reservation, succession, fork, cut, re-root, or administrative commands.

Classified as probably not a substantial claim. May combine two claims.

The model separates content identity, authorization lineage, and artifact provenance: reusing bytes does not reuse authority, and copying a predecessor does not copy its allocation.

“The model separates content identity, authorization lineage, and artifact provenance: reusing bytes does not reuse authority, and copying a predecessor does not copy its allocation.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Unknown identity fields, incomplete lineage, missing evidence, unavailable current allocation state, and conflicting records yield Indeterminate or remain Quarantined; they never become Allow through timeout.

“Unknown identity fields, incomplete lineage, missing evidence, unavailable current allocation state, and conflicting records yield Indeterminate or remain Quarantined ; they never become Allow through timeout.”

May combine two claims.

An intermediate generation cannot launder authority by allocating to children and then disappearing: each fork consumes one current predecessor residual exactly once, fences that predecessor, preserves all past debits, and introduces only a bounded child composition.

“An intermediate generation cannot launder authority by allocating to children and then disappearing: each fork consumes one current predecessor residual exactly once, fences that predecessor, preserves all past debits, and introduces only a bounded child composition.”

Classified as probably not a substantial claim. The quote only partly states this claim.

The separating executions yield seven requirements for a population-safe mechanism.

“The separating executions yield seven requirements.”

Classified as probably not a substantial claim. May combine two claims.

The theory is parameterized by a registered identity profile, authority algebra, and authenticated record predicates; those parameters support a general assurance statement and are not claims that the executable artifact implements every possible profile.

“The theory is parameterized by a registered identity profile, authority algebra, and authenticatedrecord predicates. Those parameters support a general assurance statement; they are not claims that the executable artifact implements every possible profile.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Partitioning fork fences one active predecessor while two or more single-parent children are activated atomically; their additive allocations are bounded by the predecessor's unspent residual, and a registered single-holder effect atom may be assigned to at most one child.

“One active predecessor is fenced while two or more single-parent children are activated atomically. Their additive allocations are bounded by the predecessor's unspent residual, and a registered single-holder effect atom may be assigned to at most one child.”

Classified as probably not a substantial claim. May combine two claims.

An attempt that fails any check may be logged but does not commit a protected effect; exact-result replay is specified only for effect requests, and other command classes rely on phase, uniqueness, version, and monotonicity guards and receive no A10 retry guarantee.

“An attempt that fails any check may be logged, but it does not commit a protected effect. Exactresult replay is specified only for effect requests; other command classes rely on phase, uniqueness, version, and monotonicity guards and receive no A10 retry guarantee.”

• AssumptionThe authors state this as an assumption: Effect-request idempotency: for protected-effect requests only, an exact retry under the same request identity returns the previously committed effect receipt without another debit; the same identity with a different canonical effect request is rejected; no exact-retry guarantee is assumed for proposal, certification, reservation, succession, fork, cut, re-root, or administrative commands.

May combine two claims.

If rollback generation g_rb has the same manifest digest as historical generation a, then gid(g_rb) ≠ gid(a); it cannot use a's evidence record, authorization object, reservation, activation record, or cut lineage; any authority obtained by g_rb comes from its fresh accepted handoff and is counted by (13).

“If rollback generation 𝑔 𝑟𝑏 has the same manifest digest as historical generation 𝑎 , then gid ( 𝑔 𝑟𝑏 ) ≠ gid ( 𝑎 ) . It cannot use 𝑎 's evidence record, authorization object, reservation, activation record, or cut lineage. Any authority obtained by 𝑔 𝑟𝑏 comes from its fresh accepted handoff and is counted by (13) .”

