PaperlayerView exact revision on arXiv

Source-linked AI summary

NovaFabric: A Black-Box Recorder for AI Agents with Sealed, Replayable, Diffable and Auditable Runs

Mohsen Seyedkazemi Ardebili

arXiv:2610.34594v1cs.DCcs.CRcs.SE

TL;DR

Provider-specific records are not independent witnesses, motivating portable, customer-owned evidence of agent behavior. NovaFabric organizes runs around capsules and engines with explicit replay, diff, and authorization contracts. Full capture has a reported mean fixed cost of 4.56 s across a 61.8× workload-size range, with marginal intercepted-call costs of 0.41–0.55 ms.

  • Problem

    Provider-specific records are not independent witnesses, leaving a need for portable, customer-owned, tamper-evident evidence across models, tools, clouds, and time.

    Source: §3.4 · p. 14

  • Method

    NovaFabric pairs a provider-neutral evidence layer and capsule source of truth with replay that fails closed on divergence and a dashboard that denies unclassified routes.

    Source: §3.4 · p. 14, §12.3 · p. 54, §17 · p. 66

  • Results

    4.56 s was the measured mean full-capture fixed cost across a 61.8× range of workload sizes, with 0.41–0.55 ms marginal cost per intercepted call.

    Source: §13.2 · p. 56

  • Takeaways & Limitations

    The capsule remains the source of truth while the evidence layer targets portable, customer-owned records across providers.

    Source: §3.4 · p. 14, §12.3 · p. 54

    NovaFabric stores prompts in model-call records; its capture-level policy does not reduce that storage, and its per-field allowlist is planned.

    Source: INVARIANT 4 · p. 22

Abstract

from arXiv · show

An AI agent run is no longer a function call. It is a cascade of prompts, model calls, tool invocations, file and network effects and sub-agents. When such a run misbehaves, or an auditor asks what happened, logs and traces answer poorly: they are mutable, partial and cannot be re-executed. This technical report describes NovaFabric, an open-source (Apache-2.0) black-box recorder for AI agents that turns a run into a sealed, replayable, diffable and auditable evidence capsule. The design rests on two formats only. The Run Capsule is a directory of flat files and the source of truth; every database is a rebuildable index over capsules. The Evidence Bundle is the signed export for an auditor. Everything else follows existing standards: OpenTelemetry GenAI, OpenLineage, W3C PROV, in-toto/DSSE, RFC 3161 and CycloneDX. A single-node run is the smallest case of a distributed one; the schema supports a capsule hierarchy for Slurm arrays and Kubernetes jobs, though automatic parent finalization is library-only today. The report covers the architecture and the engines behind the verb chain capture, seal, replay, diff and audit: fail-closed mocked replay; a diff gate with a stable exit-code contract; DSSE signatures that bind their intent and a capsule root that commits to file names; a capsule treated as untrusted input; signer identity-trust levels with offline TSA and CRL checking; maker-checker promotion against an operator-held trust list; and a deny-by-default authorization table for every dashboard route. It presents no new experiments; the evaluation is in arXiv:2609.12582. Every count except the private ADR tally is generated by a probe script run on the public source at the v0.107.0 tag (150 top-level commands, 84 Python subpackages, 16,721 test functions), every capability carries an explicit maturity label, and honest-limits boxes state where the system stops.

7 Replay and diff

NovaFabric’s current release sharpens replay and trust contracts while organizing runs around capsules and documenting the scope of its claims.

