Research

XATF: A Carrier-Binding Verification Profile with Typed Failure Attribution for AI-Agent Evidence over X-Road

Anton Sokolov · Published — IEEE Access, vol. 14, pp. 143470–143483 (2026) · September 2026

A successful carrier exchange is not proof of agent authority. XATF separates three states that a carrier alone conflates — carrier acceptance, carrier/evidence binding, and Action Evidence Package (AEP) appraisal — so that a request with valid signatures still fails when its X-Road request identifier does not bind to the carrier record. Against a signature-only baseline that accepts 11 strict-negative cases over the same packages, XATF rejects all of them, including that carrier-binding mismatch.

A systems and security-engineering article asking which carrier fields, evidence claims, and verifier invariants are needed to bind agent-specific evidence to an X-Road exchange without making X-Road the AI-agent verifier itself. The contribution is XATF, an executable carrier-binding verification profile with typed failure attribution: Algorithm 1 evaluates carrier acceptance, carrier/evidence binding, and AEP appraisal under an ordered invariant taxonomy (transport, schema, canonicalization, cryptographic integrity, crypto-policy, key status, policy integrity, toolchain integrity, carrier binding, freshness, replay, and agent policy). The evaluation combines a real public X-Road development-stack exchange across two Security Server containers, a 10-request carrier matrix, a signed seven-case corpus with Python/Node verifier parity, and an 18-case strict-profile red-test run (18/18 expected outcomes and 18/18 expected attributions in both Python and Node). A signature-only baseline accepts 11 strict-negative cases that XATF rejects. Footprint and timing are reported (hash-only 289 B, URI-plus-hash 352 B, full-AEP base64 23,360 B; accept-path median 18.296 ms, reject-path median 18.316 ms). X-Road stays the outer PKI-backed carrier and audit witness while AEP supplies agent identity, delegation, policy, runtime, freshness, revocation, and cryptographic evidence, aligned with RATS, EAT, and COSE. Published in IEEE Access in September 2026, open access; reproducibility package on Zenodo, DOI 10.5281/zenodo.20613101.

doi:10.1109/ACCESS.2026.3732535 → concept DOI: 10.5281/zenodo.20468482 publication note →

@article{sokolov2026xatf,
  author       = {Sokolov, Anton},
  title        = {{XATF}: A Carrier-Binding Verification Profile With Typed Failure Attribution for {AI}-Agent Evidence Over {X-Road}},
  journal      = {IEEE Access},
  volume       = {14},
  pages        = {143470--143483},
  year         = {2026},
  doi          = {10.1109/ACCESS.2026.3732535},
  note         = {Open access, CC BY 4.0; reproducibility package DOI 10.5281/zenodo.20613101}
}

Composing Application-Layer Action Evidence with Remote Attestation Procedures

Anton Sokolov · IETF I-D rev 06 + magazine companion published (IEEE Internet Computing, early access) · June–September 2026

↳ extends: EATF / Action Evidence Package; composes-with: IETF RATS (RFC 9334)

An AI agent's signed, append-only Action Evidence Package (AEP) — what it did, under whose authority, and with what outcome — is a self-report: the witness is also the suspect. Treating the AEP as application-layer Evidence and binding it to hardware platform Evidence under IETF RATS (RFC 9334), conveyed via EAT (RFC 9711) or a CMW and appraised by a Verifier such as the open-source Veraison, lets a single appraisal speak to both what the agent did and the platform it did it on. An emulated software-TPM (swtpm) feasibility check folds a hash of the AEP outcome plus a fresh nonce into an attestation-key-signed quote and resolves the good / measurement-mismatch / stale cases while rejecting a forged outcome bound to a valid quote.

