A confidential-computing sandbox gets attested at boot: kernel modules, packages, GPU firmware, egress rules, all checked once. Then the job runs, sometimes for hours, sometimes over a weekend. Nothing checks it again. A kernel module can be swapped in memory, a package silently replaced, an egress ACL quietly loosened, and the original boot attestation never notices. Provenance-Bonded Sandbox™ (PBS™) closes that gap. It folds every runtime measurement into a Merkle heartbeat accumulator, chained forward for the life of the job, signed independently with ML-DSA-65.
Prove the environment stayed honest the whole time, not just at boot.
These numbers come from the reference implementation's benchmark suite, run against the actual signer and verifier. Nothing below is projected or rounded up.
Docket HC-2026-016. Envelope common across the seven-primitive filing: USAP_VERSION='usap.v1'. Real fleet integration: pilot-ready, not yet deployed. We don't claim a live accumulator running against production kernels until a design partner runs it.
The OpenAI and Hugging Face incident compounded over a weekend: 17,000 events had to be reconstructed after the fact, and even then attribution depended on the responsible party choosing to disclose it. Nobody had a continuous, signed record of what the execution environment actually was while the exfiltration was happening.
Confidential-computing attestation checks kernel modules, package index, GPU firmware, and egress ACL once, at provisioning. That's the last cryptographic statement anyone has about the environment.
A silent kernel-module swap, an in-memory package replacement, a mid-run ACL loosen, or a dropped heartbeat can all happen after the snapshot, and the original attestation still reads clean. Reconstruction after the fact, like the 17,000-event effort at Hugging Face, is what's left.
PBS folds ordered runtime measurement leaves into a chained Merkle accumulator on every heartbeat. Tamper with any of it, or simply stop heartbeating, and the chain breaks in a way any verifier can detect offline.
Motivating incident: Hive: the OpenAI / Hugging Face incident, 17,000 events reconstructed · NIST FIPS 204 (ML-DSA).
Each row is a real tamper mode. Boot-time attestation still reads clean in every case. PBS's heartbeat accumulator fails deterministically in every case too.
| # | Tamper mode | Boot attestation | PBS: why it fails |
|---|---|---|---|
| 1 | Silent kernel-module swap mid-run | ✓ passes (pre-swap) | ✗ measurement leaf mismatch → accumulator root diverges |
| 2 | In-memory package replacement | ✓ passes (pre-replace) | ✗ package-index leaf changes, chained root fails to reconcile |
| 3 | Mid-run ACL loosen: egress rule quietly widened | ✓ passes (pre-loosen) | ✗ egress ACL leaf differs from pbs.manifest |
| 4 | Dropped heartbeat: attestor goes quiet | ✓ passes (last seen) | ✗ monotonic seq gap, no signed continuation |
VALID (at t=0)
BROKEN: kernel module swapped at t+3h42m
The boot attestation isn't lying. It was true at boot. That's exactly the problem: it stops being a live statement the moment the job starts running, and jobs run for hours or days. PBS is the only layer that keeps witnessing.
PBS emits two receipt types under the common usap.v1 envelope. pbs.manifest is issued once, at provisioning. pbs.attestation is issued every N seconds for the life of the job, each one chaining forward from the last. Both are ML-DSA-65 signed.
// pbs.manifest: issued once, at provisioning { "type": "pbs.manifest", "usap_version": "usap.v1", "docket": "HC-2026-016", "container_digest": "sha256:...", "oci_digest": "sha256:...", "kernel_modules": ["..." // ordered list, hashed], "package_index_digest": "sha256:...", "egress_acl_digest": "sha256:...", "gpu_firmware_digest": "sha256:...", "attestor_kid": "hive-pbs-attestor-01", "provisioned_at": "2026-07-26T00:24:03Z", "signature": "ML-DSA-65, 3309 bytes" } // pbs.attestation: issued every N seconds, chained { "type": "pbs.attestation", "usap_version": "usap.v1", "docket": "HC-2026-016", "manifest_ref": "pbs.manifest#...", "seq": 214, "measurement_leaves": ["..." // ordered runtime measurements], "prior_accumulator_root": "sha256:...", "delta_root": "sha256:...", "new_accumulator_root": "H(prior_accumulator_root ‖ delta_root)", "heartbeat_ts": "2026-07-26T04:06:11Z", "attestor_kid": "hive-pbs-attestor-01", "signature": "ML-DSA-65, 3309 bytes" }
Each heartbeat's new_accumulator_root folds the prior root with the current delta. A verifier can walk the whole chain, or just the tail, and confirm nothing was inserted, removed, or reordered.