1 Executive summary

  • The Run Capsule is the source of truth and the Evidence Bundle is the signed auditor export; capsule hierarchies support distributed jobs, though automatic parent finalization is library-only today.Other formats align with existing standards, including OpenTelemetry GenAI, OpenLineage, W3C PROV, in-toto/DSSE, RFC 3161, and CycloneDX.Source: §1 · p. 8
  • This reference report checks behavior against the release-tag code and states engine contracts, trust limits, maturity labels, and honest limits; it presents no new experimental campaign.The changes described have not been re-evaluated in the companion paper’s experimental setup, particularly tool replay.Source: §1 · pp. 8–9
  • Mocked replay now fails closed on any divergence, while nova diff has a stable exit-code contract and compares recorded request parameters.Any replay divergence ends with a non-zero exit code.Source: §1 · p. 9
  • Replay also de-duplicates SDK wire records into logical calls and can substitute declared Python tools.Source: §1 · p. 9

8 Trust and evidence

  • NovaSeal binds proofs to the capsule manifest; signing intent and file names are checked, and trust surfaces share verifiers for capsules and Evidence Bundles.The dashboard authorizes every route, and maker-checker signers must chain to an operator-held trust list or CA.Source: §1 · pp. 9–10

2 The problem and the idea

Agent runs span prompts, tools, files, networks, and sub-agents, leaving conventional logs unable to answer what happened, whether records are trustworthy, or what changed. NovaFabric proposes a portable evidence capsule and positions it as a complement to adjacent tools, not an orchestrator or compliance determination.

2.1 Agents became behaviours

  • Agent runs raise questions about wire-level behavior, record trust, later inspection or reproduction, and the effects of changes that conventional tooling mostly cannot answer.Source: §2.1 · p. 11

KEY IDEA

  • NovaFabric turns an important agent run into a sealed, replayable, diffable, auditable evidence capsule that can be loaded later, re-executed under a stated contract, compared, and exported for an auditor.Source: KEY IDEA · p. 12
  • NovaFabric invents two top-level formats—the Run Capsule and Evidence Bundle—and aligns other records with existing standards to support portability and customer ownership.Source: KEY IDEA · p. 12

2.3 Design commitments

  • The design commits to wire-level observation, capture that fails open by default, alignment with existing standards, and explicit maturity labels; the cluster tier adds infrastructure without changing the capsule format.Source: §2.3 · p. 12

2.4 What NovaFabric is not

  • NovaFabric is not an orchestrator, hosted SaaS, or real-time monitoring product, and its evidence exports do not themselves establish compliance.Source: §2.4 · p. 12

3.1 Four adjacent families

  • NovaFabric combines adjacent tooling into a portable record that consumes or emits their standards, while asking whether a run can be safely re-examined and its record trusted.Source: §3.1 · p. 13

3.2 An executable differentiation table

  • At v0.107.0, an executable verifier reports 10 of 10 differentiation claims passing, but checks that mechanisms exist and import rather than benchmarking competitors’ behavior.Source: §3.2 · p. 13, WHAT THE CHECK PROVES · p. 14

3.4 Positioning

  • NovaFabric complements runtimes, clouds, and observability platforms at the provider-neutral evidence, replay, and audit layer, targeting a portable, customer-owned record across providers.Source: §3.4 · p. 14

4 Concepts and data model

The Run Capsule is the source-of-truth record, while the wire envelope, distributed capsule hierarchy, and typed lineage vocabulary provide consistent event identity and relationships. Sealing, validation, and explicit schema and content limits qualify what the record can establish and contain.

4.2 The Run Capsule

  • A Run Capsule is a flat-file directory and source of truth; registry, metadata, lineage, and knowledge-graph databases are derived indexes rebuildable from capsules.Source: §4.2 · p. 15
  • The shared finalization path removes special files without following them, redacts content, records residual-scan results, and writes evidence-file digests before sealing.Source: §4.2 · p. 15
  • After sealing, verification checks the signed manifest and file digests, detecting edits; before sealing, capsule digests remain unauthenticated.Source: §4.2 · pp. 15–16

SCHEMA VERSIONS AND CONTENT

4.3 The wire contract: Event Envelope v1

  • The Event Envelope v1 is a frozen wire format carrying event and run identity, location, causality, and a payload hash, with breaking changes requiring version 2.Source: §4.3 · p. 17

4.4 Distributed identity: parent and child capsules

  • Distributed jobs form capsule trees under one global_run_id, with parent and child roles, parent completion states, and a fail mode for missing expected children.Source: §4.4 · p. 17

4.5 Typed lineage vocabulary

  • Lineage records consumed, produced_by, and replayed_from edges, plus distributed and session relationships mapped to W3C PROV-DM where counterparts exist.Source: §4.5 · p. 17

5 Architecture

NovaFabric wraps and observes workloads while leaving their planning and scheduling to other systems. Its architecture organizes capture, evidence storage, analysis, trust, governance, and assurance around capsules, with local and cluster tiers using the same formats.

