One incident, three descents: behavior, evidence, necessity. Every artifact on this page is reproducible by running the demo yourself.
First time here? About orients; Incident is the same event in postmortem form for ops/SRE readers; the vocabulary below covers what you’ll need to follow this descent.
agent_governor at 485e557, installed editable into a scratch
virtualenv. Exit 0; the demo’s own integrity tripwire fails loudly if it passes for the
wrong reason. Blocks are labelled captured run where they
are literal bytes and schematic where they are designed
to teach.agent_governor — the classic Python implementation this
demo runs on — was dispositioned legacy / historical, maintained on 2026-07-26.
New authority work lives in AG ng; governed
execution lives in Docket. The refusal below
still runs and still means what it says; it is not the current authority implementation. See the
status ledger.
standing)horizon)seamBoth runs traverse the identical chain of checks — permission verified, intent admitted, the action-time check evaluated against freshness. They differ only in when the action happens. A system that only says no is a brick; the twin is the proof it isn’t one.
standing verified wicket admitted spendability judged LA grant granted LA consume effect leaf receipt ag_rcpt_2f8d461bc9bdf930 → consumed. Fresh standing spent cleanly (effect_count=1).
standing verified ← the credential WAS valid wicket admitted ← naive auth says yes here spendability REFUSED standing_before_spendability_not_bounded gap=11s vs bound=10s → over by 1s gap_basis: monotonic, source=process_monotonic epoch=boot:demo-single-host (sound: one source, one epoch) wall 2026-06-09T00:00:40Z [display_only, uncertainty=None] — display only, NOT the gap basis leaf receipt ag_rcpt_3f8b93c149d02bbe → refused. No capacity spent (effect_count=0). The standing was checked — it lapsed in the gap between observation and exercise, and the gap was computed over compatible monotonic witnesses (provably sound).
captured runBoth blocks above are literal stdout from ./demo/refused-spend.sh, 2026-07-29, leading indentation stripped.
One second after expiry, and custody is the only layer that saw it.
renderedA readable view of the machine artifact below, which is the literal --evidence output. effect_count is read from the run rather than from this receipt; the raw bytes are one expand away and nothing here alters their meaning.
governor receipts --id 3f8b93c1… --evidence, 2026-07-29){
"receipt_id": "3f8b93c149d02bbeb87c71ddb33bea19af17b6fc162c81495d30498660db81fc",
"schema_version": 4,
"timestamp": "2026-07-29T18:06:29.472827+00:00",
"gate": "standing_spendability_seam",
"verdict": "block",
"subject_hash": "1c5ba48d123bdda15d524e34e4622aaa29f239a72ce692508204f8e89219655c",
"evidence_hash": "b4b6f0628d90588c0b6407f45571c8a3b51b1c539b396f39fc7880f1f81a7404",
"policy_hash": "e5e8b0eaefae2352489ecb2a7c3a9c6ebc51966eec5ddd4e38ee18f143e26b74",
"principal_id": "local",
"tenant_id": "default",
"auth_method": "none",
"receipt_role": "measurement",
"unsettled": [],
"evidence": {
"bound_ns": 10000000000,
"bounded": false,
"freshness_subcase": "expired",
"gap_basis": {
"end_ns": 51000000000,
"epoch": "boot:demo-single-host",
"kind": "monotonic",
"source": "process_monotonic",
"start_ns": 40000000000
},
"gap_ns": 11000000000,
"lapse_coverage": "exceeded_horizon",
"origin_mode": "drill",
"overage_ns": 1000000000,
"parent_receipt_ids": [
"7732103275259ded364078e0a7241884c618ee5107d6f241ea9dff4c871dc5fe"
],
"refusal_kind": "standing_before_spendability_not_bounded",
"wall": {
"observed_at": "2026-06-09T00:00:40Z",
"role": "display_only",
"source": "system_clock_unsynced",
"uncertainty_ms": null
}
}
}
dda5a1e5… and told you
the demo would reproduce it. It no longer does. The receipt is content-addressed over the
canonical decision inputs, and the schema gained fields — principal_id,
tenant_id, auth_method, unsettled,
freshness_subcase — so evidence_hash moved and the id moved with it.
Determinism held: the same inputs under the same schema still give the same id, and the twin
ag_rcpt_2f8d461bc9bdf930 never moved at all. But an id pinned in prose is a claim about
a schema version, not about behaviour, and it drifted here first. The behaviour is what this page
is for; the id is how you find the artifact on your own disk.
Interrogate the same incident. The custody chain reconstructs from receipts — evidence, not logs.
What happened to the spend?
The missing upstream receipt is intentional in this specimen: absence is reported as absence, not inferred away.
