Refusal policies, the thresholds that decide when a model declines a request, get changed by operators all the time: tuning, incident response, product decisions. Today those changes are internal. There is no external record that a change happened, when, by whom, or whether the new value still falls inside any bound the operator publicly committed to. Refusal Ledger™ closes that gap. It chains every policy mutation into a public, inclusion-proof ledger, and separately proves, with a zero-knowledge SNARK, that the runtime value in force at inference time falls inside a pre-declared envelope, without revealing the value itself.
Prove the policy changed honestly, and stayed in bounds, without publishing the number.
[lo, hi] without disclosing the exact threshold. What it is not: Refusal Ledger does not force an operator to publish their actual refusal threshold, and it does not judge whether a given threshold is the right one. It proves the change was recorded and the value stayed inside the operator's own declared envelope.These numbers come from the reference implementation's benchmark suite, run against the actual signer, verifier, and zk-circuit.
Docket HC-2026-017. Envelope common across the seven-primitive filing: USAP_VERSION='usap.v1'. Real policy-system integration: pilot-ready, not yet deployed. We don't claim a live ledger running against a production policy store until a design partner runs it.
In the runup to the OpenAI and Hugging Face incident, a refusal-policy configuration change happened internally. Nobody outside the operator's own systems could confirm it happened, confirm when, or confirm the new value stayed inside any bound the operator had committed to. Attribution, again, depended entirely on the operator choosing to disclose it.
Refusal thresholds live in internal config. A change is a database write or a config-service update. There is no independent, external record that anything changed at all.
Even when an operator publicly states "we will not lower thresholds below X," there is no way for an outsider to verify the live runtime value actually respects that commitment, without the operator disclosing the exact number.
Every mutation lands in a chained, inclusion-proof ledger. Separately, a zero-knowledge proof shows the live value sits inside [lo, hi], with the exact value never revealed.
Motivating incident: Hive: the OpenAI / Hugging Face incident · NIST FIPS 204 (ML-DSA).
Two independent checks run against every policy state. One confirms the mutation history is complete and untampered. The other confirms the current value, whatever it is, stays inside the declared envelope.
| # | Scenario | Internal record | Refusal Ledger: what it catches |
|---|---|---|---|
| 1 | Undisclosed threshold lowering: operator quietly loosens policy | ✓ looks routine internally | ✗ mutation lands in ledger regardless, ledger_seq advances, inclusion root changes publicly |
| 2 | Ledger tampering: attempt to delete or reorder a mutation record | ✓ internal log "looks clean" | ✗ inclusion root fails to reconcile against prior signed root |
| 3 | Envelope breach: runtime value drifts outside declared [lo, hi] | ✓ no internal alert configured | ✗ zk-proof fails to verify against public bounds |
| 4 | Unauthorized change: mutation with no valid authorization reference | ✓ change applied anyway | ✗ authorization_ref fails independent check |
TRUST REQUIRED
TRUST NOT REQUIRED: proof, not the operator's word
The exact threshold never has to be published for this to work. The ledger and the envelope bond turn "trust us" into something a third party can check with math.
Refusal Ledger emits two receipt types under the common usap.v1 envelope. refusal.mutation fires on every policy change. refusal.binding is the zero-knowledge proof that the live value stays in bounds. Both are ML-DSA-65 signed.
// refusal.mutation: fires on every policy configuration change { "type": "refusal.mutation", "usap_version": "usap.v1", "docket": "HC-2026-017", "ledger_seq": 812, "prior_policy_digest": "sha256:...", "new_policy_digest": "sha256:...", "operator_identity": "hive-op-kid-04", "authorization_ref": "change-request:CR-4471", "inclusion_root": "sha256:... // CT-log style, chained", "mutated_at": "2026-07-25T09:14:02Z", "signature": "ML-DSA-65, 3309 bytes" } // refusal.binding: proves runtime value stays inside public bounds { "type": "refusal.binding", "usap_version": "usap.v1", "docket": "HC-2026-017", "envelope_id": "env-cyber-2026-h2", "envelope_bounds_digest": "sha256:... // hash of public [lo, hi]", "policy_value_commitment": "Pedersen(value, blinding_factor)", "zk_proof_digest": "sha256:...", "zk_circuit_id": "refusal-envelope-bond-v1", "ledger_seq_at_read": 812, "checked_at": "2026-07-25T09:14:05Z", "signature": "ML-DSA-65, 3309 bytes" }
The mutation ledger answers "did anything change, and was it authorized." The envelope bond answers "does the current value stay inside the declared range." Neither depends on the other holding.