5.1 System context

  • NovaFabric observes and records a wrapped workload and its interactions with people and external systems, but does not plan or schedule the workload.Source: §5.1 · p. 19

5.2 Subsystem map

  • The source tree has 84 Python subpackages grouped into eight domains, with capture writing capsules and other components querying or serving the records.Source: §5.2 · p. 20

5.3 Design invariants

  • The architecture guide states invariants including portable self-describing capsules, nonblocking capture by default, additive schema changes, and no privileged Kubernetes access.Source: §5.3 · p. 21

INVARIANT 4

  • The stated goal of opt-in full prompt and response capture is not met: model-call content is stored at every capture level, and minimal and standard behave alike.Source: §5.3 · p. 21, INVARIANT 4 · p. 22

5.4 Two tiers, one format

  • The local tier uses disk capsules and SQLite indexes, while the cluster tier adds collectors, messaging, object storage, and database indexes around the same capsule and envelope formats.Source: §5.4 · p. 22

6 Capture runtime

NovaFabric captures agent activity through multiple entry points that converge on a shared recorder and finalization path, then applies bounded capture, untrusted-input handling, redaction, and configurable execution targets.

6.1 Capture at the wire

  • SDK and wire hooks capture logical calls and transport attempts, while framework adapters, proxies, and other entry points converge on one recorder and finalize path.Transport attempts share a logical_call_id with their logical call; consumers count logical calls only.Source: §6.1 · p. 23, Figure 6.1 · p. 24

6.2 Fail-open, bounded, isolated

  • Capture hooks fail open by default, passing workload returns or exceptions through unchanged while logging and counting dropped records in capture-health.json.Queues are bounded, concurrent captures are isolated, and strict mode lets an operator choose refusal rather than degradation.Source: §6.2 · p. 25

6.3 The workload is untrusted input

  • After workload exit, finalization treats the capsule as untrusted, removes links and special files, and makes later reads and rewrites avoid following them.Tampering is recorded and causes nova verify and nova validate to fail; hard links remain a documented limit.Source: §6.3 · p. 25

6.4 Capture levels

  • Capture policies define minimal, standard, forensic, and air_gapped levels, but only forensic and air_gapped currently retain selected tool and framework payloads.Model-call content is stored at every level; minimal and standard behave identically, and air_gapped does not yet block network calls.Source: §6.4 · p. 26, WHERE CAPTURE LEVELS APPLY TODAY · p. 26

WHERE CAPTURE LEVELS APPLY TODAY

  • In current capture paths, the level does not enforce the documented metadata-only field allowlist for minimal capture or prevent external calls for air_gapped capture.Model-call content remains stored at every level, and MCP calls always retain full arguments and results.Source: WHERE CAPTURE LEVELS APPLY TODAY · p. 26

6.5 Secrets, masking and redaction proofs

  • Before manifest creation, finalization scans and redacts capsule files, rescans the output, records a redaction proof, and can apply pluggable PII masking.The masking pipeline is fail-closed.Source: §6.5 · p. 26

PATTERNBASED SCANNING

  • The rule-based secret scanner has documented blind spots, including keys, tokens, passwords, connection strings, and personal data; model-call content is not protected by capture levels.The report directs users to a masker for data outside the pattern pack’s coverage.Source: PATTERNBASED SCANNING · p. 26

6.6 Runners: where a captured command executes

  • One runner protocol supports local, Docker, Kubernetes, Slurm, PBS, and LSF execution, with environment forwarding restricted or minimized for several remote runners.Extra environment values are still exposed in runner-specific locations, so the report explicitly says this is not end-to-end secrecy.Source: §6.6 · pp. 26–27

7 Replay and diff

NovaFabric treats replay as a set of explicit guarantees rather than byte-exact reproduction of hosted models, and combines guarded replay with structural capsule comparison and separate assurance decisions.

