What is Proof-Carrying Agent Execution (PCAE)?

Inspired by George Necula's Proof-Carrying Code, PCAE attaches a deterministic 7-gate verification audit and RFC 6962 SHA-256 Merkle certificate to every autonomous pull request or tool run before human review or merge.

How does selective disclosure protect private prompts and source diffs?

NexusAegis hashes input digests, gates G1 through G7, and output digests with 0x00 leaf domain separation. Auditors receive only 4 sibling hashes (O(log N)) to prove a single gate such as G5_ANTI_REWARD_HACK passed against the signed Merkle root.

Why use RFC 6962 domain separation bytes 0x00 and 0x01?

Prefixing leaves with 0x00 and internal nodes with 0x01 prevents second-preimage structural collision attacks where two concatenated child digests masquerade as a 64-byte leaf.

Cryptographic proofs for every agent PR.

Execute 7 deterministic safety gates and mint an RFC 6962 SHA-256 Merkle certificate in 0.254 ms P50 — with zero core dependencies.

pip install -e . && nexus-aegis demo

Open Studio ->

## NexusAegis Proof-Carrying Agent Execution (PCAE) Certificate
VERDICT: PASSED | RFC 6962 Root: 9524c6dcd0ed055b7aece7e7... | Latency: 0.348 ms

Gate ID               | Stack Component           | Verdict | Leaf Hash (0x00)
G1_SECURITY           | codesphere-u/agentshield  | PASS    | 03cc710e70600146...
G2_BUDGET_ROUTING     | codesphere-u/synapse-rtr  | PASS    | e03a5add74b9c683...
G3_SWARM_LEASES       | codesphere-u/swarmweaver  | PASS    | 3250a92db97646f3...
G4_TRAJECTORY_HEALTH  | codesphere-u/agentflight  | PASS    | 89badc61c58acf57...
G5_ANTI_REWARD_HACK   | codesphere-u/patchpilot   | PASS    | d24d94e65bec8c98...
G6_TRUTH_GROUNDING    | codesphere-u/truthgate    | PASS    | d1926fac5ca6eb39...
G7_TEMPORAL_MEMORY    | codesphere-u/cortex-mcp   | PASS    | 0332a571c9ef9179...

Verify all 7 gates or simulate selective-disclosure proofs in browser

Open PCAE Studio Read Benchmark

Seven deterministic gates.

SevenGatePipeline checks security injections, USD caps, swarm file leases, tool loops, Python AST reward-hacking, grounding, and stale memory with zero LLM judges.

RFC 6962 Merkle roots.

MerkleTreeEngine prefixes leaves with 0x00 and internal nodes with 0x01 so attackers cannot forge second-preimage structural collisions.

Selective disclosure proofs.

Prove a single gate verdict such as G5_ANTI_REWARD_HACK in O(log N) (4 sibling hashes) without revealing private prompts or source diffs.

Drop-in CI & MCP cards.

Emit signed GitHub Pull Request Markdown cards via render_pr_attestation_markdown, Stdio MCP, or the Streamable HTTP/SSE portal.

Capstone of the 8-engine stack

NexusAegis unifies seven verification primitives into one signed attestation bundle and selective-disclosure protocol.

AgentShield

Synapse

SwarmWeaver

AgentFlight

PatchPilot

TruthGate

Cortex-MCP

Try live attestation in Studio or inspect 35-scenario results and CLI/MCP docs.

Frequently asked questions

Cryptographic guarantees behind Proof-Carrying Agent Execution (PCAE).

How fast does the full 7-gate + Merkle attestation run?

Across the 35-scenario benchmark suite, end-to-end 7-gate evaluation plus RFC 6962 Merkle tree construction executes in 0.2542 ms P50 and 0.5229 ms P95 in pure Python.

Can external CI runners verify a gate without seeing proprietary prompts?

Yes. nexus-aegis attest --disclose-gate G5_ANTI_REWARD_HACK outputs a redacted proof containing only the canonical gate verdict, 0x00 leaf digest, 4 sibling hashes, and the signed Merkle root.

Does tampering with a proof fail offline verification?

In benchmark testing across 245 inclusion proofs and 245 1-bit sibling mutations, verify_merkle_inclusion_proof achieved 100.00% valid proof verification and 100.00% tamper rejection.