The policy value is committed, never disclosed in plaintext. The zk-SNARK proves the committed value satisfies lo ≤ value ≤ hi without opening the commitment.
Every mutation's inclusion root chains from the prior root, the same construction used in Certificate Transparency logs. Deletion or reorder breaks the chain deterministically.
Signature: ML-DSA-65 (FIPS 204), constant 3,309 bytes. Bench: sign p50 ~6ms, verify p50 ~2.4ms. Aggregate throughput ~132 signs/sec/type, ~418 verifies/sec/type, single-threaded JS.
Refusal Ledger runs alongside the operator's policy-management system, observing changes rather than gating them, and separately proving the live value at read time.
ledger_seq and chain the inclusion root.refusal.mutation, publicly checkable by anyone with the ledger.[lo, hi].refusal.binding. A verifier needs only the proof and the public bounds, never the value.An inclusion root that doesn't chain from the prior signed root is treated as a break, not a silent gap. Downstream consumers, including Carnac™, can stop on a broken ledger.
Both receipt types verify with just the ledger, the proof, and Hive's public key. No live access to the operator's policy store, no trust in their self-reporting.
Refusal Ledger's signing key is rooted the same way as the rest of the Hive stack: in HiveSeal™. The ledger proves the policy history; HiveSeal proves the signer.
Honesty is the product. Here is exactly where the edges are.
Refusal Ledger does not decide whether a given refusal threshold is safe, appropriate, or too loose. It proves the change was recorded and, separately, that the live value stayed inside the operator's own declared bounds.
The operator sets [lo, hi]. Refusal Ledger cannot force an operator to declare a meaningful envelope in the first place. It can only prove the value stays inside whatever envelope was declared.
The cryptographic core, the ledger, and the zk-circuit are proven against reference workloads. Wiring Refusal Ledger into a live production policy-management system is a pilot-stage integration today.
Refusal Ledger is one of seven upstream primitives filed together on July 26, 2026, all built on the same signer and the same usap.v1 envelope. Each closes a different gap the OpenAI / Hugging Face incident exposed.
| Primitive | What it proves | Axis | When |
|---|---|---|---|
| Refusal Ledger | Every refusal-policy change is on record, and the runtime value falls inside a declared envelope. | Policy / upstream | now (crypto core) policy-system pilot pending |
| PBS: Provenance-Bonded Sandbox | Environment integrity, continuously, from provisioning through every heartbeat. | Environment / upstream | now (crypto core) |
| Howler | An alarm about intent formation fired before the effect emitted, replayable by a third party. | Intent / upstream | now (crypto core) |
| Perimeter Bond | The exact enforcement bytecode intercepting syscalls is bound into every attempt receipt. | Network / upstream | now (crypto core) |
| Diurnal Bond | Consequential actions during off-hours require k-of-n countersigning from a signed risk manifold. | Time / upstream | now (crypto core) |
| Egress Bond | Data leaving the perimeter is metered per semantic class against pre-committed caps. | Egress / upstream | now (crypto core) |
| Forensic Rail | Post-incident analysis is bonded to a k-of-n consortium credential and deterministically replayable. | Forensics / upstream | now (crypto core) |
| Carnac™ | Reads consequence before effect and routes each read to the proof it warrants. | Downstream gate | now |
| HiveSeal™ | Where the signing key lives in silicon: a key-side root. | Key-side root | now |
| AFiR | Attested Fragmented Inference Routing: signed routing of an inference across fragments. | Compute axis | now |
| SiGR | A specific model at a specific config produced a specific output, signed and checkable offline. | Compute axis | now |
Motivating incident for the whole seven-primitive filing: the OpenAI / Hugging Face incident. A refusal threshold moved with no external witness. Refusal Ledger is the layer that would have made the change, and the operator's compliance with its own stated bounds, independently checkable.
We're looking for model operators and safety teams with an existing refusal-policy configuration system to take the crypto core to a live pilot. You bring the policy store. We wire the mutation ledger and the envelope-bond proof into your change path, run the four scenario tests against your real configuration flow, and you walk out with the first policy-change record a regulator, auditor, or the public can check without ever seeing your threshold.
Refusal Ledger. Patent Pending. Proves every refusal-policy configuration change is on record, and that the runtime policy value in force falls inside a pre-declared public envelope, without disclosing the value, signed independently with ML-DSA-65 (FIPS 204), checkable offline. Cryptographic core built and proven: 37 of 37 smoke tests pass across the seven-primitive filing. Filed July 26, 2026. USPTO application 64/119,279. Real policy-system integration is pilot-ready, not yet deployed. We never fake a receipt.