SCENE 01 / 21
THE UNSIGNED HANDOFF PROBLEM
Every AI agent handoff today is unsigned.
LangChain, CrewAI, AutoGPT, Microsoft Autogen, Google Vertex, Amazon Bedrock — none provide cryptographic proof that Agent B received what Agent A actually sent.
A compromised relay can inject, tamper, or replay. No agent framework detects it.
WHY NOBODY BUILT THIS BEFORE
"Why didn't LangChain just add signatures?"
Three reasons. Each one is a wall.
WALL 1: FHE + SIGNING
FHE produces encrypted results. Post-quantum signatures operate on plaintext. You can't sign inside FHE — SHAKE-256 requires bitwise ops incompatible with BFV polynomial arithmetic. Computationally impossible at production parameters.
WALL 2: DECRYPT = EXPOSE
Decrypting to sign exposes plaintext and negates FHE's zero-exposure guarantee. Every breach exploits a plaintext window. Adding signatures by decrypting creates the vulnerability you're trying to prevent.
WALL 3: TEE ≠ TRUST
Trusted execution environments introduce hardware assumptions. Intel SGX has been broken multiple times (Foreshadow, Plundervolt, SGAXe). TEE protection is not cryptographically unconditional. H33-74's security doesn't depend on TEE integrity.
H33-74 solves this: a deterministic commitment that binds encrypted computation to post-quantum signatures without decryption. That's the primitive nobody had.
SCENE 02 / 21
H33-AGENT-74
74 bytes. Three PQ families. Every handoff.
Each agent handoff produces a 58-byte H33-74 primitive signed under ML-DSA-65 (FIPS 204), FALCON-512 (integer-only, Draft FIPS 206), and SLH-DSA-SHA2-128f (FIPS 205). Three independent hardness assumptions. Persistent footprint: 74 bytes. Verification: 377 microseconds.
let s_a = H3374::new(DataImport, data, now())?;
let signed_a = agent_a.sign_three_key(&s_a);
assert!(verify(&signed_a, a_keys));
let s_b = H3374::new(AiInference, result, now())?;
assert!(verify(&signed_b, b_keys));
let s_c = H3374::new(ArchiveSign, delivery, now())?;
SCENE 03 / 21
CAPABILITY 1 — LINEAR DELEGATION
A → B → C → ... → N. No limit.
AGENTSCHAIN TIMEPER AGENT
35.5 ms1,820 µs
1016.9 ms1,688 µs
5085.7 ms1,713 µs
100173 ms1,730 µs
AGENTSPQ SIGSPERSISTENT
39222 B
1030740 B
501503.7 KB
1003007.4 KB
Per-agent cost is flat at ~1,700µs. Zero degradation at any depth.
SCENE 04 / 21
CAPABILITY 2 — FAN-OUT
One parent. N children. Full provenance.
Agent A distributes work. B, C, D each get independent attestations referencing A's signing message. Parallel processing with cryptographic lineage.
PROVEN: 1→3 fan-out, all branches verified independently
SCENE 05 / 21
CAPABILITY 3 — DAG MERGE
N parents → 1 child. Both verified.
The merge node verifies ALL parent attestations before producing its output. References every parent's signing message in its payload.
PROVEN: 2→1 merge, both parents verified
SCENE 06 / 21
CAPABILITY 4 — DIAMOND TOPOLOGY
A → (B, C) → D. Branch and reconverge.
The most common real-world agent topology. End-to-end verified in one pass.
PROVEN: 4-agent diamond, end-to-end verified
SCENE 07 / 21
CAPABILITY 5 — REVOCATION MID-CHAIN
Agent B is compromised.
AGENT A
StatusValid — not on revocation list
Crypto checkPASS
Policy checkPASS
Chain continuesYes
AGENT B
Crypto checkPASS
Policy checkREVOKED
Chain continuesHALTED
Upstream attestations are unaffected. Downstream agents refuse the compromised output.
PROVEN: compromised agent halted, valid agents preserved
SCENE 08 / 21
CAPABILITY 6 — KEY ROTATION
Old keys verify old attestations. New keys verify new.
SCENARIORESULT
v1 signed → v1 keysPASS
v2 signed → v2 keysPASS
v1 signed → v2 keysREJECTED
v2 signed → v1 keysREJECTED
No flag-day cutover. No deployed-binary reissuance.
SCENE 09 / 21
CAPABILITY 7 — THRESHOLD DELEGATION
2-of-3 quorum. The chain advances only if consensus is met.
Three agents vote. The aggregator verifies each vote independently. Only advances if the threshold is met. References all valid votes in its output.
PROVEN: quorum enforced, partial rejected
SCENE 10 / 21
CAPABILITY 8 — TYPE-BYTE ROUTING
Byte [1] tells the router where to send it.