• AssumptionThe authors state this as an assumption: Complete effect mediation.
• AssumptionThe authors state this as an assumption: Authentic canonical identity.
• AssumptionThe authors state this as an assumption: Durable monotone generations.
• AssumptionThe authors state this as an assumption: Complete lineage accounting.
• AssumptionThe authors state this as an assumption: Sound population algebra.
• AssumptionThe authors state this as an assumption: Atomic population transactions.
• AssumptionThe authors state this as an assumption: Evidence-root independence.
• AssumptionThe authors state this as an assumption: Transfer non-amplification: an accepted authorization record binds one exact predecessor, one successor or atomic successor set, the predecessor's reconstructed residual, successor grants, population state, manifest commitments, evidence records, and consumed identifiers; the ledger accepts only when the exact post-state remains below the applicable bound.
• AssumptionThe authors state this as an assumption: Complete revocation fencing: an ancestor cut is checked on activation, succession, fork, re-root, rollback, and every protected effect; cached child records cannot override a monotone lineage cut.
• AssumptionThe authors state this as an assumption: Effect-request idempotency: for protected-effect requests only, an exact retry under the same request identity returns the previously committed effect receipt without another debit; the same identity with a different canonical effect request is rejected; no exact-retry guarantee is assumed for proposal, certification, reservation, succession, fork, cut, re-root, or administrative commands.

May combine two claims.

No retained-predecessor allocation and no fresh issuance participate in either core transition; the predecessor is fenced at commit.

“No retained-predecessor allocation and no fresh issuance participate in either core transition: 𝑝 is fenced at commit.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Figure 1 separates candidate production from authority control; mutable runtimes may produce any number of candidates; the identity builder commits every security-relevant field and the evidence layer evaluates registered predicates; neither component can activate a candidate; only the population ledger can accept the applicable authorization object and atomically change the active frontier; every

“Figure 1 separates candidate production from authority control. Mutable runtimes may produce any number of candidates. The identity builder commits every security-relevant field and the evidence layer evaluates registered predicates. Neither component can activate a candidate. Only the population ledger can accept the applicable authorization object and atomically change the active frontier. Every”

May combine two claims.

Revoking an ancestor inserts its atom into the population's monotone cut set and marks nonterminal affected generations and held reservations revoked; already terminal generations remain terminal.

“Revoking an ancestor inserts its atom into the population's monotone cut set and marks nonterminal affected generations and held reservations revoked; already terminal generations remain terminal.”

May combine two claims.

A crash before commit leaves the predecessor unchanged and any staged candidate non-active; a crash after commit recovers the complete post-state.

“A crash before commit leaves the predecessor unchanged and any staged candidate non-active; a crash after commit recovers the complete post-state.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

A separately recorded source may name copied code, checkpoints, or artifacts; it is provenance only and never an authorization parent.

“A separately recorded source ( 𝑔 ) may name copied code, checkpoints, or artifacts; it is provenance only and never an authorization parent.”

May combine two claims.

An ancestor cut RevokeAncestor(p, a) atomically inserts a into the monotone set Cut_S(p); the ledger projection moves every nonterminal affected generation and held reservation to REVOKED, while already terminal generations remain terminal; safety does not require finding or stopping every descendant process because a fresh effect or population-changing request from any such process fails the the

“An ancestor cut RevokeAncestor ( 𝑝, 𝑎 ) atomically inserts 𝑎 into the monotone set Cut 𝑆 ( 𝑝 ) . The ledger projection moves every nonterminal affected generation and held reservation to REVOKED ; already terminal generations remain terminal. Safety does not require finding or stopping every descendant process: a fresh effect or population-changing request from any such process fails the current”

May combine two claims.

An accepted independent re-root of g' has no authorization path to the old root, imports no old-root allocation, and attributes every later admitted effect solely to its fresh root; removing or renaming old lineage fields without the external root-grant transition cannot establish these facts.

“An accepted independent re-root of 𝑔 ′ has no authorization path to the old root, imports no old-root allocation, and attributes every later admitted effect solely to its fresh root. Removing or renaming old lineage fields without the external root-grant transition cannot establish these facts.”