7.1 Replay is a contract, not a button

  • Because hosted models drift, rerunning a prompt later is a new experiment; NovaFabric therefore specifies replay guarantees rather than claiming byte-exact remote-LLM replay.Replay modes distinguish whether they re-execute the recorded command.Source: §7.1 · p. 28, Figure 7.1 · p. 29

7.2 The mocked-replay contract ADR0300, ADR0304

  • Mocked replay serves supported recorded model and MCP results, refuses unsupported SDK surfaces, and fails closed on divergence unless --permissive is used.Divergences include missing recorded responses, unmatched tool calls, and recorded responses left unconsumed.Source: §7.2 · p. 29

7.3 The safety ladder ADR0012

  • Calls not served from the capsule run live only when the operator supplies the matching mutation-class flag, and OPA policy denial or error refuses replay before execution.A replay.yaml allow: false is never overridden, including under --permissive.Source: §7.3 · p. 30

7.4 Substituting non-MCP tools ADR0306

  • Replay can substitute declared Python tools and captured Google ADK and OpenAI Agents tool calls, alongside nested record.tool boundaries and redacted MCP matching.Source: §7.4 · p. 30

REPLAY BOUNDARIES

  • Mocked replay refuses capsules without a runnable command and cannot serve tool results captured below forensic level; replay reports network connections but does not block them.Intervention replay can emit counterfactual streams without re-execution for capsules lacking a runnable command.Source: REPLAY BOUNDARIES · p. 31

7.5 Structural diff and the CI gate ADR0303

  • Structural diff pairs model calls by span, identical-request anchors, and intervening position, while tool calls pair by name and argument hash before position.Changed prompts appear as one changed pair rather than a removal plus an addition, and recorded request parameters are compared.Source: §7.5 · p. 31

7.6 Drift, equivalence and the assurance loop

  • Drift detectors gather evidence but do not issue verdicts; separate assurance commands decide policy, and NovaFabric does not schedule the assurance loop.Source: §7.6 · p. 32

8 Trust and evidence

NovaFabric’s trust and evidence mechanisms combine capsule sealing, signed exports, storage controls, and two-person approval paths, with explicit boundaries on what verification and identity claims establish.

8.1 NovaSeal: three independent proofs

  • NovaSeal binds signature, timestamp, and log proofs to a capsule manifest, while the signed payload records the manifest file and signing intent.Renaming the manifest file or editing a signed intent label fails verification; sealing remains opt-in.Source: §8.1 · pp. 33–34

8.2 Merkle constructions and the price of the guarantee

  • Capsule Merkle leaves commit to relative paths as well as content, so renaming a file changes the root; capsule-file, signing-log, and MMR constructions are distinct.Mixing leaves or combiners across constructions yields a wrong root.Source: §8.2 · p. 35

VERIFICATION COSTA WITHDRAWN TARGET ADR0268

  • Full log verification recomputes the root from every stored leaf hash, taking about 1.9 seconds end-to-end per million entries on a Postgres 16 CI runner.The earlier p99-under-200-ms target at one million entries was withdrawn; full verification is framed as a scheduled audit.Source: VERIFICATION COSTA WITHDRAWN TARGET… · p. 35

READING A LOG ROOT

  • Signing-log roots carry tree size and root version; older v1 roots can collide for odd-sized inputs, and pre-v0.106 releases generally cannot verify v2 inclusion proofs.Source: READING A LOG ROOT · p. 35

8.3 Evidence Bundles

  • Evidence Bundles package signed in-toto attestations and optionally an RFC 3161 token, with status fields describing what the bundle proves itself and what needs a witness.Verification checks signatures, artifact digests, statement subjects, and signed bundle members; a bundled key alone does not establish signer identity.Source: §8.3 · p. 36