Proposes a composition pattern in which an AI agent's Action Evidence Package (AEP) is carried as application-layer Evidence over IETF RATS conveyance (an EAT or a CMW) and appraised alongside hardware platform Evidence, with results aligned to the AR4SI and EAR Internet-Drafts. The aim is to attest not just the machine but that the agent's governance controls actually ran, anchored to a root of trust the agent cannot forge — composing with hardware attestation rather than competing with it. A deliberately modest feasibility check on an emulated software TPM (swtpm) demonstrates the binding mechanics. The IETF document is an individual submission, not a working-group document and not adopted by the RATS WG. The practitioner-facing magazine companion, “When the Witness Is Also the Suspect”, is published as an early-access article in IEEE Internet Computing (DOI 10.1109/MIC.2026.3734398).

doi:10.5281/zenodo.20818672 → publication note →

@article{sokolov2026witnesssuspect,
  author       = {Sokolov, Anton},
  title        = {When the Witness Is Also the Suspect: The Case for Hardware-Rooting the Evidence That {AI} Agents Leave Behind},
  journal      = {IEEE Internet Computing},
  year         = {2026},
  note         = {Early access},
  doi          = {10.1109/MIC.2026.3734398}
}

@misc{sokolov2026aepratscomposition,
  author       = {Sokolov, Anton},
  title        = {Composing Application-Layer Action Evidence with Remote Attestation Procedures},
  howpublished = {IETF Internet-Draft draft-sokolov-rats-aep-composition-06 (individual submission)},
  year         = {2026},
  month        = aug,
  note         = {Preprint Zenodo DOI 10.5281/zenodo.20818672}
}

Agent-access receipts for artificial intelligence-mediated content and application programming interface access: a reproducible synthetic security experiment

Anton Sokolov · Published — Frontiers in Computer Science, vol. 8, article 1900546 (2026) · September 2026

↳ applies: the Action Evidence Package idea to access decisions at a publisher's edge; companion-of: “Cryptographic Attestation for AI Agent…”

A bare allow-or-block verdict at the publisher's edge loses the bindings a disputed access decision later turns on: the caller's identity, the principal it represents, the delegated authority, the declared purpose, the resource, the policy snapshot, the response sensitivity and the payment or licensing state. An agent-access receipt is a compact decision record that preserves those bindings for later inspection, and the synthetic laboratory shows that every scenario and mutation case matches its expected outcome while all 30 receipts pass the schema guard.

Publishers increasingly treat AI agents that fetch content or call APIs on a user's behalf as a bot-management problem: identify the automated caller and allow, block, delay, challenge or meter it. The article argues that the framing is useful but incomplete, and implements an agent-access receipt as a decision record generated at the edge and preserved for inspection. A deterministic Python laboratory with a synthetic policy and a synthetic trust registry evaluates 15 scenario cases, 15 mutation and control cases and 3 post-issue receipt-integrity controls. The artefact is not a production security protocol and claims no legal compliance, deployment readiness or third-party endorsement; its contribution is to show why access-control evidence for AI-mediated callers should preserve the bindings among identity, delegation, purpose, inventory and economic authorisation.

doi:10.3389/fcomp.2026.1900546 → publication note →

@article{sokolov2026agentaccessreceipts,
  author       = {Sokolov, Anton},
  title        = {Agent-access receipts for artificial intelligence-mediated content and application programming interface access: a reproducible synthetic security experiment},
  journal      = {Frontiers in Computer Science},
  volume       = {8},
  year         = {2026},
  doi          = {10.3389/fcomp.2026.1900546},
  note         = {Article 1900546; open access, CC BY 4.0}
}

Spec-as-(N+1)-oracle Differential Fuzzing of SD-JWT Presentation Verification

Anton Sokolov · Published — Springer LNCS, STM 2026 proceedings, pp. 103–119 · October 2026

Treating the specification itself as an additional oracle alongside N implementations surfaces silent claim-drops in SD-JWT presentation verification — cases where a verifier returns success while quietly discarding selectively disclosed claims.