• AssumptionThe authors state this as an assumption: Complete effect mediation.
• AssumptionThe authors state this as an assumption: Authentic canonical identity.
• AssumptionThe authors state this as an assumption: Durable monotone generations.
• AssumptionThe authors state this as an assumption: Complete lineage accounting.
• AssumptionThe authors state this as an assumption: Sound population algebra.
• AssumptionThe authors state this as an assumption: Atomic population transactions.
• AssumptionThe authors state this as an assumption: Evidence-root independence.
• AssumptionThe authors state this as an assumption: Transfer non-amplification: an accepted authorization record binds one exact predecessor, one successor or atomic successor set, the predecessor's reconstructed residual, successor grants, population state, manifest commitments, evidence records, and consumed identifiers; the ledger accepts only when the exact post-state remains below the applicable bound.
• AssumptionThe authors state this as an assumption: Complete revocation fencing: an ancestor cut is checked on activation, succession, fork, re-root, rollback, and every protected effect; cached child records cannot override a monotone lineage cut.
• AssumptionThe authors state this as an assumption: Effect-request idempotency: for protected-effect requests only, an exact retry under the same request identity returns the previously committed effect receipt without another debit; the same identity with a different canonical effect request is rejected; no exact-retry guarantee is assumed for proposal, certification, reservation, succession, fork, cut, re-root, or administrative commands.

Classified as probably not a substantial claim. May combine two claims.

Replacement commits one active predecessor fenced and one successor activated in a single durable commit, so no protected-effect check can observe both the old and new allocation as active.

“One active predecessor is fenced and one successor is activated in a single durable commit. No protected-effect check can observe both the old and new allocation as active.”

Classified as probably not a substantial claim. May combine two claims.

The model does not infer arbitrary program equivalence, discover unmanifested effect paths, or establish the truth of a certifier's observations merely because an authenticated record was accepted.

“The model likewise does not infer arbitrary program equivalence, discover unmanifested effect paths, or establish the truth of a certifier's observations merely because an authenticated record was accepted.”

May combine two claims.

No trace consisting only of records originating in or controlled by a non-bootstrap candidate generation g can move g to ACTIVE; every accepted candidate activation contains an accepted evidence record from at least one profile-required control root independent of the candidate proposer, plus an authenticated authorization decision of the external lineage authority.

“No trace consisting only of records originating in or controlled by a non-bootstrap candidate generation 𝑔 can move 𝑔 to ACTIVE . Every accepted candidate activation contains an accepted evidence record from at least one profile-required control root independent of the candidate proposer, plus an authenticated authorization decision of the external lineage authority.”

• AssumptionThe authors state this as an assumption: Complete effect mediation.
• AssumptionThe authors state this as an assumption: Authentic canonical identity.
• AssumptionThe authors state this as an assumption: Durable monotone generations.
• AssumptionThe authors state this as an assumption: Complete lineage accounting.
• AssumptionThe authors state this as an assumption: Sound population algebra.
• AssumptionThe authors state this as an assumption: Atomic population transactions.
• AssumptionThe authors state this as an assumption: Evidence-root independence.
• AssumptionThe authors state this as an assumption: Transfer non-amplification: an accepted authorization record binds one exact predecessor, one successor or atomic successor set, the predecessor's reconstructed residual, successor grants, population state, manifest commitments, evidence records, and consumed identifiers; the ledger accepts only when the exact post-state remains below the applicable bound.
• AssumptionThe authors state this as an assumption: Complete revocation fencing: an ancestor cut is checked on activation, succession, fork, re-root, rollback, and every protected effect; cached child records cannot override a monotone lineage cut.
• AssumptionThe authors state this as an assumption: Effect-request idempotency: for protected-effect requests only, an exact retry under the same request identity returns the previously committed effect receipt without another debit; the same identity with a different canonical effect request is rejected; no exact-retry guarantee is assumed for proposal, certification, reservation, succession, fork, cut, re-root, or administrative commands.

Probably not a substantial claim: may not pass S4 (based).

Additive budgets are partitioned so their componentwise sum does not exceed the predecessor's reconstructed residual.

“Additive budgets are partitioned so their componentwise sum does not exceed the predecessor's reconstructed residual.”

Classified as probably not a substantial claim. May combine two claims.

The broker serializes its admission against all population transitions and reads the current ledger version and state.

“The broker serializes its admission against all population transitions and reads the current ledger version and state.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

A process whose record is fenced, revoked, or bound to a cut atom is not a member and cannot pass fresh effect admission under A1 and A9.

