Forensic Rail™ binds post-incident analysis to a bonded k-of-n consortium credential, industry ISAC-style, and every model call made under that credential is deterministic-replay-bonded: fixed seed, temperature zero, bound prompt, output, and KV-cache digests. Anyone holding the credential, the analysis receipts, and Hive's public key, a regulator, a court, or a rival producer investigating the same incident, can byte-identically reproduce the exact output the original responder got. No confabulation can hide behind "trust our report."
Make the investigation itself reproducible, not just the incident.
These numbers come from the reference implementation and its test suite. The threshold-signature credential logic and the digest-binding scheme are real and measured. Standing up an actual ISAC-style consortium and running deterministic replay against a real model stack at a customer is the next step, and it hasn't happened yet.
Envelope format is USAP_VERSION='usap.v1', shared across all seven upstream primitives filed under the same provisional. Filed July 26, 2026. USPTO application 64/119,279.
After the OpenAI and Hugging Face incident, the reconstruction of 17,000 events depended heavily on the producer's own account of what happened. No independent responder, no regulator, no rival producer, had a way to rerun the same analysis and confirm the conclusions weren't confabulated, selectively presented, or simply wrong. The investigation itself was unverifiable, even though it was the thing everyone had to trust.
When the producer investigates its own incident, the output is a narrative, not a reproducible artifact. Nobody outside can rerun the same model call with the same inputs and get the same answer to check the story holds up.
The scale of the incident made independent reconstruction exactly the kind of task that needed to be reproducible. Instead, the analysis stayed locked to the producer's own tooling and their own telling. Read the incident analysis.
Forensic Rail issues a scoped, threshold-signed credential for the incident, and binds every model call under it to deterministic replay: same seed, same temperature zero, same prompt and output digests. Anyone with the credential and the receipts can reproduce it exactly.
Motivating incident: Hive incident analysis: OpenAI and Hugging Face, 17,000 events · Signature standard: NIST FIPS 204 (ML-DSA).
Two things have to hold at once. First, the responder has to be operating under a credential that a consortium of independent parties, not the producer alone, threshold-signed into existence, scoped to exactly what the responder is allowed to do. Second, every model call made under that credential has to be pinned to settings that make the output byte-identically reproducible by anyone else running the same replay hint.
| Component | What it pins | Why it's load-bearing | What breaks without it |
|---|---|---|---|
| consortium_root_kid | Which threshold key issued the credential | No single party, including the producer, can mint its own credential | Self-issued credentials, no independent oversight |
| threshold_k / total_n | How many consortium signers had to agree | A minority can't authorize a scope the majority didn't approve | One captured signer could authorize anything |
| scope: analyze_only | Whether the responder may generate novel output at all | Prevents an investigation from quietly becoming an unauthorized deployment | Scope creep, undetected |
| seed, temperature_bp = 0 | The exact sampling settings used | Nonzero temperature makes byte-identical reproduction impossible | "Reproduction" that never actually matches |
| prompt_digest, output_digest, kv_cache_digest | What went in, what came out, and the cache state | A verifier can confirm the exact inputs and outputs without re-running anything first | No way to check the claimed output matches the claimed input |
READS FINE
BROKEN: the claimed output does not reproduce under the bonded credential
A report that reads well is not the same as a report that reproduces. Forensic Rail forces the second test, and it's the one that actually catches confabulation or a selectively edited account.
Two receipt types. forensic.credential establishes the scoped, threshold-signed consortium authorization for the incident. forensic.analysis binds every model call made under that credential to the deterministic settings and digests needed for byte-identical replay. Both are ML-DSA-65 signed under the shared usap.v1 envelope.
// forensic.credential: threshold-signed by the consortium, scoped and time-bound { "usap_version": "usap.v1", "receipt_type": "forensic.credential", "incident_case_id": "case:openai-hf-2026-07-25", "ticket_chain_ref": "sha256:ticket-chain-root...", "scope": "analyze_only", ← analyze_only | analyze_and_generate "no_execute": true, "no_generate_novel": true, "validity_window": { "not_before": "2026-07-26T00:00:00Z", "not_after": "2026-08-02T00:00:00Z" }, "consortium_root_kid": "kid:isac-consortium-root", "threshold_k": 4, "total_n": 9, "consortium_signers": ["kid:signer-01","kid:signer-05","kid:signer-06","kid:signer-09"], "signers_digest": "sha256:signer-set-digest...", "signature": "ML-DSA-65, 3309 bytes" } // forensic.analysis: one per model call made under the credential, deterministic-replay-bonded { "usap_version": "usap.v1", "receipt_type": "forensic.analysis", "credential_ref": "sha256:credential-receipt-digest...", "model_ref": "model:reference-analyzer-v3", // deterministic mode "seed": 42, "temperature_bp": 0, ← must be 0, no exceptions "top_p_bp": 10000, "prompt_digest": "sha256:8e21...", "output_digest": "sha256:3fa0...", "kv_cache_digest": "sha256:c910...", "responder_kid": "kid:responder-lab-04", "replay_hint": { "library": "vllm==0.9.2", "kernel": "5.15.0-cc" }, "deterministic_replay": true, "signature": "ML-DSA-65, 3309 bytes" }
temperature_bp must equal 0 in every forensic.analysis receipt. Any nonzero sampling temperature makes "reproduce this exactly" a contradiction in terms, so the schema refuses to represent that case as deterministic_replay: true.
no_execute and no_generate_novel are booleans bound into the signed credential itself. A responder operating under analyze_only can't quietly slide into generating new content and still claim the credential covers it.