8.4 WORM storage, retention and legal holds

  • NovaFabric provides WORM storage adapters, retention sweeps, and legal holds that can block deletion, retention actions, and PII erasure.A hold is registry-wide, and releasing a hold through the server requires admin scope.Source: §8.4 · pp. 36–37

8.5 Two-person control

  • Promotion proposals and approvals require trust-listed identities, separation of duties, and policy gates; capsule attestations additionally bind approval to a canonical proposal digest.Offline verification checks signer chains, digest binding, distinct proposer and approver, and ordered timestamps.Source: §8.5 · p. 37

WHAT TWOPERSON CONTROL PROVES

  • Two-person control binds signatures only as strongly as the operator’s trust list or pinned CA; login-level signer authentication is not yet part of the check.Source: WHAT TWOPERSON CONTROL PROVES · p. 37

9 Lineage and the knowledge graph

NovaFabric builds lineage from capsule events and extends that evidence into interoperable graphs, governed actions, human oversight, and compliance records. Its account emphasizes both operational guarantees and the boundaries of what is implemented or independently verified.

9.1 Event-derived, rebuildable lineage

  • Lineage edges are stored in capsules and indexed in a rebuildable graph, supporting provenance, blast-radius, replay-chain, time-travel, and root-cause queries.Memory edges distinguish who wrote a poisoned item from who read it.Source: §9.1 · pp. 39–40

9.2 Tiered backends behind one interface

  • All four lineage backends are implemented and tested against live servers, with a shared behavioral contract; the NATS transport itself has mocked tests.The parent-child producer-to-consumer path is tested end-to-end using real captures and spool segments.Source: §9.2 · p. 40

9.3 Interoperability

  • Lineage can be exported as OpenLineage RunEvents or W3C PROV, including row and transformation facets for column-level detail.AI lineage is intended to land in existing data catalogues rather than a new silo.Source: §9.3 · p. 40

9.4 The capsule knowledge graph

  • The separate capsule knowledge graph aggregates cross-run agent, model, tool, and MCP-server entities and supports security-path analysis; temporal validity and an RDF store are planned.Its consumer and server routes restrict which capsule paths can be ingested.Source: §9.4 · pp. 40–41

Governance, compliance and assurance

10.2 Human oversight as evidence

  • Human approval is evidence rather than automated decision-making, while the five-level approval taxonomy and human-impact ledger remain future design.The accountability spine also includes energy receipts, adversary-anchored ledgers, replay attestations, and safety-case compilation.Source: §10.2 · p. 44, §10.3 · p. 44

10.4 Compliance machinery

  • PII erasure makes data unreadable only in capsules captured with subject-key encryption; binary or oversize artifacts, media blobs, and in-process capsules are outside that coverage.A registry-wide legal hold defers every erasure until release.Source: §10.4 · p. 45

10.5 Honest numbers: cost and evals

  • Cost aggregates refuse to report uncomputable values instead of treating unpriced models as free, while evaluation suites feed a promotion regression gate.Container evaluation suites require a user-supplied image and digest.Source: §10.5 · pp. 45–46

11 Product surfaces

NovaFabric presents the CLI as its reference interface, with a dashboard and server exposing related capabilities. The server applies route authorization and other access boundaries, while SDKs and integrations extend the product surface.

11.1 The CLI is canonical

  • At v0.107.0, the CLI registers 150 top-level commands and 374 runnable command paths, and documentation guard tests check command coverage in both directions.The CLI is the reference interface; other surfaces call the same library code or show the equivalent command.Source: §11.1 · p. 47

11.2 The local dashboard

  • The experimental local dashboard reads the CLI’s capsules and indexes, and its portable, versioned JSON dashboards can be diffed, reviewed, and committed like code.Its 30 tabs are grouped into seven journeys.Source: §11.2 · pp. 47–48

11.3 Authorization on every route

  • Authorization is defined in a declarative method-and-path table, with nested admin, operate, and read scopes and a separate audit scope.The table has 225 entries, including optional topology and TV-5 routes.Source: §11.3 · p. 48

