The original human instruction, held outside the chain as a content-addressed object. Every action is verified against it — never against a recalled summary.

Every delegation creates a cryptographic record. Drift gets timestamped to the exact hop that introduced it.

The agent operates on encrypted inputs, encrypted state, encrypted outputs. Plaintext is never visible to the runtime.

Credentials are intercepted before they can be pasted into a delegate. Each use produces a signed receipt bound to the human who authorized it.

Inference runs against fully encrypted state. Privacy is a property of the computation, not a permission.

Bounded authority evaluation, substrate-signed escalation routing, signed dispositions. Every approval and denial is a cryptographic event.

Five zero-knowledge proof streams check every artifact in under 100 microseconds before it can execute. Prevention, not detection.