Diurnal Bond™ binds consequential agent actions, inference under elevated risk, tool calls, egress, model swaps, and policy changes, during weekends, on-call windows, after-hours periods, or declared incidents, to k-of-n countersigning from geographically distributed human attestors. k is not a fixed number picked once and forgotten. It is computed dynamically from a signed risk manifold, so nobody can quietly lower the bar for a Saturday at 2am and nobody can prove after the fact that the bar was ever different.
Force multiple humans awake before the weekend action can commit.
These numbers come from the reference implementation and its test suite. The risk manifold logic, the k-of-n threshold computation, and the receipt signing are real and measured. Live integration with a customer's on-call rotation is the next step, and it hasn't happened yet.
Envelope format is USAP_VERSION='usap.v1', shared across all seven upstream primitives filed under the same provisional. Filed July 26, 2026. USPTO application 64/119,279.
The OpenAI and Hugging Face incident did not happen in a single moment during business hours. It ran over a weekend, and 17,000 events accumulated before anyone with the authority to stop it was looking. That is not a monitoring failure. It is a structural one: nothing in the system required a second, awake, geographically separate human to agree before the risky action was allowed to repeat.
Approval chains, escalation policies, and on-call rotations are usually built for a five-day week. Weekend and after-hours windows quietly inherit weaker review, fewer eyes, and looser thresholds, and nothing makes that gap visible or provable.
Across the weekend the agent repeated the same class of action thousands of times. No signed record exists anywhere that a second human, awake and independent, ever looked at the risk and agreed to let it continue. Read the incident analysis.
Diurnal Bond ties the required countersign count k to the actual time regime and action class, via a signed risk manifold. A Saturday model swap requires more independent, awake signers than a Tuesday afternoon inference call, and that requirement can't be edited without leaving a signed trace.
Motivating incident: Hive incident analysis: OpenAI and Hugging Face, 17,000 events · Signature standard: NIST FIPS 204 (ML-DSA).
A fixed policy of "two approvers on weekends" can be quietly rewritten by whoever controls the config file. Diurnal Bond makes the required signer count k a function of a signed risk manifold, keyed by regime and action class, with the manifold's own digest bound into every regime-declaration receipt. Change the manifold, and the change itself is signed and dated. You cannot lower k for a specific Saturday without leaving a record that k was lowered.
| Regime | Example action class | What changes | Why it can't be gamed |
|---|---|---|---|
| business_hours | inference | k is typically low, sometimes 1 | Manifold digest still signed and bound, even when k=1 |
| on_call | tool_call | k rises, attestor pool narrows to on-call roster | Roster membership is part of the signed attestor_kid_set |
| weekend | egress, model_swap | k rises further, attestors must be geographically distributed | region field on every attestation receipt, checked independently |
| after_hours | policy_change | k rises, validity_window shrinks | Any attestation outside the window fails verification |
| incident_active | any | k rises to the manifold's ceiling | Declaring incident_active itself is a signed, auditable event |
| maintenance | model_swap | k set by the maintenance-specific row of the manifold | Maintenance windows are pre-declared, not self-declared mid-action |
LOOKS FINE ON PAPER
BROKEN: manifold edited without a trace, action proceeds under the wrong k
A static policy document can say anything. Only a signed risk manifold, checked against the countersigning receipts actually produced, tells you whether the required bar was really met, on that Saturday, for that action class.
Two receipt types. diurnal.regime declares the time regime, the action class, and the dynamically computed k, with the risk manifold's digest bound in so it can't be edited invisibly. diurnal.attestation is the signed countersign itself, one per attestor, tied back to the regime declaration. Both are ML-DSA-65 signed under the shared usap.v1 envelope.
// diurnal.regime: declared before any action in a non-default window is allowed { "usap_version": "usap.v1", "receipt_type": "diurnal.regime", "regime": "weekend", // business_hours | on_call | weekend | after_hours | maintenance | incident_active "action_class": "egress", // inference | tool_call | egress | model_swap | policy_change "risk_manifold_digest": "sha256:9f2a...", ← binds the manifold, can't be edited invisibly "required_k": 3, "total_n": 7, "attestor_kid_set": ["kid:attestor-01","kid:attestor-04","kid:attestor-07", "..."], "validity_window": { "not_before": "2026-07-25T00:00:00Z", "not_after": "2026-07-27T08:00:00Z" }, "signature": "ML-DSA-65, 3309 bytes" } // diurnal.attestation: one signed countersign per attestor, must reach required_k { "usap_version": "usap.v1", "receipt_type": "diurnal.attestation", "regime_ref": "sha256:regime-receipt-digest...", "attestor_kid": "kid:attestor-04", "region": "us-west", "ts": "2026-07-25T14:32:09Z", "action_class": "egress", "signature": "ML-DSA-65, 3309 bytes" }
The risk manifold itself is signed and its digest lives inside every regime declaration. Edit the manifold to quietly lower k for a specific weekend, and the digest changes, which breaks the chain of trust against any prior regime declaration referencing the old manifold.
The region field on every attestation is not decorative. Verification can require the k attestors to span a minimum number of distinct regions, so "three approvers" can't secretly mean three people in the same office who all went home at 6pm.
