Mechanism

The append-only mutation lineage records the evolutionary history of a semantic agent's identity as a tamper-evident sequence of structured entries. Each entry captures a transition to a new successor Dynamic Agent Hash (DAH) together with the host device identity, semantic context, a timestamp, and a mutation-class label. The lineage is the persisted form of the trust slope: rather than a static credential, an agent's identity is the cumulatively validated sequence of DAHs produced by successive, verifiable mutations, and the lineage log is where that sequence is written down so that downstream verifiers can audit it.

Each entry is produced by the same successor rule used throughout the substrate. For entry i, the agent computes the successor identity as H(DAH_{i-1} || mu_host,i || Ext(X_A,i) || salt_A,i || tag) in the local-state embodiment, or as H(DAH_{i-1} || mu_host,i || KDF(HWID, salt_A,i) || tag) in the hardware-anchor embodiment, with the extractor output and hardware-anchor contribution concatenated in a hybrid configuration. Here mu_host,i is a host mutation token derived from the executing host's current Dynamic Device Hash (DDH) and the mutation class, so each agent-side transition is entangled with the device that executed it.

What An Entry Contains

A first lineage entry records the initial successor identity along with the executing host's device hash, an initialization context, and a timestamp, and is classified with an initialization class indicator and signed by the executing host. In the disclosed example, a first entry captures DAH_1 together with the host device identity DDH_1, a semantic context Ctx_1, and a timestamp T_1; a subsequent entry advances the agent identity to DAH_2 under a policy-driven mutation class; and a further entry advances to DAH_3 under a migration class.

For each entry, the recorded fields are the prior DAH, the resulting successor DAH, the host DDH in effect at execution, the mutation class, and a timestamp. The executing host appends a host-signed entanglement trace that binds the host mutation token mu_host,i to the disclosed DDH for that epoch. The entanglement trace is what couples the agent-side transition to a specific device identity at the moment of execution, so a verifier can later confirm not only that the successor is a valid descendant of its predecessor but also that the mutation was executed on a host whose device identity is consistent with policy.

Per-Entry Digest And Cumulative Chain

Integrity of the lineage is preserved by a cumulative chain hash that is updated at each entry. A structured per-entry digest is computed over the contents of the entry and then folded into the cumulative hash, computed in one embodiment as C_i = H(C_{i-1} || ...), where each new cumulative value is hashed from the prior cumulative value together with the new per-entry digest. The result is a forward-secure ledger in which any omission, reordering, or modification of entries is detected by divergence of the terminal cumulative value: a verifier who recomputes the chain and finds that its terminal value does not match the trusted reference has detected tampering, without needing to inspect each entry in isolation.

This construction is the source of the lineage's tamper evidence. Because each cumulative value depends on every preceding entry, an adversary cannot remove, substitute, or reorder a single entry without changing the terminal value, and cannot recompute a consistent terminal value without reproducing the entire valid history. The chain is forward-secure in the sense that the integrity of past entries is fixed once they are folded into the cumulative value.

Periodic Anchors For Bounded Proofs

In size-bounded deployments, periodic anchors are emitted every fixed number of entries, denoted J in the disclosure, by hashing the then-current cumulative value with the prior anchor. Anchors enable compact proofs over long histories without retaining every intermediate entry. A verifier that holds a trusted anchor can validate a window of recent entries against it rather than walking the entire chain from genesis, which is what makes the lineage practical for memory-constrained and intermittently connected substrates.

The disclosure does not fix a single value for the anchor interval J; J is a deployment parameter applied in size-bounded embodiments. Anchors are produced as part of the lineage by hashing the then-current cumulative value with the prior anchor, and the disclosure describes them as a mechanism for compact proofs and bounded validation across long histories without retaining all intermediate entries.

Validation By Bounded Replay

Validation proceeds through bounded replay from a stored reference. A verifier issues a lineage request and receives a proof window comprising the referenced entries, the corresponding host signatures, and either a terminal cumulative hash or a set of periodic anchors sufficient to validate the window. The verifier checks the host signatures against the disclosed host identities, recomputes each successor identity using the disclosed entanglement inputs, verifies that the host mutation token aligns with the referenced host DDH and mutation class, and folds the per-entry digests to recompute the cumulative chain.

Acceptance follows when the recomputed cumulative chain opens to the trusted anchor and all per-entry checks succeed. If the cumulative chain fails to match the provided terminal value or cannot be opened against the periodic anchors, the verifier records a tamper finding in local memory under policy. Because every check is performed against locally retained materials and the disclosed proof window, validation requires no external authority, no persistent key registry, and no synchronized ledger.

Replay And Tamper Resistance

Replay resistance and non-transferability are enforced during validation by rejecting entries whose successor identity regresses relative to the verifier's stored reference and by rejecting entries whose freshness input is stale or inconsistent with policy cadence. An entry that reproduces a previously accepted successor for the same sender and context within a replay horizon is rejected as a replay. Any omission, substitution, or reordering attempt is detected when the cumulative chain fails to match the provided terminal hash or cannot be opened against the periodic anchors, producing a tamper finding recorded in local memory under policy.

The lineage thus provides verifiable provenance for semantic agents operating across decentralized substrates. It supports incremental validation from recent anchors, complete reconstruction from earlier checkpoints, and reliable detection of spoofing, forgery, and replay attempts using only locally available materials and bounded proofs.

Neutrality To Unpredictability Source

The lineage is neutral to the source of per-step unpredictability and compatible with domain-specific governance. Hardware-anchor embodiments derive freshness solely from per-epoch salted hardware identifiers; local-state embodiments derive freshness from extractor outputs over stability-tuned local-state vectors; hybrid embodiments concatenate both into the successor rule. The chaining, signing, anchoring, and replay-based validation are identical across these embodiments, so heterogeneous devices can participate in the same lineage while preserving cryptographic interoperability through the cumulative chain and anchors.

Lineage entries may carry additional metadata such as mutation-class labels or execution-zone identifiers, enabling heterogeneous trust domains to enforce local acceptance criteria. Across distributed substrates, an agent migrating between hosts accumulates a sequence of entangled entries that forms a multi-node provenance path, binding each agent-side identity transition to the host on which it occurred without any global registry or shared ledger.

Disclosure Scope

The append-only mutation lineage log, comprising structured entries that each record the prior DAH, the successor DAH, the host DDH in effect at execution, the mutation class, a semantic context, and a timestamp; the host-signed entanglement trace that binds the host mutation token to the disclosed DDH; the per-entry digest folded into a cumulative chain hash computed as C_i = H(C_{i-1} || ...); the periodic anchors emitted every J entries to support compact proofs; and validation by bounded replay from a stored reference with detection of omission, reordering, modification, and replay through divergence of the terminal cumulative value, is disclosed in U.S. Application No. 19/388,580. This article describes that disclosed mechanism. The scope is neutral to the underlying hash, signature, or extractor primitive and to the unpredictability source, extending to hardware-anchor, local-state, and hybrid embodiments and to single-host and cross-substrate lineages, provided each transition is entangled to a host device identity and chained into the cumulative, anchored log.