“A process whose record is fenced, revoked, or bound to a cut atom is not a member and cannot pass fresh effect admission under A1 and A9.”

• AssumptionThe authors state this as an assumption: Complete effect mediation.
• AssumptionThe authors state this as an assumption: Complete revocation fencing: an ancestor cut is checked on activation, succession, fork, re-root, rollback, and every protected effect; cached child records cannot override a monotone lineage cut.

Classified as probably not a substantial claim. May combine two claims.

The theorems establish authorization safety for the registered identity and effect boundary; the abstract parameters state the obligations for a conforming profile; the artifact evidence applies only to the fixed manifest, authority, authentication, and transition realization described; neither level claims semantic equivalence for arbitrary code or models.

“The theorems establish authorization safety for the registered identity and effect boundary. The abstract parameters above state the obligations for a conforming profile; the artifact evidence in Section 8 applies only to the fixed manifest, authority, authentication, and transition realization described here. Neither level claims semantic equivalence for arbitrary code or models.”

May combine two claims.

Checking candidates one at a time loses information; if two successors each pass the same ceiling check, a Boolean capability copied to both may increase parallel exercise, an additive budget may double, and two partial relational permissions may later be joined.

“Checking candidates one at a time loses information. If two successors each pass the same ceiling check, a Boolean capability copied to both may increase parallel exercise, an additive budget may double, and two partial relational permissions may later be joined.”

Classified as probably not a substantial claim.

A fork atomically replaces one predecessor with at least two children.

“A fork atomically replaces one predecessor with at least two children.”

Probably not a substantial claim: may not pass S4 (based).

Replacement promotion establishes that predecessor fencing and successor activation share one linearization point.

“Replacement promotion additionally establishes that predecessor fencing and successor activation share one linearization point.”

• AssumptionThe authors state this as an assumption: Every security-relevant commitment named by the profile crosses a broker that validates the current generation, complete lineage-atom closure, allocation, and complete effect tuple at its own linearization point.
• AssumptionThe authors state this as an assumption: Generation identities, the unique authorization parent, body/configuration commitments, authorization and certification records, cuts, allocations, receipts, and evidence-root identities use unambiguous canonical encodings and authenticators whose acceptance cannot be produced from the candidate's control.
• AssumptionThe authors state this as an assumption: Generation and root epochs never decrease or reactivate; accepted evidence/authorization records, lineage cuts, fences, root-lifetime debit records, and effect-request replay records cannot be rewritten.
• AssumptionThe authors state this as an assumption: Every non-root generation has exactly one registered authorization parent before activation; a fork may create several successors atomically, but each successor names the same single predecessor; the predecessor is fenced; the ledger retains every resulting parent edge and lineage atom across offline, delayed, and nested.
• AssumptionThe authors state this as an assumption: Effect normalization preserves every policy-relevant correlation; the registered effect-membership predicate and authority join are monotone, multiplicity-aware where policy requires it, additive for consumable resources, and conservative for.
• AssumptionThe authors state this as an assumption: Reservation, allocation replacement, activation, predecessor fencing, and budget consumption execute as serializable durable transitions with exact population-version and source-residual preconditions. A held reservation either.
• AssumptionThe authors state this as an assumption: Each promotion profile names required predicates and independent control-root classes; aliases, descendants, cloned processes, and principals governed by the candidate's control root cannot satisfy independent slots.

May combine two claims.

Every effect accepted at time t is attributed to exactly one current active generation with a complete authority witness; aggregate authority allocated to all active dependent descendants remains below both the root's lifetime grant and the population's persistent current-exposure ceiling; and no descendant can exercise an ancestor atom after its durable revocation cut.