Measurement leaves are folded in a declared order. Reordering them, not just altering them, changes the root. Silent reorder attacks fail the same way silent substitution does.
The monotonic seq field means a gap is visible even with no tampering at all. Going quiet is not a safe way to hide a change.
Signature: ML-DSA-65 (FIPS 204), constant 3,309 bytes. Bench: sign p50 ~6ms, verify p50 ~2.4ms. Aggregate throughput ~132 signs/sec/type, ~418 verifies/sec/type, single-threaded JS.
PBS runs as an attestor process alongside the workload, not inside the operator's control plane. It never trusts the operator to self-report a clean environment.
pbs.manifest, the root everything else chains from.delta_root, chain against prior_accumulator_root.pbs.attestation. A verifier needs only the manifest and the attestation chain, no live access to the box.A missing or malformed heartbeat is a signed break, not a silent gap. Downstream consumers, including Carnac™, can treat a broken chain as a stop condition.
Verification needs the manifest, the attestation chain, and Hive's public key. No live access to the sandbox, no trust in the operator's own reporting.
PBS's signing key is provisioned the same way as the rest of the Hive stack: rooted in HiveSeal™. PBS proves the environment; HiveSeal proves the signer can be trusted.
Honesty is the product. Here is exactly where the edges are.
PBS proves the environment stayed the environment it claimed to be. It does not prove the workload running inside it produced a correct or safe output. That's a separate claim, made by other primitives in the canon.
Shorter intervals catch drift faster but cost more overhead. PBS does not claim continuous, zero-latency detection. It claims deterministic detection at the next heartbeat, on a declared interval the operator sets.
The cryptographic core is proven against reference measurements. Wiring PBS into a live confidential-computing fleet at scale is a pilot-stage integration, not a shipped production deployment today.
PBS is one of seven upstream primitives filed together on July 26, 2026, all built on the same signer and the same usap.v1 envelope. Each closes a different gap the OpenAI / Hugging Face incident exposed.
| Primitive | What it proves | Axis | When |
|---|---|---|---|
| PBS: Provenance-Bonded Sandbox | Environment integrity, continuously, from provisioning through every heartbeat. | Environment / upstream | now (crypto core) fleet pilot pending |
| Refusal Ledger | Every refusal-policy change is on record, and the runtime value falls inside a declared envelope. | Policy / upstream | now (crypto core) |
| Howler | An alarm about intent formation fired before the effect emitted, replayable by a third party. | Intent / upstream | now (crypto core) |
| Perimeter Bond | The exact enforcement bytecode intercepting syscalls is bound into every attempt receipt. | Network / upstream | now (crypto core) |
| Diurnal Bond | Consequential actions during off-hours require k-of-n countersigning from a signed risk manifold. | Time / upstream | now (crypto core) |
| Egress Bond | Data leaving the perimeter is metered per semantic class against pre-committed caps. | Egress / upstream | now (crypto core) |
| Forensic Rail | Post-incident analysis is bonded to a k-of-n consortium credential and deterministically replayable. | Forensics / upstream | now (crypto core) |
| Carnac™ | Reads consequence before effect and routes each read to the proof it warrants. | Downstream gate | now |
| HiveSeal™ | Where the signing key lives in silicon: a key-side root. | Key-side root | now |
| AFiR | Attested Fragmented Inference Routing: signed routing of an inference across fragments. | Compute axis | now |
| SiGR | A specific model at a specific config produced a specific output, signed and checkable offline. | Compute axis | now |
Motivating incident for the whole seven-primitive filing: the OpenAI / Hugging Face incident, 17,000 events reconstructed after the fact, attribution dependent on voluntary disclosure. PBS is the layer that would have kept a signed, continuous record of the environment the whole time.
We're looking for confidential-computing operators and platform teams running long-lived agent sandboxes to take the crypto core to a live fleet. You bring the workload. We wire the heartbeat accumulator into your provisioning and runtime measurement path, run the four tamper-mode tests against your real environment, and you walk out with the first receipts a regulator, auditor, or incident responder can check offline.
Provenance-Bonded Sandbox (PBS). Patent Pending. Proves environment integrity continuously, from provisioning through every heartbeat, using a Merkle heartbeat accumulator, signed independently with ML-DSA-65 (FIPS 204), checkable offline. Cryptographic core built and proven: 37 of 37 smoke tests pass across the seven-primitive filing. Filed July 26, 2026. USPTO application 64/119,279. Real fleet integration is pilot-ready, not yet deployed. We never fake a receipt.