Byte-identical output depends on matching library and kernel versions, not just the seed. The replay_hint field says exactly what a third party needs to match to get the same output, honestly, instead of pretending reproduction is trivial.
Forensic Rail does not claim every incident analysis will reproduce trivially on any hardware. It claims that, given the replay_hint, an independent party has everything needed to try, and a mismatch is externally detectable rather than invisible.
Forensic Rail sits in front of whatever inference stack an incident responder already uses. It doesn't replace the responder's tooling. It requires a valid, scoped credential before any call counts as bonded, and it binds the deterministic settings needed for someone else to check the output afterward.
The credential is threshold-signed by an ISAC-style consortium, not minted unilaterally by the producer under investigation. That single change is what makes the resulting analysis trustworthy to a party other than the producer: nobody investigating their own incident can also be the sole authority on what they were allowed to do while investigating it.
Public verifier: standalone, offline, zero network calls to Hive. A regulator, court, or rival producer can check the credential's scope, the threshold signature, and whether a claimed output digest actually matches an independent replay.
Sits in front of any inference stack that supports deterministic decoding (fixed seed, temperature zero). Pilot-ready for a live ISAC-style consortium; not yet deployed against a real industry body.
Credential checks and digest binding add negligible latency to the analysis call. The deterministic decoding constraint itself may reduce output diversity compared to normal sampling, which is the intended tradeoff for reproducibility.
A call outside the credential's scope, or a call that isn't run in deterministic mode, does not get to claim deterministic_replay: true. There's no code path that backfills that guarantee after the fact.
Signature standard: NIST FIPS 204 (ML-DSA) · Reference implementation: hive-typed-signer, one file per primitive.
Honesty is the product. Here is exactly where the edges are.
Forensic Rail proves the analysis was run under an authorized, scoped credential and that its output is reproducible. It does not prove the conclusions drawn from that output are the right conclusions. Reproducibility and correctness are different claims.
Byte-identical replay depends on the responder's library and kernel versions matching the replay_hint. Different hardware or a different inference engine version can produce a different output even at temperature zero. We say this plainly rather than overselling "reproduce anywhere."
The cryptographic core, the threshold-signature scheme, and the digest binding are built and tested. Standing up a real ISAC-style consortium and wiring this to a live deterministic inference stack at a customer is the next step, and it has not happened yet.
Forensic Rail™ is one of seven upstream primitives filed together, July 26, 2026, USPTO application 64/119,279, all sharing the ML-DSA-65 signer and the usap.v1 envelope. It governs the post-incident reproducibility axis: whether the investigation itself, not just the incident, can be independently checked. The other six cover environment integrity, policy disclosure, intent alarms, network enforcement, time and consensus, and egress metering.
| Primitive | What it proves | Axis | When |
|---|---|---|---|
| Forensic Rail | Post-incident analysis runs under a bonded consortium credential and is deterministic-replay-bonded for independent reproduction. | Post-incident reproducibility | crypto core proven integration pilot-ready |
| Provenance-Bonded Sandbox | Environment integrity, continuously, from provisioning through every heartbeat. | Environment integrity | crypto core proven |
| Refusal Ledger | Every refusal-policy mutation is on record, and the runtime value stays inside declared bounds without disclosing it. | Policy disclosure | crypto core proven |
| Howler | An alarm about intent formation fired before the effect emitted, and a third party can independently replay it. | Intent alarm | crypto core proven |
| Perimeter Bond | The exact enforcement bytecode that intercepted syscalls is bound into every attempt receipt. | Network enforcement | crypto core proven |
| Diurnal Bond | Weekend and after-hours actions require k-of-n countersigning, where k is computed from a signed risk manifold. | Time and consensus | crypto core proven |
| Egress Bond | Data leaving the perimeter is metered per semantic class against pre-committed caps, without exposing which rows contributed. | Egress metering | crypto core proven |
| Carnac | The downstream gate: challenge, escalate, or stop an agent action before it executes. | Downstream gate | now |
| HiveSeal | Where the signing key lives in silicon: a key-side root. | Key-side root | now |
| AFiR | Attested Fragmented Inference Routing: signed routing of an inference across fragments and providers. | Compute axis | now |
| SiGR | A specific model at a specific config produced a specific output, signed and checkable offline. | Compute axis | now |
See also: the OpenAI and Hugging Face incident analysis, the case where an unreproducible self-account motivates Forensic Rail directly.
We're looking for design partners, including consortium bodies and independent responders, to take the crypto core into a live post-incident investigation. You bring the consortium and the incident. We wire the threshold credential, the deterministic replay binding, and the digest verification, run the smoke tests against your response workflow, and you walk out with receipts a regulator, court, or another producer can check offline.
Forensic Rail: bonded, reproducible incident response. Patent Pending. Binds post-incident analysis to a threshold-signed consortium credential and deterministic replay, signed independently with ML-DSA-65 (FIPS 204), checkable offline. Crypto core built and proven: 37 of 37 smoke tests pass. Filed July 26, 2026, USPTO application 64/119,279. Real consortium and deterministic-stack integrations are pilot-ready, not yet deployed. We never fake a receipt.