“The protected statement is that every effect accepted at time 𝑡 is attributed to exactly one current active generation with a complete authority witness, that the aggregate authority allocated to all active dependent descendants remains below both 𝑟 's lifetime grant and the population's persistent current-exposure ceiling, and that no descendant can exercise an ancestor atom after its durable rev”

• AssumptionThe authors state this as an assumption: Every security-relevant commitment named by the profile crosses a broker that validates the current generation, complete lineage-atom closure, allocation, and complete effect tuple at its own linearization point.
• AssumptionThe authors state this as an assumption: Generation identities, the unique authorization parent, body/configuration commitments, authorization and certification records, cuts, allocations, receipts, and evidence-root identities use unambiguous canonical encodings and authenticators whose acceptance cannot be produced from the candidate's control.
• AssumptionThe authors state this as an assumption: Generation and root epochs never decrease or reactivate; accepted evidence/authorization records, lineage cuts, fences, root-lifetime debit records, and effect-request replay records cannot be rewritten.
• AssumptionThe authors state this as an assumption: Every non-root generation has exactly one registered authorization parent before activation; a fork may create several successors atomically, but each successor names the same single predecessor; the predecessor is fenced; the ledger retains every resulting parent edge and lineage atom across offline, delayed, and nested.
• AssumptionThe authors state this as an assumption: Effect normalization preserves every policy-relevant correlation; the registered effect-membership predicate and authority join are monotone, multiplicity-aware where policy requires it, additive for consumable resources, and conservative for.
• AssumptionThe authors state this as an assumption: Reservation, allocation replacement, activation, predecessor fencing, and budget consumption execute as serializable durable transitions with exact population-version and source-residual preconditions. A held reservation either.
• AssumptionThe authors state this as an assumption: Each promotion profile names required predicates and independent control-root classes; aliases, descendants, cloned processes, and principals governed by the candidate's control root cannot satisfy independent slots.

Classified as probably not a substantial claim. May combine two claims.

The staged single-successor path records a PROPOSED generation, attaches an independent certification record, moves it to RESERVED, and atomically changes it to ACTIVE while fencing its predecessor; quarantine describes where candidate code is evaluated and is not an authority-bearing ledger phase; the fork path instead evaluates a complete child family and, after inline validation, creates all

“The staged single-successor path records a PROPOSED generation, attaches an independent certification record, moves it to RESERVED , and atomically changes it to ACTIVE while fencing its predecessor. Quarantine describes where candidate code is evaluated; it is not an authority-bearing ledger phase. The fork path instead evaluates a complete child family and, after inline validation, creates all”

May combine two claims.

The same body can be installed twice, restored after revocation, or launched under two different roots.

“The same body can be installed twice, restored after revocation, or launched under two different roots.”

Classified as probably not a substantial claim. May combine two claims.

The staged singleton path records a proposed candidate, independent evidence, and a held reservation before activation; quarantine is an execution condition, not authority; the atomic fork path evaluates all children before the commit and creates their active generation records together; only ACTIVE authorizes a fresh protected effect.

“The staged singleton path records a proposed candidate, independent evidence, and a held reservation before activation. Quarantine is an execution condition, not authority. The atomic fork path evaluates all children before the commit and creates their active generation records together. In either path, only ACTIVE authorizes a fresh protected effect.”

Classified as probably not a substantial claim. May combine two claims.

If an effect request id already names the identical canonical effect request, the operation returns the original receipt without a new admission, effect, or debit, even if the generation has since been fenced; reuse of the id with a different canonical request is rejected; otherwise the request is fresh and accepted only if the generation is active, the normalized effect satisfies Permits_Q, and

“If 𝑖𝑑 already names the identical canonical effect request, the operation returns the original receipt without a new admission, effect, or debit; this remains a replay result even if 𝑔 has since been fenced. Reuse of 𝑖𝑑 with a different canonical request is rejected. Otherwise the request is fresh, and it is accepted only if 𝑔 ∈ AD 𝑆 ( 𝑟 ) , the exact normalized effect 𝑒 = abs ( 𝑜 ) satisfies Perm”

May combine two claims.