DENY BY DEFAULT

  • Unclassified routes are denied to every caller, and a completeness test prevents a mounted route from shipping without classification.Classified routes still reach their own authentication dependency; denials are audited.Source: DENY BY DEFAULT · p. 48

11.4 Server mode

  • The experimental server offers OIDC bearer validation, role-based access control, offline tokens, and other multi-user API features; evidence export accepts no client filesystem path.Production promotion still requires an explicit policy allow.Source: §11.4 · p. 50

11.5 SDKs, collector and integrations

  • The product surface includes a Python in-process SDK and typed API client, a TypeScript SDK, a Go collector, and a Claude Code plugin.The TypeScript SDK is marked experimental.Source: §11.5 · p. 50

11.6 Distribution and supply chain

  • The PyPI package is Apache-2.0 and uses OIDC Trusted Publishing with SLSA provenance and a CycloneDX SBOM.The amd64 and arm64 container image is keyless-cosign signed and published with an SBOM and provenance.Source: §11.6 · p. 50

12 Architecture at scale

NovaFabric’s cluster architecture keeps compute-node capture lightweight and moves signing, routing, and indexing to service nodes. It is designed for distributed arrivals and rebuildable storage, while some parent-finalization behavior remains unwired in runtime paths.

12 Architecture at scale

  • Cluster-scale processing separates compute from the service plane: compute nodes spool payload-bearing, SHA-256-bound envelopes locally without blocking, while service nodes handle signing, deduplication, routing, and indexing.All six cluster-scale phases are implemented and shipped as experimental.Source: §12 · p. 51

12.1 The Go collector

  • The experimental Go collector uses a Lustre-safe spool with fsync-before-rename commits, FIFO eviction, and back-pressure errors; it refuses unsigned batches if its signing key service is unreachable.In the HPC profile, signing occurs at the cluster hub so compute nodes have no key-service dependency.Source: §12.1 · p. 51

12.2 Distributed runs and the fail-open arrival policy

  • The designed child-arrival model links late orphans to deterministic placeholders and supports fail-open or fail-closed partial completion, but runtime capture does not invoke this state machine or finalize parents.A parent reaches terminal status only if something outside nova capture finalizes it.Source: §12.2 · pp. 52–53, WHAT IS WIRED TODAY · pp. 53–54

12.3 Polyglot persistence with one source of truth

  • The object capsule store is the source of truth, while metadata and graph backends are rebuildable; the store pins SHA-256 and checks a manifest chain by default.The stack can run self-hosted and air-gapped.Source: §12.3 · p. 54

12.4 Reliability contract

  • The reliability contract assumes at-least-once delivery, duplicates, out-of-order events, missing children, and untrusted clocks; if NovaFabric fails, the workload continues.Unreachable collectors spool locally, signing failures refuse unsigned batches, and lost indexes are rebuilt from capsules.Source: §12.4 · p. 54

13 Performance evidence

NovaFabric publishes performance claims through a catalogue that distinguishes enforced, measured, and aspirational numbers. Reported capture costs separate fixed startup overhead from per-call cost, while the report states that some measurements need remeasurement or demotion.

13.1 One catalogue, three kinds of number

  • 21 catalogue entries comprise 10 CI-gated, 8 measured, and 3 target values; measured claims carry revalidation dates, while targets are explicitly not promises.The catalogue is the source for published performance numbers and generated documentation.Source: §13.1 · p. 55

13.2 Reading the capture-overhead numbers

  • 168.8 ms was the gated trivial-run median (n = 30) when last characterized, with a p95 < 2 s gate.The no-op capture budget of ≤50 ms remains a target, not a measured result.Source: §13.2 · p. 56, WHERE THE NUMBERS STOP · p. 57
  • 4.56 s is the measured full-capture mean, remaining flat across a 61.8× range of workload sizes; per intercepted call, marginal cost is about 0.41–0.55 ms.That marginal cost is 3.6% on an 11.5 ms call and 0.5% on a 102 ms call.Source: §13.2 · p. 56

