Egress Bond™ meters data leaving the perimeter, per semantic class: credentials, PII, model weights, test data, plaintext, against pre-committed caps set before the agent ever runs. It uses additive homomorphic Pedersen commitments so the producer never sees which specific rows contributed to the running total. When a class breaches its cap, the bond breaks, and that break retroactively invalidates the entire associated SiGR Chain DAG. Reconstruction after the fact becomes cryptographically unnecessary, because the bond already told you exactly where it broke.
Break the bond at row 10,001. Don't wait for someone to count to 17,000.
These numbers come from the reference implementation and its test suite. The commitment scheme, the per-class cap logic, and the receipt signing are real and measured. Wiring this to a live classifier watching real egress traffic is the next step, and it hasn't happened yet.
Envelope format is USAP_VERSION='usap.v1', shared across all seven upstream primitives filed under the same provisional. Filed July 26, 2026. USPTO application 64/119,279.
In the OpenAI and Hugging Face incident, test-data rows exfiltrated across a weekend before anyone reconstructed what had happened. The reconstruction itself took real forensic work, after the fact, against logs that could be incomplete or altered. Egress Bond removes the need for that reconstruction by metering the aggregate live, per semantic class, against a cap set before the run ever started.
A log is a record you consult after the fact, and only if it survived intact. A pre-committed cap is a limit the system enforces during the run. By the time anyone reads a log about row 17,000, row 17,000 already left.
Nothing in the pipeline compared the running total against a pre-declared limit per data class. Test data, credentials, and PII were treated the same, uncapped, until someone counted afterward. Read the incident analysis.
Egress Bond meters every class continuously with homomorphic commitments. At row 10,001 against a cap of 10,000, the bond breaks, a signed event fires, and the associated SiGR Chain DAG is retroactively invalidated. There's nothing left to reconstruct.
Motivating incident: Hive incident analysis: OpenAI and Hugging Face, 17,000 events · Signature standard: NIST FIPS 204 (ML-DSA).
Each row is classified locally by a classifier whose weights digest is bound into the manifest before the run starts. Every row's class contributes to a running homomorphic commitment, additive, so the total can be checked against the cap without any party, including the producer, ever seeing which individual rows contributed. Cross the cap, and the bond breaks.
| Class | Typical cap | Why the cap exists | What breaking it triggers |
|---|---|---|---|
| credential | 0 rows | No credential should ever leave the perimeter | Immediate bond break, DAG invalidation |
| pii | 10 rows | Small, audited exceptions only, never bulk | Bond break past 10, DAG invalidation |
| model_weight | 0 rows | Weights are the crown jewels, zero tolerance | Immediate bond break, DAG invalidation |
| test_data | 100 rows | Some test data movement is normal, bulk isn't | Bond break past 100, DAG invalidation |
| plaintext | 1000 rows | Highest tolerance, still bounded | Bond break past 1000, DAG invalidation |
LOOKS FINE ON THE DASHBOARD
BROKEN: test_data cap breached, DAG invalidated at the moment of breach
Aggregate volume can look completely normal while one semantic class quietly blows past its cap. Only per-class metering, checked continuously, catches it at row 10,001 instead of row 17,000.
Two receipt types. egress.manifest declares the per-class caps, the classifier weights digest, and the commitment seed before the run starts. egress.measurement reports the windowed commitments and, if a cap is breached, the bond break and disposition. Both are ML-DSA-65 signed under the shared usap.v1 envelope.
// egress.manifest: declared before the run, binds the caps and the classifier { "usap_version": "usap.v1", "receipt_type": "egress.manifest", "per_class_row_caps": { "credential": 0, "pii": 10, "model_weight": 0, "test_data": 100, "plaintext": 1000 }, "classifier_weights_digest": "sha256:7c1e...", ← binds the local classifier, can't be swapped invisibly "commitment_seed_digest": "sha256:4a90...", "retroactive_invalidation": true, "sigr_chain_ref": "sha256:sigr-dag-root...", "signature": "ML-DSA-65, 3309 bytes" } // egress.measurement: windowed report, homomorphic per-class commitments { "usap_version": "usap.v1", "receipt_type": "egress.measurement", "window": { "start": "2026-07-25T00:00:00Z", "end": "2026-07-25T06:00:00Z" }, "per_class_row_commitments": { "credential": "pedersen:0x9ab2...", "pii": "pedersen:0x11cd...", "test_data": "pedersen:0x77fe..." }, "per_class_rows_total": { "credential": 0, "pii": 3, "test_data": 10001 }, "bond_break_detected": { "class": "test_data", "cap_exceeded": 100, "observed_total": 10001 }, "disposition": "invalidate_dag", ← the retroactive break "signature": "ML-DSA-65, 3309 bytes" }
Pedersen commitments are homomorphic: individual row commitments sum to a verifiable total without revealing which rows were which. The producer proves the aggregate stayed under cap, or gets caught the moment it didn't, without ever exposing row-level content.
The manifest binds the classifier_weights_digest. Swap the classifier for a laxer one mid-run and the digest mismatch is externally visible, so the classifier itself can't be quietly weakened to dodge a cap.
