VERIFICATION & GOVERNANCE POSTURE

Verification & Governance Posture

AegisAI does not ask operators to trust model output. It converts proposals into deterministic policy adjudication and verifiable execution records. In adapter mode, the demo now exercises the real aegisai.core.Kernel with Ed25519 Class A attestation on every trace.

DEFINITIONS

DECISIONTRACE

The core execution record produced by every Kernel adjudication. Contains session_id, trace_id (UUID), custody_hash (SHA-256), decision_outcome, audit_log, and timestamp. Always present — not an optional artifact.

ATTESTATION (CLASS A)

An Ed25519-signed wrapper around a finalized DecisionTrace. Produced only when the Kernel is initialised with a signing key. This is the externally verifiable governance artifact. Absence of attestation is not governance proof.

SECURITY FAILURE

A scenario where a HIGH-severity policy should have produced BLOCK, but the kernel allowed the action to proceed. Primary safety metric. Benchmark gate exits 1 if security_failures > 0.

FALSE BLOCK

A scenario where the expected outcome was ALLOW, but policy produced BLOCK. Not a safety failure — a policy strictness trade-off. Tunable via the policy bundle.

BENCHMARK ARTIFACT

An aggregate result over a defined canonical scenario set. Shows scenario-set consistency under the current fixture set. Not a universal safety certification.

ENFORCEMENT GUARANTEES

Policy is evaluated before any action is dispatched — no exceptions.
Model output is parsed and schema-validated before reaching the Kernel. It is never executed directly.
A DecisionTrace is always produced — not optional, not conditional.
Panic mode provides a hard stop across all transitions, with no reasoning path around it.
Break-glass (BypassApproval) requires an Ed25519 signature, is one-time, and has replay protection.
Escalation path (REQUIRE_CONFIRM) is explicit: the Kernel blocks until authorized acknowledgment.

DEMO ASSURANCE POSTURE (PHASE E2)

REPLAY LANEdemo-replay
  • →Bounded scenario registry — 7 adversarial scenarios
  • →artifact_class: demo-replay — honest separation from core traces
  • →demo_trace_ref is a display reference only, not a custody hash
  • →Decision outcome (BLOCK/ALLOW) generated server-side by Cloudflare Worker
GEMINI ADAPTER LANEcore-backed
  • →Routes to standalone Python backend (Render) running real aegisai.core.Kernel
  • →GeminiLLMAdapter generates a structured ProposalSpec via Gemini API
  • →Strict tool_id allowlist enforced — non-allowlist proposals rejected before Kernel
  • →artifact_class: core-backed — real DecisionTrace, real custody_hash (SHA-256)
  • →Ed25519 Class A attestation present on every response (aegis-demo-key-e1)
  • →source: gemini on every ProposalInfo — identifies the real upstream generator
  • →Gemini proposes. Kernel decides. No LLM execution authority.

EXPLICIT LIMITS

!
BENCHMARK SCOPE

The benchmark artifact reflects consistency under the current canonical fixture set (7 scenarios). It does not constitute a universal safety proof or regulatory certification.

!
ATTESTATION REQUIREMENT

Absence of a Class A attestation means the DecisionTrace has not been externally signed. The trace exists, but external verifiability requires the signing key to be configured.

!
DEMO ISOLATION

Replay lane: bounded scenario registry — no core Kernel call. Adapter lane: routes to real aegisai.core.Kernel on Render under controlled conditions. Neither lane executes unrestricted production actions or provides access to real customer data.

!
MUTABLE POINTERS

benchmark_latest.json is updated on every run. For stable evidence references, use the immutable benchmark_run_{id}.json artifact.

VERIFICATION POSTURE

The following machine-enforced checks run on every commit to main:

CI
Benchmark gate
python3 scripts/run_benchmark.py — exits 1 if security_failures > 0
CI
Schema parity check
All benchmark fixtures validated against benchmark_case_schema.json
CI
Kernel contract tests
18 tests pinning the public API: return type, trace_id UUID, custody_hash SHA-256, session_id match, no-raise invariant, BLOCK enforcement
CI
Crypto vector verification
python3 scripts/verify_crypto_vectors.py — deterministic Ed25519 vector suite
CI
E2E mock trace
python3 scripts/generate_llm_trace.py --mode mock — full path from adapter to DecisionTrace
CI
Red-team security suite
Adversarial scenarios: prompt injection, bypass attempts, panic mode activation
SUITE
185 passing tests
Unit, security, integration, and contract tests. Zero collection errors.

REGULATORY SUPPORT

AegisAI is designed to support record-keeping, oversight, and auditability requirements in regulated deployments. It is not certified against any standard.

WHAT AEGISAI SUPPORTS

  • ✓EU AI Act — Article 12 (Record-keeping): per-decision immutable records
  • ✓EU AI Act — Article 14 (Human Oversight): REQUIRE_CONFIRM enforces escalation
  • ✓SOC 2 Type II alignment: audit trails, least-privilege action dispatch

WHAT AEGISAI DOES NOT PROVIDE

  • ✕Certification against any regulatory standard
  • ✕Compliance attestation or legal audit opinion
  • ✕Guarantee of regulatory acceptance in any jurisdiction
View Evidence Artifacts →Read Architecture →Security Model →