For an accepted atomic fork from predecessor p to children N, the composition of all child allocations is bounded by p's reconstructed pre-fork residual, p is fenced at the same commit position, and the residual can be consumed by that fork at most once; repeating this argument down a fork tree preserves the bound over current active leaf allocations descended from its originating allocation;

“Consider an accepted atomic fork from predecessor 𝑝 to children 𝑁 . The composition of all child allocations is bounded by 𝑝 's reconstructed pre-fork residual as in (10) , 𝑝 is fenced at the same commit position, and the residual can be consumed by that fork at most once. Repeating this argument down a fork tree preserves the bound over current active leaf allocations descended from its”

• AssumptionThe authors state this as an assumption: Complete effect mediation.
• AssumptionThe authors state this as an assumption: Authentic canonical identity.
• AssumptionThe authors state this as an assumption: Durable monotone generations.
• AssumptionThe authors state this as an assumption: Complete lineage accounting.
• AssumptionThe authors state this as an assumption: Sound population algebra.
• AssumptionThe authors state this as an assumption: Atomic population transactions.
• AssumptionThe authors state this as an assumption: Evidence-root independence.
• AssumptionThe authors state this as an assumption: Transfer non-amplification: an accepted authorization record binds one exact predecessor, one successor or atomic successor set, the predecessor's reconstructed residual, successor grants, population state, manifest commitments, evidence records, and consumed identifiers; the ledger accepts only when the exact post-state remains below the applicable bound.
• AssumptionThe authors state this as an assumption: Complete revocation fencing: an ancestor cut is checked on activation, succession, fork, re-root, rollback, and every protected effect; cached child records cannot override a monotone lineage cut.
• AssumptionThe authors state this as an assumption: Effect-request idempotency: for protected-effect requests only, an exact retry under the same request identity returns the previously committed effect receipt without another debit; the same identity with a different canonical effect request is rejected; no exact-retry guarantee is assumed for proposal, certification, reservation, succession, fork, cut, re-root, or administrative commands.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The protocol turns mutation acceptance into a durable population transition; it does not ask a mutable agent to remember its own limits; it places generation registration, allocation, succession, revocation, and protected effect admission behind an external ledger and broker.

“The protocol turns mutation acceptance into a durable population transition. The protocol does not ask a mutable agent to remember its own limits. It places generation registration, allocation, succession, revocation, and protected effect admission behind an external ledger and broker.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

A fork atomically creates siblings, each satisfying par(g)=p for the same unique predecessor p; the core transition system admits no multi-parent child and no merge rule.

“A fork atomically creates siblings 𝑁 , each satisfying par ( 𝑔 ) = 𝑝 for the same unique predecessor 𝑝 . The core transition system admits no multi-parent child and no merge rule.”

May combine two claims.

A fresh effect admission belongs either before the family commit and to the active predecessor allocation, or after it and to an active child allocation.

“A fresh effect admission belongs either before the family commit and to the active predecessor allocation, or after it and to an active child allocation.”

May combine two claims.

Let c = RevokeAncestor(p(r), a) insert a into Cut_S(p(r)); no fresh protected-effect admission ordered after c can be authorized by a generation whose complete lineage set contains a, including every nested dependent descendant; a generation under an independent re-root is outside the conclusion because its authority contains no old atom.

“Let 𝑐 = RevokeAncestor ( 𝑝 ( 𝑟 ) , 𝑎 ) insert 𝑎 into Cut 𝑆 ( 𝑝 ( 𝑟 )) . No fresh protected-effect admission ordered after 𝑐 can be authorized by a generation whose complete lineage set contains 𝑎 . This includes every nested dependent descendant. A generation under an independent re-root is outside the conclusion because its authority contains no old atom.”