WHERE THE NUMBERS STOP

  • The cloud-campaign measurements cannot be renewed as stated because equivalent virtual machines are no longer available, and the report makes no broader cluster-scale throughput claim.The lineage bulk-copy path measured 1,340 edges/s against a 10,000/s objective; topology reclustering crosses its 30 s objective at about 1,700 nodes.Source: WHERE THE NUMBERS STOP · p. 57

14 Capability and maturity matrix

NovaFabric labels capabilities by maturity: stable local functions coexist with experimental server, cluster, and post-v0.59 cohort features, while its formats remain unfrozen. The matrix spans capture and replay, trust, lineage, governance, and distributed execution.

Capability and maturity matrix

  • Local capture, replay, diff, SQLite lineage, the trust layer, asset registry, policy and approval gates, and standard eval suites are listed as stable; server mode, cluster, and post-v0.59 cohorts are experimental.The matrix separately marks framework adapters and cost attribution as experimental.Source: §14 · pp. 58–59
  • Replay offers forensic, semantic, exact-eligibility, and fail-closed mocked modes, alongside structural diff with an exit-code contract and parameter diff.Intervention replay and non-MCP tool substitution are also listed.Source: §14 · p. 58
  • NovaSeal’s local profile uses DSSE P‑256, RFC 3161, and a Merkle log; maker-checker promotion and capsule attestation bind signers to an operator trust list or pinned CA.Source: §14 · pp. 58–59
  • Lineage supports SQLite and exports OpenLineage and W3C PROV, while additional graph backends and cross-site federation have different maturity levels.Cross-site lineage federation remains experimental, with a sovereignty review open.Source: §14 · p. 59
  • The capsule hierarchy supports parent-child views and distributed validation, but parent arrival counting and finalization are library-only rather than called by nova capture.The matrix also lists local, Docker, Kubernetes, Slurm, PBS, and LSF runners.Source: §14 · pp. 58–59
  • The Run Capsule and Evidence Bundle formats are not yet frozen, and NovaFabric does not claim million-agent readiness or compliance certification.The project describes itself as beta; its evidence is for compliance workflows, not certification.Source: §14 · pp. 58, 60

15 Roadmap and future work

The roadmap prioritizes freezing the capsule format and lists follow-ups, longer-horizon designs, and out-of-scope products. The report also documents engineering practices, security posture, and explicit security boundaries.

15.1 Now: freeze the capsule format

  • Freezing the v1.0 capsule format is gated on sign-off from independent design partners, not the maintainer's own validation.A migration to v1.0 already exists; freezing would put the format under a stability policy and RFC process.Source: §15.1 · p. 61

15.2 Planned follow-ups

  • Planned follow-ups include authenticated identities for maker-checker signers, capsule-scoped legal holds, capture-level policy enforcement, and additional runner context.Today, maker-checker signers are bound to an operator trust list, holds are registry-wide, and minimal and standard capture levels do not reduce capture.Source: §15.2 · p. 61

15.3 Longer horizon

  • Longer-horizon work includes post-quantum signing, cross-organization provenance federation, broader workload identity, and independently controlled regional cells.Federation's protocol is future design; the current system has a stateless fan-out query coordinator.Source: §15.3 · p. 62

15.4 Not planned

  • Real-time monitoring and alerting, hosted SaaS, and a prompt playground are out of scope by decision and assigned to adjacent tools.Source: §15.4 · p. 62

16.1 How it is built

  • The project describes quality gates, CI checks, and documentation guard tests, with a suite of 16,721 test functions in 1,239 files.The collector CI also runs go vet, the race detector, coverage, and govulncheck.Source: §16.1 · p. 63

16.3 Security posture

  • The security posture emphasizes opt-in network surfaces and runners, explicit environment-variable safety overrides, and pattern-based secret scanning with stated limits.The report also describes post-workload capsule cleanup and shared verification across CLI, dashboard, and API surfaces.Source: §16.3 · pp. 64–65

STATED SECURITY BOUNDARIES

  • The report disclaims FIPS validation, notes that hard links inside capsules are not detected by exporters, and says SAML awaits a dedicated security-architecture review.It also notes that old audit records retain the first eight characters of the serve token because the hash-chained log is not rewritten.Source: STATED SECURITY BOUNDARIES · p. 65

17 Conclusion

NovaFabric treats a sealed, replayable evidence capsule as a possible unit of accountability, while acknowledging that broader adoption remains unvalidated. Its engines are designed to refuse misleading or unsupported claims, and the report identifies work still needed.

