AFIR · attested fragment inference routing

From sleepy inference to chain of custody.

Every prompt, tool call, cache hit, and agent hop gets signed with ML-DSA-65, rooted in a Merkle tree, and anchored on Base.

Prompt Model z z z Response no receipt · no proof
Prompt AFIR node Response Receipt: signed ✓ ML-DSA-65 · 384 bytes
Orchestrator Web search ✓ in/out signed Database ✓ in/out signed API call ✓ in/out signed Merkle root one signature · whole pipeline
P1

Signed tool calls

Before/after receipts on every tool an agent touches.

P2

Receipt trees

Every agent hop under one Merkle root per session.

P3

KV cache signing

Caches get signed the moment they're written, so you can trace them across turns.

P4

Model manifest

Prove which model signed. No TEE required.

P5

Crypto-agile

Flip a switch when NIST moves.
ML-DSA-65

Private by design. Hive does not store your prompts. Every request is already receipted by a one-way SHA-256 fingerprint, not the words. Proof, not surveillance.