Unchained

The fully autonomous Digital Forensics & Incident Response (DFIR) agent: GPT-5.6 chooses where to look; deterministic code controls what may run and verifies exactly what was executed and cited.

Comment

Inspiration

Agentic AI produces a transcript - a self-reported story of what the model says it did. In DFIR, nobody can act on that: not an incident-response consultancy facing a regulator or opposing counsel, not an expert witness under oath. The gap is structural - the model's narrative and the evidentiary record are the same object, so nothing checks the narrative. Unchained separates them. The thesis: agentic AI in high-consequence domains is only sellable when every action it took can be checked by someone who trusts neither the agent, the vendor, nor the transcript.

What it does

GPT-5.6 chooses where to look; deterministic code controls what may run and verifies exactly what was executed and cited.

Prove it yourself in 60 seconds - $0, no API key:

git clone https://github.com/3sk1nt4n/Unchained.git; cd Unchained
.\setup.ps1
sentinel verify examples/public-run-complete --require-complete --require-live-gpt56

That prints VALID - 37 artifacts, 194 hash-chained audit entries: byte-exact offline re-verification of a real GPT-5.6 Sol COMPLETE investigation that ships in this repo (run 20260721T001718Z-f0cd5641): 31/31 typed Volatility tools across 20 adaptive turns on the public 2 GiB DC01 domain-controller memory image, 4 adjudicated findings (1 CONFIRMED / 2 NEEDS-REVIEW / 1 UNSUPPORTED) after a fresh-context downgrade-only review - $2.92, in 9m39s, custody intact.

Two more retained GPT-5.6 runs ship beside it - we keep PARTIAL and INVALID states rather than cherry-pick:

  • examples/public-run-partial (gpt-5.6-luna): 14/14 typed tools, then an honest stop at the hard budget ("MAX_TOOL_CALLS: reservation would reach 14 > 13") - PARTIAL, exit code 3, $1.16, 55.5 s, verifies VALID (20 artifacts / 62 audit entries) on current code.
  • docs/runs/sol-capped-dc01-opening.json (gpt-5.6-sol): 6/6 opening tools executed with provider request/response IDs retained; the 7th was refused before dispatch ("reservation would reach 7 > 6", duration_ms 0, "No successful forensic execution is claimed") - $0.39 under a $1.00 cap.

How it works:

  • Code profiles the evidence with zero model calls and seals SHA-256 custody before GPT-5.6 sees anything.
  • GPT-5.6 opens with up to twelve typed tools, validated all-or-none, executed in parallel; later turns allow one typed action each.
  • Only a typed finish_investigation(status="DONE") can end a case - prose has no terminal authority.
  • A fresh-context reviewer may preserve or downgrade findings, never promote.
  • Deterministic code resolves exact byte spans, renders the report and an inert no-JS viewer, seals a content-addressed bundle, and re-verifies the whole lifecycle offline.
  • Exactly 4 fixed GPT-5.6 requests plus one per adaptive action - never an unbounded loop.
  • Cross-OS proof: the Linux lanes ran live on 2026-07-21, and the Windows-sealed bundle strict-verifies VALID inside the no-network Linux container - byte-exact.

Honest limits, kept on purpose: one public case on one flagship OS route; no measured competitive benchmark (deliberately cut - no unmeasured claims); receipts prove execution and citation support, not forensic truth; bundles are locally sealed (external anchoring is future work).

How we built it

Codex Session ID: 019f61e5-5755-7a02-adb4-618d32baab27 (core build; /feedback uploaded). Codex was the primary implementation and adversarial-review collaborator: evidence lifecycle, Responses API adapter, typed execution boundary, caps, typed-DONE-v2 protocol, forced serializer, exact evidence spans, downgrade-only review, renderers, the independent offline verifier, CLI, Docker isolation, and the 378-test offline gate (ruff clean). A second Codex thread (019f76f3-a19f-71d1-81b2-eed6305857f6) carried the Docker/README/release work. The human owned the product thesis, the authority split, the DFIR testbed and DC01 case, the hard caps, the scope cuts, and every public claim. At runtime, GPT-5.6 Sol is both the investigator and the reviewer; GPT-5.6 Terra is the cheap rehearsal lane behind an explicit launch card and key step.

Challenges we ran into

  • Token throughput vs. rich context. New-account TPM ceilings (~200k/min) vs ~270k-token serializer packets meant 429s that end runs as honest PARTIALs, never silent retry storms. The shipped COMPLETE run finished within the stock HEAVY caps ($2.92 of $10; ~395,555 of 400,000 tokens); headroom overrides are documented for richer runs.
  • Fail-closed, proven in the receipts. Caps fire before dispatch: the retained receipt shows a 7th tool refused ("reservation would reach 7 > 6", duration_ms 0, "No successful forensic execution is claimed"), and the shipped PARTIAL bundle repeats it on current code ("reservation would reach 14 > 13").
  • All-or-none opening validation. One unknown, duplicate, or malformed call rejects the whole opening - no valid-looking subset ever runs. Harder than accepting best-effort output, and worth it.
  • Terminal authority. Prose, Markdown, and empty output cannot end a case; only the typed finish_investigation(status="DONE") can.
  • Honest census. Retained runs span COMPLETE, PARTIAL, and INVALID - all kept and labeled, never cherry-picked.

Accomplishments that we're proud of

  • 378/378 tests pass in 22.5s, ruff clean (2026-07-21, CPython 3.11.9).
  • Three authentic retained GPT-5.6 runs on real evidence, led by the shipped COMPLETE flagship: 31/31 typed tools, 20 turns, 4 adjudicated findings, custody match.
  • Byte-exact offline verification: strict verify → VALID, 37 artifacts / 194 audit entries (PARTIAL bundle: VALID, 20 / 62) - no network, no key.
  • Measured, capped spend on every run: $2.92 / $1.16 / $0.39 - each under its hard ceiling.
  • A $0 judge lane, an explicit launch-card + key spend gate, a bounded 4-plus-one-per-action invocation budget, and an inert sealed deliverable (static no-JS viewer + authoritative report + content-addressed manifest).

What we learned

  • The valuable line is not "an LLM can call forensic tools" - it is drawing the authority split sharply enough to inspect.
  • Saying what a proof does NOT establish is as important as saying what it does.
  • Fail-closed beats optimistic: refusing a tool before dispatch produced a more trustworthy artifact than any best-effort completion.
  • Typed terminal contracts turn "did it finish?" from a judgment call into a checkable fact.
  • Token budgeting is a first-class design constraint - TPM ceilings shape the protocol, not just the bill.
  • Monotonic review is cheap, honest safety: a reviewer that can only preserve or downgrade can never inflate.

What's next for Unchained

  • Having very shiny UX to get more cyber folks to DFIR field and have them use it in all SOC and IR centers!!!

  • Generalize the pattern beyond DFIR - security testing, compliance review, financial operations: model chooses bounded strategy → code executes typed authority → exact outputs and citations retained → a monotonic reviewer reduces claims → deterministic code renders and verifies the deliverable.

Unchained is not an LLM pretending to be evidence. It is GPT-5.6 directing a bounded investigation whose actions, citations, custody, and final report can be checked independently.

Built With

Share this project:

Updates