A bond break doesn't just log an alert. It sets disposition to invalidate_dag, which retroactively invalidates the entire SiGR Chain DAG tied to that run, so nothing downstream can claim the run was clean after the fact.
Egress Bond does not need to know what was in row 10,001 to know the cap on test_data broke at row 10,001. That's the point: metering per class, continuously, without exposing content, closes the gap logs-after-the-fact can't.
Egress Bond sits between a local semantic classifier and the perimeter's actual egress path. It doesn't replace the classifier. It takes the classifier's per-row class label, folds it into a running homomorphic commitment per class, and checks the running total against the manifest's caps on every measurement window.
Most DLP and egress-monitoring tools require the monitor to see the content to classify it, which means someone always has visibility into the actual rows. Egress Bond's homomorphic commitments let the aggregate be checked against a cap without any party, including Hive, learning the row-level content.
Public verifier: standalone, offline, zero network calls to Hive. A regulator, auditor, or the operator itself can check whether a cap was breached and whether the DAG invalidation followed correctly, using only the manifest, the measurement receipts, and Hive's public key.
Sits behind any existing DLP or semantic classifier that already labels rows by class. Pilot-ready for a live egress gateway; not yet deployed against real production traffic.
Folding a row into a Pedersen commitment is cheap, additive group operations, not per-row signing. Signing happens per measurement window, not per row, keeping the hot path fast.
Once bond_break_detected fires, disposition defaults to invalidate_dag. There's no code path where a breached cap silently continues without the invalidation taking effect.
Signature standard: NIST FIPS 204 (ML-DSA) · Reference implementation: hive-typed-signer, one file per primitive.
Honesty is the product. Here is exactly where the edges are.
Egress Bond meters against a classifier's output. It does not itself decide whether a given row is PII, a credential, or plaintext. A weak or misconfigured classifier still produces weak or misconfigured metering; the manifest binds the weights digest but can't fix bad training.
Egress Bond detects and signs the breach; whether the underlying egress path is blocked at that moment depends on the enforcement layer it's wired to, for example Perimeter Bond. Wire them together for detection and enforcement in one place.
The cryptographic core, the commitment math, and the DAG invalidation logic are built and tested. Wiring this into a live classifier and a real egress gateway at a customer is the next step, and it has not happened yet.
Egress Bond™ is one of seven upstream primitives filed together, July 26, 2026, USPTO application 64/119,279, all sharing the ML-DSA-65 signer and the usap.v1 envelope. It governs the egress metering axis: how much of what data class actually left the perimeter, checked without exposing content. The other six cover environment integrity, policy disclosure, intent alarms, network enforcement, time and consensus, and post-incident reproducibility.
| Primitive | What it proves | Axis | When |
|---|---|---|---|
| Egress Bond | Data leaving the perimeter is metered per semantic class against pre-committed caps, without exposing which rows contributed. | Egress metering | crypto core proven integration pilot-ready |
| Provenance-Bonded Sandbox | Environment integrity, continuously, from provisioning through every heartbeat. | Environment integrity | crypto core proven |
| Refusal Ledger | Every refusal-policy mutation is on record, and the runtime value stays inside declared bounds without disclosing it. | Policy disclosure | crypto core proven |
| Howler | An alarm about intent formation fired before the effect emitted, and a third party can independently replay it. | Intent alarm | crypto core proven |
| Perimeter Bond | The exact enforcement bytecode that intercepted syscalls is bound into every attempt receipt. | Network enforcement | crypto core proven |
| Diurnal Bond | Weekend and after-hours actions require k-of-n countersigning, where k is computed from a signed risk manifold. | Time and consensus | crypto core proven |
| Forensic Rail | Post-incident analysis runs under a bonded consortium credential and is deterministic-replay-bonded for independent reproduction. | Post-incident reproducibility | crypto core proven |
| Carnac | The downstream gate: challenge, escalate, or stop an agent action before it executes. | Downstream gate | now |
| HiveSeal | Where the signing key lives in silicon: a key-side root. | Key-side root | now |
| AFiR | Attested Fragmented Inference Routing: signed routing of an inference across fragments and providers. | Compute axis | now |
| SiGR | A specific model at a specific config produced a specific output, signed and checkable offline. | Compute axis | now |
See also: the OpenAI and Hugging Face incident analysis, the 17,000-row weekend exfiltration that motivates Egress Bond directly.
We're looking for design partners with a live semantic classifier and a real egress gateway to take the crypto core into production metering. You bring the classifier and the traffic. We wire the manifest, the per-class commitments, and the bond-break-to-DAG-invalidation path, run the smoke tests against your data classes, and you walk out with receipts a regulator, auditor, or court can check offline.
Egress Bond: per-class data egress metering. Patent Pending. Meters data leaving the perimeter per semantic class against pre-committed caps, using homomorphic Pedersen commitments, signed independently with ML-DSA-65 (FIPS 204), checkable offline. Crypto core built and proven: 37 of 37 smoke tests pass. Filed July 26, 2026, USPTO application 64/119,279. Real classifier and gateway integrations are pilot-ready, not yet deployed. We never fake a receipt.