ProofToAct

Admissibility memory for high-stakes agents

Comment

Remembered is not admissible—and admissible is not authorized

Most agent-memory systems ask, “What is relevant?” ProofToAct asks two harder questions: “What is still admissible?” and “What authority is still spendable now?”

Long-lived agents carry memory across sessions, tools, and replacement processes. ProofToAct makes that memory useful without treating it as automatic truth or transferable authority. Remembered evidence is re-admitted against current provenance, validity, scope, revocation, and conflict state. Authority is checked and committed separately.

Three states, not one

  • Remembered: evidence exists in persistent memory.
  • Admissible: deterministic current-state gates accept it.
  • Authorized: a bounded action holds current durable authority.

The synthetic Highwater Drill makes these boundaries inspectable. It is a research demonstration for reasoning about long-lived agents and bounded authority.

Admit before ranking

The reviewed source models evidence, verification and conflict state, short-lived retrieval snapshots, authority receipts, fences, outbox intent, and recovery lineage in one CockroachDB consistency domain. Deterministic SQL decides which memories are admissible before semantic ranking. A semantically attractive record loses before ranking when its provenance, validity, scope, revocation, or conflict state is unacceptable.

Distributed Vector Index g1_vector_candidates_embedding_idx ranks only the admitted snapshot. The selected-evidence identity remains bound through the authority request.

Similarity proposes. Deterministic admissibility decides what similarity is allowed to see. Authority is committed separately.

Commit authority once

The authority path models serializable transactions, resource locking, logical-operation binding, fencing, durable receipts, and one outbox intent. Exact replay resolves to the same modeled durable result, while a changed-input attempt cannot silently mint a second result.

A connection failure after COMMIT dispatch creates ambiguity. ProofToAct distinguishes known pre-commit serialization aborts from commit ambiguity and switches to read-only reconciliation. When one coherent database outcome cannot be established, the modeled path returns UNKNOWN_DO_NOT_ACT.

Recover context without recovering power

The CockroachDB Cloud Managed MCP recovery contract is a bounded read-only select_query path. It returns checkpoint, evidence, conflict, and receipt context while withholding operation, effect, fence, lease, credential, and execution authority. Fresh authorization remains a separate step.

CockroachDB and AWS architecture

The repository contains AWS Lambda and API Gateway handlers plus infrastructure definitions for separated agent, authority, boundary, signer, public-demo, and evidence roles. The Lambda boundary carries the same request, DVI-selection, serializable authority, fencing, receipt, and read-only reconciliation contracts modeled in the CockroachDB layer.

This architecture keeps retrieval and transactional memory in one consistency domain: deterministic admission precedes Distributed Vector Indexing, the selected evidence is bound into the authority decision, and Managed MCP recovery returns context through a deliberately narrower interface.

Try the public judge experience

Open https://flash-bri.github.io/prooftoact/ in a signed-out browser.

Use Act I to compare admitted and refused synthetic evidence, Act II to follow the one-outcome authority boundary, and Act III to recover context without authority transfer. Previous, Play/Pause, Next, Restart, Left/Right, Space, and Home provide direct replay control.

The deterministic public replay exposes the synthetic scenario, source identity, and SHA-256 manifest used to render the walkthrough. The public under-three-minute video is https://youtu.be/32X1suFvTEA.

Verified source identity

What we learned

Similarity is a proposal mechanism, not an authorization mechanism. Persistent agent memory benefits from explicit provenance, time, scope, conflict, revocation, and authority semantics. A successor agent can inherit evidence and context without automatically inheriting the previous agent’s permission to act.

All Highwater Drill scenario data is synthetic. ProofToAct makes no production-safety or exactly-once external-effect claim.

Built With

  • amazon-api-gateway
  • aws-lambda
  • cockroachdb
  • cockroachdb-cloud
  • cockroachdb-cloud-managed-mcp-server
  • distributed-vector-indexing
  • javascript
  • node.js
Share this project:

Updates