• AssumptionThe authors state this as an assumption: Complete effect mediation.
• AssumptionThe authors state this as an assumption: Authentic canonical identity.
• AssumptionThe authors state this as an assumption: Durable monotone generations.
• AssumptionThe authors state this as an assumption: Complete lineage accounting.
• AssumptionThe authors state this as an assumption: Sound population algebra.
• AssumptionThe authors state this as an assumption: Atomic population transactions.
• AssumptionThe authors state this as an assumption: Evidence-root independence.
• AssumptionThe authors state this as an assumption: Transfer non-amplification: an accepted authorization record binds one exact predecessor, one successor or atomic successor set, the predecessor's reconstructed residual, successor grants, population state, manifest commitments, evidence records, and consumed identifiers; the ledger accepts only when the exact post-state remains below the applicable bound.
• AssumptionThe authors state this as an assumption: Complete revocation fencing: an ancestor cut is checked on activation, succession, fork, re-root, rollback, and every protected effect; cached child records cannot override a monotone lineage cut.
• AssumptionThe authors state this as an assumption: Effect-request idempotency: for protected-effect requests only, an exact retry under the same request identity returns the previously committed effect receipt without another debit; the same identity with a different canonical effect request is rejected; no exact-retry guarantee is assumed for proposal, certification, reservation, succession, fork, cut, re-root, or administrative commands.

May combine two claims.

An ancestor may be fenced by completed succession without invalidating an already-created descendant; inserting that ancestor's atom into Cut_S(p(r)) invalidates every dependent descendant because its complete closure contains the atom.

“An ancestor may be fenced by completed succession without invalidating an already-created descendant; inserting that ancestor's atom into Cut 𝑆 ( 𝑝 ( 𝑟 )) invalidates every dependent descendant because its complete closure contains the atom.”

Probably not a substantial claim: may not pass S4 (based).

A body restored by rollback is a fresh generation and receives no authority from historical identity alone.

“A body restored by rollback is a fresh generation and receives no authority from historical identity alone.”

• AssumptionThe authors state this as an assumption: Every security-relevant commitment named by the profile crosses a broker that validates the current generation, complete lineage-atom closure, allocation, and complete effect tuple at its own linearization point.
• AssumptionThe authors state this as an assumption: Generation identities, the unique authorization parent, body/configuration commitments, authorization and certification records, cuts, allocations, receipts, and evidence-root identities use unambiguous canonical encodings and authenticators whose acceptance cannot be produced from the candidate's control.
• AssumptionThe authors state this as an assumption: Generation and root epochs never decrease or reactivate; accepted evidence/authorization records, lineage cuts, fences, root-lifetime debit records, and effect-request replay records cannot be rewritten.
• AssumptionThe authors state this as an assumption: Every non-root generation has exactly one registered authorization parent before activation; a fork may create several successors atomically, but each successor names the same single predecessor; the predecessor is fenced; the ledger retains every resulting parent edge and lineage atom across offline, delayed, and nested.
• AssumptionThe authors state this as an assumption: Effect normalization preserves every policy-relevant correlation; the registered effect-membership predicate and authority join are monotone, multiplicity-aware where policy requires it, additive for consumable resources, and conservative for.
• AssumptionThe authors state this as an assumption: Reservation, allocation replacement, activation, predecessor fencing, and budget consumption execute as serializable durable transitions with exact population-version and source-residual preconditions. A held reservation either.
• AssumptionThe authors state this as an assumption: Each promotion profile names required predicates and independent control-root classes; aliases, descendants, cloned processes, and principals governed by the candidate's control root cannot satisfy independent slots.

Probably not a substantial claim: may not pass S4 (based).

Either guard prevents concurrent consumption from spending the reserved residual.

“Either guard prevents concurrent consumption from spending the reserved residual.”

Classified as probably not a substantial claim. May combine two claims.

The identifier is the domain-separated digest over the exact manifest digest, population, root grant, generation sequence, unique parent, and complete lineage-atom set; domain separation prevents a manifest digest, authorization record, or effect receipt from being reinterpreted as a generation identity; the fresh generation sequence makes two otherwise identical manifests distinct; a rollback may

“The identifier is the domain-separated digest in (1), over the exact manifest digest, population, root grant, generation sequence, unique parent, and complete lineage-atom set. Domain separation prevents a manifest digest, authorization record, or effect receipt from being reinterpreted as a generation identity. The fresh generation sequence makes two otherwise identical manifests distinct. A roll”