If fewer than required_k valid attestations exist inside the validity_window, the action does not get to claim it was countersigned. There is no code path that lets an action proceed and backfill the missing signatures later.
Diurnal Bond does not evaluate whether the underlying action is a good idea. It evaluates whether enough of the right people, awake, in enough different places, actually agreed to it, and it makes that fact checkable offline by anyone holding the receipts and Hive's public key.
Diurnal Bond sits in front of any action classifier that already tags requests by action_class. It adds the regime lookup, the k computation, and the countersign collection, then emits signed receipts that a verifier can check without ever calling back to Hive.
k is not a static number anyone can memorize and route around. It's derived from the manifold at declaration time, and the manifold's digest travels with every receipt. A verifier can independently confirm k was computed correctly for that regime and action class, not just trust that it was.
Public verifier: standalone, offline, zero network calls to Hive. Anyone holding the regime declaration, the attestations, and Hive's public key can check whether the required k was actually met, and whether the attestors were actually distributed the way the manifold demanded.
Sits alongside existing on-call and paging tooling. Pilot-ready for PagerDuty-style rotation systems and any workflow engine that already tags actions by class; not yet deployed at a live customer.
Regime lookup and manifold digest check add negligible latency to the action path. Countersign collection is asynchronous and off the hot path; the action either waits for k or fails closed within its validity window.
If the countersigning infrastructure itself is unreachable, the underlying action fails closed rather than proceeding uncountersigned. There's no silent bypass mode.
Signature standard: NIST FIPS 204 (ML-DSA) · Reference implementation: hive-typed-signer, one file per primitive.
Honesty is the product. Here is exactly where the edges are.
Diurnal Bond proves that enough of the right people, geographically distributed and awake, agreed to let an action proceed. It does not evaluate whether the action was wise, safe, or correct. That judgment still belongs to the humans who countersigned.
If an organization genuinely has nobody awake and available to meet the required k during a weekend, Diurnal Bond blocks the action. It doesn't magically produce qualified attestors. It makes the staffing gap visible instead of hidden.
The cryptographic core, the manifold digest binding, and the k computation are built and tested. Wiring this into a real paging system and a real on-call rotation at a customer is the next step, and it has not happened yet.
Diurnal Bond™ is one of seven upstream primitives filed together, July 26, 2026, USPTO application 64/119,279, all sharing the ML-DSA-65 signer and the usap.v1 envelope. It governs the time and consensus axis: who has to be awake and agree before a risky action proceeds in a low-oversight window. The other six cover environment integrity, policy disclosure, intent alarms, network enforcement, egress metering, and post-incident reproducibility.
| Primitive | What it proves | Axis | When |
|---|---|---|---|
| Diurnal Bond | Consequential actions in weekend, on-call, or after-hours windows require k-of-n countersigning, where k is computed from a signed risk manifold. | Time and consensus | crypto core proven integration pilot-ready |
| Provenance-Bonded Sandbox | Environment integrity, continuously, from provisioning through every heartbeat. | Environment integrity | crypto core proven |
| Refusal Ledger | Every refusal-policy mutation is on record, and the runtime value stays inside declared bounds without disclosing it. | Policy disclosure | crypto core proven |
| Howler | An alarm about intent formation fired before the effect emitted, and a third party can independently replay it. | Intent alarm | crypto core proven |
| Perimeter Bond | The exact enforcement bytecode that intercepted syscalls is bound into every attempt receipt. | Network enforcement | crypto core proven |
| Egress Bond | Data leaving the perimeter is metered per semantic class against pre-committed caps, without exposing which rows contributed. | Egress metering | crypto core proven |
| Forensic Rail | Post-incident analysis runs under a bonded consortium credential and is deterministic-replay-bonded for independent reproduction. | Post-incident reproducibility | crypto core proven |
| Carnac | The downstream gate: challenge, escalate, or stop an agent action before it executes. | Downstream gate | now |
| HiveSeal | Where the signing key lives in silicon: a key-side root. | Key-side root | now |
| AFiR | Attested Fragmented Inference Routing: signed routing of an inference across fragments and providers. | Compute axis | now |
| SiGR | A specific model at a specific config produced a specific output, signed and checkable offline. | Compute axis | now |
See also: the OpenAI and Hugging Face incident analysis, the motivating case for Diurnal Bond and three of its six sibling primitives.
We're looking for design partners running agent workloads with real on-call rotations to take the crypto core into a live paging and countersigning flow. You bring the rotation and the action classifier. We wire the risk manifold, the regime declaration, and the k-of-n countersign collection, run the smoke tests against your action classes, and you walk out with receipts a regulator, auditor, or court can check offline.
Diurnal Bond: weekend and after-hours countersigning. Patent Pending. Binds consequential agent actions in low-oversight time windows to k-of-n countersigning from geographically distributed attestors, where k is computed from a signed risk manifold, signed independently with ML-DSA-65 (FIPS 204), checkable offline. Crypto core built and proven: 37 of 37 smoke tests pass. Filed July 26, 2026, USPTO application 64/119,279. Real on-call integrations are pilot-ready, not yet deployed. We never fake a receipt.