NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs

An audit-grade Run Capsule integrating OpenTelemetry, DSSE/in-toto, and W3C PROV for verifiable agent execution

Mohsen Seyedkazemi Ardebili· 2026· DOI 10.48550/arXiv.2609.12582

The core problem

Autonomous AI agents increasingly perform consequential actions, yet proving what an agent actually did remains an open problem. Existing agent-observability platforms capture traces, but traces are mutable: they can be altered undetected, offer no recipe for re-execution, and remain silent on whether captured secrets were properly removed. Regulatory frameworks—including the EU AI Act, ISO 42001, and NIST AI RMF—presume records that an independent party can check. NovaFabric addresses this gap by producing audit-grade execution evidence that is provider-neutral, tamper-evident, replayable, and shareable. The system records an agent run without modifying agent logic into a portable Run Capsule, a fifteen-entity schema sealed with a holistic DSSE signature, RFC 3161 timestamp, Merkle log, and redaction attestation. Sealed runs are re-executable under a four-mode replay protocol and exportable as an Evidence Bundle for third-party verification with stock tooling. The contribution is explicitly integration, not new cryptography, combining OpenTelemetry, DSSE/in-toto, and W3C PROV. The work evaluates eight research questions at measured scope, finding that mocked replay serves every mo

Innovation

Evaluation of NovaFabric across eight research questions yields mixed results. Mocked replay successfully serves every model response from the capsule without live model calls, achieving 10/10 on model-response substitution. However, mocked replay is offline with respect to models, not the network, and only 2/10 tool-using workloads completed; the gap is attributed to missing tool-response substitution. Tampering is rejected across all three tested classes, demonstrating the sealing mechanism's integrity. Declared-stream completeness is 0.652 with a 95% confidence interval of \pm0.064 across ten scenarios, indicating that a substantial portion of the declared stream is not captured. A repaired rule pack redacts 14/14 credential types while preserving 9/9 decoys, and diff localisation identifies 140/140 mutations. Blast-radius queries achieve 45.5ms p99 over 10M edges, 3.3\times faster than a columnar baseline, and 167.9ms over 100M edges with one client and n=30. A 314-machine, ten-region run finds capsule REST ingest lossless but capped at 61.6 req/s with p99 latency of 26.8s due to per-worker serialisation. Six defects were found in NovaFabric and its evaluation corpus: four fixed, one

NovaFabric constructs a Run Capsule by instrumenting an agent run through OpenTelemetry, capturing spans and events without altering agent logic. The capsule schema comprises fifteen entities that encode the execution graph, model interactions, tool calls, and metadata. Sealing applies a holistic DSSE signature over the capsule, an RFC 3161 timestamp from a trusted authority, a Merkle log for append-only integrity, and a redaction attestation that records which secrets were removed. The replay protocol defines four modes: mocked replay, which serves every model response from the capsule without live model calls; and three additional modes that progressively reintroduce live components. The Evidence Bundle is a portable export containing the sealed capsule and verification metadata, designed for third-party checking with stock tooling. The evaluation addresses eight research questions across tamper resistance, replay fidelity, redaction completeness, query performance, and distributed ingest. Tamper tests cover three classes of modification. Redaction is evaluated with a rule pack tested against 14 credential types and 9 decoys. Blast-radius queries are benchmarked over graphs of 10M and 100M edges. A distributed run spans 314 machines across ten regions to measure REST ingest throughput and loss. The trusted computing base is explicitly stated as a condition for verification. Formally, the sealing operation can be represented as:

Why it matters

The results position NovaFabric as a promising but incomplete solution for audit-grade agent evidence. The strong tamper rejection and perfect redaction of credential types with preserved decoys demonstrate that the sealing and redaction mechanisms work as intended. The diff localisation of all 140 mutations further supports the integrity guarantees. However, the low declared-stream completeness of 0.652 reveals that a significant fraction of declared events are not captured, which undermines the evidentiary value of the capsule. The tool-using workload gap—only 2/10 completed—is critical because many consequential agent actions involve tools. The missing tool-response substitution means that mocked replay cannot fully re-execute tool-using runs, limiting replayability. The distributed ingest cap of 61.6 req/s due to per-worker serialisation suggests that scaling to high-throughput agent fleets will require architectural changes, such as parallelising serialisation or sharding. The blast-radius query performance is strong, with 3.3× speedup over a columnar baseline at 10M edges, but the 100M-edge latency of 167.9ms may be acceptable for interactive queries. The six defects found, with four fixed, one withdrawn, and one open, indicate active maintenance but also that the evaluation corpus itself had issues. The conditional verification on a trusted computing base means that the security guarantees are only as strong as the TCB. The contribution is integration, not new cryptography, so the novelty lies in combining existing standards into a coherent evidence pipeline. Future work should address tool-response substitution, improve declared-stream completeness, and scale ingest. The overall implication is that tamper-evident, replayable evidence for autonomous agents is feasible but requires careful attention to tool interactions and distributed performance. The replay protocol's four modes can be represented as:This state diagram illustrates the progression from fully mocked to fully live replay, with each mode adding a live component while retaining the capsule as the source of truth for sealed components.

Who should read this

CS practitioners and researchers

Opening member content…