$ governor why 3f8b93c149d02bbe…
——————————
DRILL chain origin: 'drill' (NQ-side mint provenance — receipt does NOT carry an observed-condition witness)
——————————
REFUSED standing_before_spendability_not_bounded gate=standing_spendability_seam id=3f8b93c149d0...
OK verdict=pass gate=wicket_seam id=773210327525...
OK verdict=pass gate=standing_seam id=450d1472130e...
MISSING no receipt found for cited id nq_fnd_drill_wal_bloat_all_green
! no receipt found for cited parent nq_fnd_drill_wal_bloat_all_green; chain terminates at this gap
✓ chain walks refusal → admission → standing → honest MISSING terminus
captured runLiteral, with per-receipt timestamps elided for width. The DRILL banner is the tool’s own: this chain carries no observed-condition witness, and it says so before it says anything else.
Which predicate failed?
$ governor receipts --id 3f8b93c149d02bbe… --evidence gap_ns = 11000000000 bound_ns = 10000000000 overage_ns = 1000000000
✓ gap exceeded bound by exactly the lapse
schematicThree fields lifted from the JSON above for legibility. The command returns the whole document, not this three-line summary.
Stale under which clock witness?
"gap_basis": { "kind": "monotonic", "source": "process_monotonic",
"epoch": "boot:demo-single-host", "start_ns": 40…, "end_ns": 51… }
"wall": { "observed_at": "2026-06-09T00:00:40Z", "role": "display_only" }
✓ the gap ran on a named monotonic basis; wall time is display-only. A gap is a difference between compatible clock witnesses, not numbers.
And a receipt that doesn't exist?
$ governor why 0000000000000000… —————————— receipt id not found: 0000000000000000… $ echo $? 1
✓ honest absence — not found, never inferred, and it exits non-zero
The policy is not the villain. It is right, for the world it is handed — and nothing attests the world it is handed.
default allow := false
allow if {
input.credential.status == "valid"
input.credential.role == "operator"
input.action == "consume_capacity"
}
The input document asserts status: "valid" — unwitnessed self-report in a structured costume. Nothing in it says when that was true.
And when the policy engine does run, its verdict enters the evidence plane — policy hash, input hash, input provenance (unwitnessed_self_report), decision — a receipt, not a line in a decision log. The demo ships this as a runnable shim: ./demo/opa-contrast.sh. If the opa binary is present the policy is evaluated live; if it is not, the shim says so plainly and never fabricates a verdict.
citedThe eight lines above are the policy the shim actually ships, verbatim — src/governor/demo_opa_contrast.py.
Policy engines decide over claims; custody systems decide whether those claims may become premises.
refusal class standing_before_spendability_not_bounded
licensed by Admissibility.Freshness.expired_not_fresh
An observation whose exercise time is past its expiry is not Fresh. The receipt's gap_ns > bound_ns is definitionally the theorem's hypothesis — this refusal is the one the kernel licenses, not a discretionary policy denial.
Reading Lean isn't required for what this is doing — the signature is here so the claim is checkable, not so you have to check it.
What this proves and what it doesn’t: the theorem proves the class boundary; the receipt proves the instance facts; the link is the artifact. It does not assert that any deployed system is safe, nor that this instance was machine-checked — only that this refusal class is the one the custody discipline requires.
From a clone to this refusal, about five minutes:
git clone https://github.com/unpingable/agent_governor.git cd agent_governor
python3 -m venv .venv . .venv/bin/activate pip install -e . ./demo/refused-spend.sh # a valid credential, acted on one second after expiry — REFUSED, with receipts ./demo/interrogate.sh # "just one more thing": six questions, answered from receipts (no arg = fresh Act 1; or pass the root Act 1 printed) ./demo/opa-contrast.sh # what a policy engine would have said about the same incident (allow)
The demo’s exit code is the claim: 0 only if the impostor was refused for the right reason — the temporal lapse, spending no capacity — and not by a short-circuit. It fails loudly if it passes for the wrong reason. Expect the refusal receipt id 3f8b93c1… and the legitimate twin ag_rcpt_2f8d461bc9bdf930 while the receipt schema stays at version 4; the ids are how you find the artifacts on your disk, not the thing being claimed.
"Isn't this just OPA / admission control?" — Policy decides over premises; this receipts whether the claims were allowed to become premises in the first place. Rego can check freshness if you feed it freshness; it cannot establish the custody of its own inputs. OPA runs happily inside this.
"Isn't this AI-governance vapor?" — It's a refusal you can run, a receipt you can hash, and a theorem you can read. Every claim on this page reproduces from a cold clone; where the system can't prove something, the page says so (see Limits).