A security-engineering study that fuzzes SD-JWT presentation verification differentially, using the specification as an (N+1)-th oracle against the implementations under test. The method targets silent failure: a verifier that accepts a presentation while dropping disclosed claims produces no error a relying party can observe. The evidence boundary is explicit — findings are version-bound to the libraries and versions tested, the high-severity reading holds under permissive default-allow authorization, and the study claims neither ecosystem-wide prevalence nor any compliance or certification status. Presented at STM 2026 in Rome on 17 September 2026 and published in the Springer LNCS proceedings on 8 October 2026.

doi:10.1007/978-3-032-41330-7_6 → publication note →

@inproceedings{sokolov2026sdjwtfuzzing,
  author       = {Sokolov, Anton},
  title        = {Spec-as-($N$+1)-Oracle Differential Fuzzing of {SD-JWT} Presentation Verification},
  booktitle    = {Security and Trust Management ({STM} 2026)},
  series       = {Lecture Notes in Computer Science},
  publisher    = {Springer},
  year         = {2026},
  pages        = {103--119},
  doi          = {10.1007/978-3-032-41330-7_6}
}

MIRROR: Local Evidence Bundles for Reproducible Research Software Review, with a JANUS Case Study

Anton Sokolov · Accepted — Journal of Open Research Software (30 September 2026); in production · September 2026

↳ sibling-of: “EATF-MultiRoot: A Reproducible Verifier and…”; the same evidence-bundle habit applied to research-software review

A reviewer or a later reader can re-check that research software still does what its paper says without asking the author anything: MIRROR produces a local evidence bundle, a manifest of the files that were run, the hashes that pin them, the environment, the commands and the outputs, in a form a stranger can verify offline.

MIRROR is a small tool for a large habit. When an editor, a reviewer or a later reader wants to know whether a piece of research software still does what its paper says, the usual answer is a repository link and goodwill. MIRROR instead produces a local evidence bundle that pins the files, environment, commands and outputs of a run, so that the check can be repeated offline. The JANUS case study walks one real software review through the bundle. The article was accepted by the Journal of Open Research Software on 30 September 2026; the software it describes did not change between submission and acceptance. The DOI shown is the software release; the article's DOI will be added when the journal publishes it.

doi:10.5281/zenodo.20463358 → publication note →

@article{sokolov2026mirror,
  author       = {Sokolov, Anton},
  title        = {{MIRROR}: Local Evidence Bundles for Reproducible Research Software Review, with a {JANUS} Case Study},
  journal      = {Journal of Open Research Software},
  year         = {2026},
  note         = {Accepted 30 September 2026; in production. Software v0.1.1, DOI 10.5281/zenodo.20463358}
}

Nekropolis: a cross-domain dataset of computer-science retractions and AI-governance lifecycle records (2018–2026)

Anton Sokolov · published article — Data in Brief · June 2026

↳ parent-of: “A source-stratified opacity profile of six…”, “Computer-generated content and the AI/ML…”

A single unified entry schema brings five public negative-results record families — journal retractions, preprint withdrawals, trusted-service lifecycle changes, archived governance repositories, and reviewed benchmark withdrawals — into one cross-domain corpus of 14,923 records, while keeping source-family labels visible so the evidentiary unevenness between families is never silently pooled.

A peer-reviewed Data in Brief data article for Nekropolis v0.3 — a 14,923-record curated public-record corpus of artifacts retracted, withdrawn, revoked, archived, or discontinued across computer-science retractions, AI-governance records, trusted-service lifecycle changes, withdrawn benchmarks, archived governance repositories, and related source families between 2018 and 2026. Each record carries an artifact category, lifecycle dates, source-stated reason where one exists, a conservative project-inferred cause label, and hashed source pointers. The article defines the schema, source-family gates, validation checks, deposit layout, licensing, and responsible-reuse guidance for the corpus. Companion analyses of public-record opacity (sokolov2026nekropolisOpacity) and AI/ML retraction causes (sokolov2026nekropolisRipr) are separate manuscripts that read this corpus through narrower slices. Dataset deposit: Zenodo v0.3 DOI 10.5281/zenodo.20405512 (CC BY 4.0).

doi:10.1016/j.dib.2026.113041 → concept DOI: 10.5281/zenodo.20405511 publication note →