TYPE BYTEDOMAINHANDLER
0x06Medical (PHI)medical_handler
0x03Financial (FedNow)financial_handler
0x09Legal (Archive)archive_handler
0x0DAI Inferenceai_inference_handler
Cross-domain replay is cryptographically impossible. The type byte is mixed into the hash.
SCENE 11 / 21
CAPABILITY 9 — REPLAY PREVENTION
Reject stale attestations. Timestamp is in the primitive.
The timestamp field at bytes [34..42] is a 64-bit millisecond Unix timestamp. Any agent can enforce a maximum age policy. Stale outputs are rejected before verification.
PROVEN: stale rejected, fresh accepted
SCENE 12 / 21
CAPABILITY 10 — MUTUAL AUTH
Both agents verify each other before exchanging data.
Agent A attests a challenge. Agent B verifies, attests a response referencing A's challenge. A verifies B. Mutual authentication established. Impersonators rejected by both sides.
PROVEN: mutual auth, impersonation rejected
SCENE 13 / 21
CAPABILITY 11 — FULL DAG
Branch + converge + threshold + time-bound. All at once.
6 agents. 18 PQ signatures. Every constraint enforced simultaneously. This is not a toy — it's the production topology.
PROVEN: 6 agents, 18 PQ sigs, all constraints pass
SCENE 14 / 21
ATTACK SIMULATION
Flip one bit. The chain breaks.
Modify one byte anywhere in Agent B's 58-byte primitive. The signing message changes. Verification fails. The tamper is detected instantly.
Cross-agent injection — verifying Agent A's signature under Agent B's keys — is also rejected. Three independent keypairs per agent.
PERMANENT AUDIT TRAIL
Every chain. Anchored to Bitcoin. Forever.
Every attestation's 32-byte signing message can be committed to the Bitcoin blockchain via Taproot key-path tweak (zero marginal weight) or OP_RETURN. No soft fork. No new opcodes. Standard transaction.
PROPERTYVALUE
On-chain cost32 bytes (Taproot: 0 marginal weight)
Batch anchoringN attestations under 1 Merkle root
ImmutabilityBitcoin's 15-year adversarial track record
VerificationAny Bitcoin full node, worldwide
First mainnet anchorApril 14, 2026 — tx 7f8d9ef2...b028b4a7
A 10-agent chain produces 10 signing messages. Merkle-aggregate into one root. One Bitcoin transaction. Ten agents. Permanent provenance.
THE FULL STACK
Encrypted computation. Attested without decryption.
H33-Agent-74 + H33's FHE engines = the only end-to-end stack where AI agents compute on encrypted data and every handoff is post-quantum attested without ever exposing plaintext.
WHAT COMPETITORS COULD ADD
Signatures on handoffsYes (classical)
Post-quantum signaturesMaybe (single family)
Three-family PQHard
FHE underneathNo
H33 FULL STACK
FHE computation (BFV/CKKS)Built
Three-family PQ attestationBuilt
Agent delegation chainsBuilt (11 capabilities)
Bitcoin anchoringBuilt (mainnet verified)
Attest encrypted output without decryptionOnly H33
Nobody else has the FHE layer underneath. That's the moat.
SCENE 15 / 21
PERFORMANCE
2,556 tests passing. Zero structural limits.
PROPERTYVALUE
Capabilities11 (all proven)
Max chain tested100 agents
Per-hop cost~1,700 µs
Per-verify cost~377 µs
PQ sigs per handoff3
Persistent per agent74 bytes
Chain depth limitNone
H33-74 primitive tests (whitepaper)118 passing
Full scif-backend tests2,556 passing
SCENE 16 / 21
SDK SURFACES
Rust. Python. Go. REST. TypeScript.
RUST CRATE
RolePrimary
IntegrationNative
PerformanceZero-copy
PYTHON (PYO3)
RoleML pipelines
Integrationpip install
PerformanceRust sidecar
GO (GRPC)
RoleMicroservices
Integrationgo get
PerformancegRPC native
REST API
RoleUniversal
IntegrationHTTP/JSON
PerformanceSub-ms verify
TYPESCRIPT
RoleBrowser / Node
Integrationnpm install
PerformanceRust sidecar
SCENE 17 / 21
PRICING
$0.001 per attestation. Each handoff is one mint.
PIPELINEMINTSCOST
3-agent chain3$0.075
10-worker fan-out + merge12$0.30
50-agent pipeline50$1.25
100-agent pipeline100$2.50
Free tier: 10,000 attestations/month. No credit card.
POST-QUANTUM AI AGENT INFRASTRUCTURE
H33-Agent-74
11 capabilities. 100+ agent chains. 1.7ms per handoff. Every handoff post-quantum. Encrypted computation attested without decryption.
Whitepaper: h33.ai/h33-74/whitepaper/ · Live Demo: h33.ai/demos/ai-agents/
Eric Beans · H33.ai, Inc. · support@h33.ai · April 2026
H33-AGENT-74