• cites [21] [21] Justin Samuel, Nick Mathewson, Justin Cappos, and Roger Dingledine. 2010. Survivable Key Compromise in Software Update Systems. In Proceedings of the 17th ACM Conference on Computer and Communications Security . Association for Computing Machinery, New York, NY, USA, 61-72. doi: 10.1145/1866307.1866315 - sourceNot checked — no full text of the source
• cites [29] [29] Santiago Torres-Arias, Hammad Afzali, Trishank Karthik Kuppusamy, Reza Curtmola, and Justin Cappos. 2019. in-toto: Providing Farm-to-Table Guarantees for Bits and Bytes. In 28th USENIX Security Symposium . USENIX Association, Santa [Clara, CA, 1393-1410. https://www.usenix.org/conference/usenixsecurity19/presentation/torres-arias](https://www.usenix.org/conference/usenixsecurity19/presentation/torres-arias) -Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim. May combine two claims.

The theorems quantify over the registered generation graph, root grants, population ceiling, normalizer, evidence profile, and mediated effects; they establish enforcement of the supplied policy relation and lineage state, but do not infer whether arbitrary code is semantically equivalent or whether an evaluator's external factual judgment is correct.

“The theorems quantify over the registered generation graph, root grants, population ceiling, normalizer, evidence profile, and mediated effects. They establish enforcement of the supplied policy relation and lineage state; they do not infer whether arbitrary code is semantically equivalent or whether an evaluator's external factual judgment is correct.”

• AssumptionThe authors state this as an assumption: Every security-relevant commitment named by the profile crosses a broker that validates the current generation, complete lineage-atom closure, allocation, and complete effect tuple at its own linearization point.
• AssumptionThe authors state this as an assumption: Generation identities, the unique authorization parent, body/configuration commitments, authorization and certification records, cuts, allocations, receipts, and evidence-root identities use unambiguous canonical encodings and authenticators whose acceptance cannot be produced from the candidate's control.
• AssumptionThe authors state this as an assumption: Generation and root epochs never decrease or reactivate; accepted evidence/authorization records, lineage cuts, fences, root-lifetime debit records, and effect-request replay records cannot be rewritten.
• AssumptionThe authors state this as an assumption: Every non-root generation has exactly one registered authorization parent before activation; a fork may create several successors atomically, but each successor names the same single predecessor; the predecessor is fenced; the ledger retains every resulting parent edge and lineage atom across offline, delayed, and nested.
• AssumptionThe authors state this as an assumption: Effect normalization preserves every policy-relevant correlation; the registered effect-membership predicate and authority join are monotone, multiplicity-aware where policy requires it, additive for consumable resources, and conservative for.
• AssumptionThe authors state this as an assumption: Reservation, allocation replacement, activation, predecessor fencing, and budget consumption execute as serializable durable transitions with exact population-version and source-residual preconditions. A held reservation either.
• AssumptionThe authors state this as an assumption: Each promotion profile names required predicates and independent control-root classes; aliases, descendants, cloned processes, and principals governed by the candidate's control root cannot satisfy independent slots.

May combine two claims.

Both the single-parent and fork paths may leave residual authority unallocated; neither retains an attenuated active predecessor, returns spent budget, or mutates the predecessor's immutable grant.

“Both paths may leave residual authority unallocated; neither retains an attenuated active predecessor, returns spent budget, or mutates the predecessor's immutable grant.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

General semilattices, arbitrary multiplicities, and arbitrary Φ_p predicates describe the registered abstraction and are not presented as executable-artifact results.

“General semilattices, arbitrary multiplicities, and arbitrary Φ 𝑝 predicates describe the registered abstraction and are not presented as executable-artifact results.”

Classified as probably not a substantial claim. May combine two claims.

The checker must reject both mapping-substitution and cross-adapter disagreement forms.

“The checker must reject both disagreement forms.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The evaluation is organized as separately gated evidence layers.

“The evaluation is organized as separately gated evidence layers.”

May combine two claims.

Two concrete refinements over frozen public runtimes have their own source, execution, and result seals; logical adapter results are never relabeled as external-runtime evidence.

“Two concrete refinements over frozen public runtimes have their own source, execution, and result seals; logical adapter results are never relabeled as external-runtime evidence.”

Probably not a substantial claim: may not pass S3 (load-bearing).