@article{sokolov2026nekropolis,
  author       = {Sokolov, Anton},
  title        = {Nekropolis: a cross-domain dataset of computer-science retractions and {AI}-governance lifecycle records (2018--2026)},
  journal      = {Data in Brief},
  volume       = {67},
  pages        = {113041},
  year         = {2026},
  month        = aug,
  doi          = {10.1016/j.dib.2026.113041},
  issn         = {2352-3409},
  publisher    = {Elsevier BV},
  url          = {https://doi.org/10.1016/j.dib.2026.113041}
}

Standards Assurance as Join Integrity: Evidence graphs, counterfactual mutation testing, and LLM failure modes in a CEN/CENELEC AI case study

Anton Sokolov · v0.3.1 — public research capsule and interactive evidence lab · August 2026

↳ applies: EATF evidence binding to standards assurance; no conformity, trust-service, or semantic-truth claim

Standards assurance is a join-integrity problem: a plausible clause or artifact is insufficient unless the legal requirement, exact standard version, dependency, evidence object, and human disposition remain bound to one inspectable chain.

NORMTRACE connects AI Act Articles 12–14 and 17 to a declared CEN/CENELEC assurance spine covering logging, transparency, human oversight, quality management, and organisation-level AI management. A separate five-standard ETSI corpus validates the mapping instrument under complete-source conditions; controlled architecture and mutation experiments expose identity loss, invented joins, document-state drift, modal weakening, and actor/object binding failures. A same-window multilingual portal panel preserves public reachability and missingness without republishing protected standards text. The public capsule includes code, manifests, model receipts, signed attestations, external timestamp evidence, and explicit claim boundaries. Independent human adjudication remains future validation; neither the paper nor the demonstrator certifies conformity or semantic truth.

doi:10.5281/zenodo.21924089 → concept DOI: 10.5281/zenodo.21924046 interactive evidence lab →

@misc{sokolov2026normtrace,
  author       = {Sokolov, Anton},
  title        = {Standards Assurance as Join Integrity: Evidence Graphs, Counterfactual Mutation Testing, and {LLM} Failure Modes in a {CEN/CENELEC} {AI} Case Study},
  year         = {2026},
  month        = aug,
  publisher    = {Zenodo},
  version      = {0.3.1},
  doi          = {10.5281/zenodo.21924089},
  url          = {https://doi.org/10.5281/zenodo.21924089},
  note         = {Research paper; public research capsule v0.3.1}
}

From Permit to Packet: Composing Agent Authority with Public Internet Measurement Evidence

Anton Sokolov · v0.1.0 — full manuscript and executable research artifact · August 2026

↳ applies: SCITT Permit and RATS role-separation concepts to an externally assigned public-measurement effect; no conformance claim

A valid signature cannot compensate for a broken transition from mandate to action, external platform effect, captured evidence, or bounded claim: five isolated treatments accept all 22 authorised controls, while only the composed verifier with a witness rejects and correctly localises all 21 designed faults; a precommitted live RIPE Atlas trace then binds the authorised request to eight later-assigned measurement IDs and 32/32 captured rows.

An executable method for testing authority-to-claim composition around a real external platform. The release contains 21 matched positive/negative pairs plus one clean baseline, a 448-variation deterministic mutation sweep, a prospective Zeus1-only action with an exact request digest committed before RIPE assigned IDs, five unit tests, manifests, a Node prospective verifier, a 12-page manuscript, and a public Observatory. A GitHub-hosted runner reproduces 56 prospective gates over checkout and production artifacts. The evidence boundary is explicit: RIPE public API rows are not RIPE-signed statements, the witness shares Tyche administration and the RIPE upstream, and the study claims neither SCITT/RATS conformance, independent audit, population error rates, legal compliance, nor global availability.

doi:10.5281/zenodo.21923744 → concept DOI: 10.5281/zenodo.21923743

@software{sokolov2026permitpacket,
  author       = {Sokolov, Anton},
  title        = {From Permit to Packet: Composing Agent Authority with Public Internet Measurement Evidence},
  year         = {2026},
  month        = aug,
  publisher    = {Zenodo},
  version      = {0.1.0},
  doi          = {10.5281/zenodo.21923744},
  url          = {https://doi.org/10.5281/zenodo.21923744}
}