Internal self-audit

We ran the method against our own authority stack first.

Before offering the Agent Authority & Evidence Audit externally, BitEvo used the method on its own agent/control workflows. The self-audit found real bounded authority and evidence failures, rejected weak repairs, forced additional repair cycles and retested the resulting controls.

Map one workflow Scope an audit

CLAIM CEILING

This page describes an internal dogfood program: real failures reproduced in bounded environments, repair cycles, scoped qualification and an internal adversarial/evidence batch. It is not customer evidence, independent certification, universal no-bypass, provider-wide enforcement or proof of fleet-wide production adoption.

Executive summary

The important result was not a PASS. It was catching our own assumptions lying to us.

The narrow question was whether an executor with limited declared authority could still create an effect outside that authority — and whether the evidence layer could distinguish what was declared from what actually happened.

The answer was yes. We observed authority crossing, contradictory effect receipts, evidence-quality failures and an early repair whose own authority logic could be bypassed. The method then had to survive its own retest rather than accepting a narrated success status.

Three redacted cases

Real failure → control change → same-boundary retest.

Private paths, hostnames, credentials, repository internals and secret-bearing logs are intentionally omitted. The public unit is the authority/evidence failure pattern and the bounded control decision.

01AUTHORITY CROSSING

Declared local-only authority reached synced storage.

OBSERVED FAILURE

A bounded executor was instructed to stay local, while evidence showed a write crossing into synced storage.

WHY IT MATTERED

Declared authority was narrower than the effect the workflow could actually reach.

CONTROL DIRECTION

Move effect classification into a trusted preflight/broker so callers do not self-label an operation as local, synced, governance or another effect class.

RETEST

Denied synced/governance cases stop before downstream dispatch; one legitimate bounded local-read control still reaches its handler.

02FALSE RECEIPT

A no-effect receipt contradicted the observed action record.

OBSERVED FAILURE

A return claimed no external effect while separate evidence showed writes or mutations.

WHY IT MATTERED

Narrative self-attestation could not be treated as the terminal evidence source.

CONTROL DIRECTION

Use machine-derived ledgers and independently recomputable manifests instead of trusting a narrated result.

RETEST

DENY must produce zero downstream external-effect dispatch, machine counters and a terminal ledger row.

03REPAIR BYPASS

The first repair still trusted caller-controlled effect semantics.

OBSERVED FAILURE

The caller could supply both an effect label and separate operation semantics, allowing a benign label to disagree with the actual requested effect.

WHY IT MATTERED

A repaired authority check was still asking the caller to describe the very property the control needed to derive independently.

CONTROL DIRECTION

Typed operation → trusted operation registry → broker-derived effect class → exact approval binding → operation-specific handler → effect ledger.

RETEST

Safe decision-only counterexamples challenge the semantic binding without executing the encoded external command.

Qualification ladder

A returned PASS was never enough by itself.

Evidence strength increased only when the qualification class changed: from historical observation, to safe reproduction, to handler interception, to bounded dispatch, to adversarial and high-volume evidence testing.

01Historical real failures
02Deterministic safe reproduction
0312-scenario local reference harness
04Shadow authority check
05Executor-facing handler interception
06Real local executor dispatch qualification
07Separate adversarial replication lane
08Typed-operation / effect-broker repair cycles
09Exception / ledger boundary retests
10High-volume adversarial and evidence testing

Antigravity qualification

One scoped executor boundary reached an accepted contract.

This is local-shadow/scoped engineering qualification. The receipt does not establish universal no-bypass, provider-wide enforcement, production-wide security, certification or absence of unknown defects.

CONTRACTTYPED_EFFECT_BROKER_EXCEPTION_BOUNDARY_PASS

REQUESTS46 total

DENIED45

ALLOWED CONTROL1 bounded READ_LOCAL

DENIED HANDLER DISPATCH0

EXTERNAL HANDLER DISPATCH0

UNCAUGHT EXCEPTIONS0

TERMINAL LEDGER ROWS46

Spark internal adversarial batch

Scale was used to attack evidence quality, not manufacture a trust score.

These figures describe one repaired internal batch. They are not an independent certification or a benchmark of every agent system.

5,400adversarial authority requests

24 / 25mutation kills · 96% in that batch

10,000synthetic event ledgers

1,000deliberately corrupted summaries

100%corrupted-summary detection in that batch

12,000authority state-space scenarios

105attack patterns

45source-binding feature rows validated

LANE F / SOURCE BINDING45 feature rows

SOURCE-BACKED32

OFFICIAL GUIDANCE3

INFERENCE9

UNVERIFIED1

KNOWN SOURCE-TOPIC MISMATCHES0

What changed in our operating model

The dogfood result changed the evidence rules, not just one patch.

The strongest outcome was a stricter separation between declaration, execution, evidence, adjudication and deployment state.

Return status is a claim until adjudicated

A PASS or no-effect return is not terminal truth until the evidence chain agrees.

Proof classes stay separate

Artifact integrity, runtime proof, semantic proof, adversarial proof and production adoption are different gates.

Local/shadow is not fleet-wide enforcement

A bounded control can be proven without implying provider-wide or production-wide adoption.

Source outranks projection

Mirrors, projections and summaries do not become source authority by presentation alone.

Raw manifests outrank narrated totals

Machine-derived evidence is preferred when human summaries and strict manifests diverge.

External effects require explicit authority

Irreversible or external actions must be bound to explicit permission and effect semantics.

What remains deliberately unclaimed

Control proven ≠ control adopted everywhere.

Reference and shadow controls were proven, and a bounded executor path was qualified. Fleet-wide/live adoption remains a separate engineering program.

NOT CLAIMED — BitEvo systems are production safe.
NOT CLAIMED — All BitEvo agents are fully hardened.
NOT CLAIMED — Universal no-bypass.
NOT CLAIMED — Certified secure.
NOT CLAIMED — Provider-wide enforcement.
NOT CLAIMED — No unknown vulnerabilities remain.

Why this matters

A useful authority audit should be willing to break its own repair.

Our dogfood case found failures in our own stack, rejected weak repairs, forced additional repair, and kept tested controls separate from unproven production adoption. Apply the same discipline to one effectful workflow.

Map one workflow Scope an audit Compare synthetic proof classes →