17 Conclusion

  • Broader use of sealed, replayable capsules as an accountability unit remains an assumption; the report provides no evidence from independent verifiers, design partners, or adopters.Source: §17 · p. 66
  • Mocked replay fails closed on divergence, the diff gate distinguishes change from inability to compare, and unclassified dashboard routes are denied.Source: §17 · p. 66
  • Multi-tenant serving refuses startup when a store is unsafe, and cost aggregates refuse to print a misleading zero.Source: §17 · p. 66
  • PII erasure reaches data encrypted at capture, remains experimental and opt-in per subject, and defers while a legal hold is active.Source: §17 · p. 66
  • Signatures, Evidence Bundles, and maker-checker approvals are rejected when their claims are not covered, and dashboard trust views share the CLI verifier.Source: §17 · p. 66
  • Workload-planted links and special files are removed and recorded rather than followed, and the resulting capsule fails verification.Source: §17 · p. 66
  • The remaining work includes freezing the capsule format with independent partners, bringing prompt capture under capture-level policy, remeasuring due metrics, and proving the cluster tier on real HPC hardware.Source: §17 · p. 66

CLI command surface

The CLI inventory reports 150 top-level commands and 374 runnable paths, spanning capture, replay, evidence, policy, lineage, and operational workflows. The report also traces release changes, corrections, and code-verification methods through v0.107.0.

CLI command surface

  • The CLI has 150 top-level commands and 374 runnable paths at v0.107.0.The count is generated from the Typer application.Source: CLI command surface · p. 67

Selected groups

  • Selected command groups cover sealing and evidence, lineage and knowledge graphs, policy and promotion, audit and evaluation, server management, and session replay.Source: Selected groups · p. 68

What changed since Edition 1

  • Releases added witness co-signing (v0.75–0.91), lineage backends (v0.68–0.70), cloud KMS key-wrapping (v0.71–0.72), fail-closed mocked replay (v0.105), and signing intent inside the signature (v0.106).In v0.107, one verifier served nova verify, the trust radar, the Seal tab, and verify routes; every Evidence Bundle member was signed, with signer trust pinned by NOVAFABRIC_EVIDENCE_TRUSTED_KEYS.Source: What changed since Edition 1 · pp. 69–70

Corrections to Edition 1

  • The report corrects earlier claims: only forensic and air_gapped capture levels change recording behavior, full Merkle-root recomputation is the guarantee, and the seal latency gate is median under 50 ms.The p99 is an alarm because shared CI runners sometimes stall past it.Source: Corrections to Edition 1 · p. 70

Generated numbers

  • Counts are reproduced from the public v0.107.0 repository by a shipped probe script, except the ADR tally, which relies on private decision records.Source: Generated numbers · p. 71

Checked by hand against the code

  • The report's code review included end-to-end attacks on six v0.106 security fixes, each found blocked, and a separate AI-assisted pass cross-checked about 85 claims.Source: Checked by hand against the code · p. 72

Update to v0.107.0

  • For v0.107.0, every chapter was reread against the release code and changelog, while maker-checker trust binding, replay policy gates, parent finalization, and MCP recording behavior were rechecked.Parent finalization counts arrivals rather than child status; MCP hooks record full arguments and results at every capture level.Source: Update to v0.107.0 · p. 72

Diagrams

  • The report's diagrams were inspected as raster images, and three were corrected against code for maker-checker ordering, cluster deduplication, and parent-finalization semantics.Source: Diagrams · p. 73

Related papers

Loading 2610.34594v1…