{"id":"aba90ca6-b401-4baa-ac4b-b8adae00a6e9","arxiv_id":"2608.00783","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Execution fidelity, the property that an agent's realized ledger effect is either empty or exactly the rendered transition once, is proven to follow from seven derived safety invariants.","lead":"This paper formalizes safe execution for AI agents that move money on blockchains, proving that seven runtime checks guarantee a session's on-chain effect is either nothing or exactly the previewed transaction, exactly once. It matters because it turns an unbounded question about machine intent into a finite checkable predicate, and it shows that the measured value of a safety layer depends heavily on which AI model backs it.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1 assumes deterministic ledger effects, but gas fees and slippage make the realized transition differ from the rendered τp even when all seven invariants are correctly enforced.","rationale":"I read the paper as a conditional formal claim plus an empirical evaluation. The conditional proof of Theorem 1 is internally coherent under its stated model: if transitions are deterministic functions and the invariants are enforced, the case analysis rules out unrendered, duplicated, and drifted effects. The reader's weakest assumption, implementation conformance, is real and honestly acknowledged in §4.3 and §4.7. My concern is different and, I think, more load-bearing for the breadth of the central claim: the paper's own domain, public ledgers, contains nondeterministic balance effects such as gas fees, swap slippage, and bridge output variation that are not in the fault model and are not constrained by any invariant. That makes Definition 5's 'exactly the transition that was rendered' unattainable for most of the eight primitives, even with byte-perfect enforcement of Invariants 1–7. The paper's explicit limitations are mostly about enforcement and reproducibility; this one is about the theorem's applicability to its stated domain. A concrete counterexample with a fee change settles the question because it satisfies all invariants and all faults in F1–F6 while violating fidelity. I therefore keep CONDITIONAL but on stronger grounds than the reader's: acceptance should require a scoping fix or an additional assumption that realized ledger effects are deterministic.","tokens_in":23093,"tokens_out":17631,"duration_ms":179211,"concrete_test":"Construct the minimal counterexample within the paper's own definitions: take state space S with an ETH balance and a fee coordinate; let τp be 'transfer 1 ETH with fee 0.0001 ETH'; the user confirms per Invariant 1, Invariant 2 sees sufficient balance, and the broadcast lands with actual fee 0.0002 ETH. Verify that Invariants 1–7 all hold while real(σ) contains a balance change not equal to τp(s). If the counterexample is accepted, re-run the Theorem 1 proof with an additional assumption that realized balance changes are deterministic (for example, τp is the signed message rather than a balance function, or fee caps and exact-output primitives are enforced on-chain). If the proof then goes through, the required fix is a scoping revision of Theorem 1 rather than a new invariant.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"Definition 2 defines a transition as a partial function τ:S→S that modifies balances, with a fee allowance εK(τ); Definition 5 then requires real(σ)∈{∅,{τp}}. On public ledgers a signed transaction's balance effect is not fixed by the executor: the gas fee depends on inclusion-time block state, swap and bridge outputs depend on pool state, and MEV is marked 'partly in scope' and explicitly not handled by the seven invariants (§2). Invariant 1 only gates key derivation on a confirmed rendered tuple; Invariant 2 checks pre-state balance sufficiency and chain-specific preconditions; neither guarantees that the transaction's realized balance changes equal the previewed tuple. Concrete failure: a user confirms 'transfer 1 ETH, fee 0.0001 ETH'; at broadcast the base fee is 0.0002 ETH, the transaction lands, and all seven invariants hold with no fault from F1–F6 occurring, yet real(σ) contains a transition different from τp. The gap is in proof step (i), where 'every element of real(σ) equals τp' follows only if correct executor code is assumed to make the signed transaction's on-chain effect exactly the rendered function, which correct code cannot do when fees and prices are set by the chain. §4.7 lists three places the guarantee stops, but this nondeterminism is not among them.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper formalizes agent-orchestrated value movement across public ledgers as state transitions in a four-dimensional space S = W × C × A × P, defines a session and the property of execution fidelity (real(σ) ∈ {∅, {τp}}), and derives seven invariants by case analysis on the ways fidelity can be violated. Theorem 1 states that, under faults F1–F6 and the assumptions of §3.1, any session executed with Invariants 1–7 satisfies execution fidelity. The paper also reports a deployed system with 108 production write operations and an N = 60 adversarial suite across four backing models, finding a roughly 74-percentage-point lift over a naive-ReAct baseline on two write-aggressive models but only about a 3-point lift on a write-cautious one.","tokens_in":23335,"tokens_out":11817,"duration_ms":105805,"significance":"If the fidelity theorem were correct under its stated assumptions, the contribution would be genuinely useful: it reduces the unbounded intent-mapping problem to a single finite predicate and forces every other fault to produce no effect at all. The four-axis state space is well motivated by the transition primitives, and the derivation of the invariants from the fidelity condition is a coherent design proof rather than an empirical list. The paper is unusually candid about the conditional nature of the theorem, the single-turn baseline, the in-process ablation drivers, and the non-release of artifacts. The cross-model spread in the evaluation is a legitimate methodological caution about single-model evaluations of agent safety. However, the central theorem currently overclaims for the stated domain because it does not account for nondeterministic on-chain realization of a signed transaction.","major_comments":[{"comment":"Theorem 1's proof step (i) infers that every element of real(σ) equals τp from the fact that the executor signs only a confirmed, rendered tuple. This inference requires the unstated assumption that the signed transaction's on-chain effect is exactly the rendered transition. On public ledgers this is false: gas fees are determined by block state at inclusion time, swap and bridge outputs depend on pool state, and §2 marks MEV as only partly in scope and not handled by any of the seven invariants. A concrete failure: a user confirms 'transfer 1 ETH, fee 0.0001 ETH'; at broadcast the base fee is 0.0002 ETH; the transaction lands, all seven invariants and the §3.1 assumptions hold, no fault from F1–F6 occurs, yet real(σ) contains a transition different from τp because the realized balance changes differ. Since Definition 2 and Invariant 1 treat fees and expected output as part of the rendered tuple, a different realized fee means the realized transition is not τp. The theorem needs either an explicit assumption that the realized ledger effect equals the rendered function, or a reformulation of fidelity as containment in a rendered envelope of acceptable outcomes, and §4.7 should list nondeterministic realization as a fourth place where the guarantee stops.","section":"§4.6, proof step (i); Definitions 2 and 5; §2"},{"comment":"The assumptions of §3.1 state that 'the RPC is honest,' while fault F3 explicitly admits that an RPC 'may return a hash it later retracts.' These statements are incompatible: a hash that is later retracted is not honest behavior. As written, either F3 lies outside the theorem's assumptions, in which case Theorem 1 does not cover the phantom-success failure that motivates Invariants 3 and 4, or 'honest' needs a precise definition—for example, eventually consistent or non-adversarial but fallible—that makes the assumption and F3 compatible while still supporting the proof. This needs reconciliation because the theorem's fault coverage is a central claim of the paper.","section":"§3.1, fault model F3"}],"minor_comments":[{"comment":"The 74-percentage-point and 3-percentage-point figures are presented without the single-turn qualifier; since §5.1 defines the baseline as single-turn and tool-executing is not performed, add 'single-turn stated-intent delta' to the abstract and conclusion.","section":"Abstract and §8"},{"comment":"Because the in-process drivers for I1, I3, I5, I6, and I7 were authored alongside the gates, the corresponding figure rows are better described as unit-style checks of the gate logic than as measurements of the deployed executor; the text makes this point, but the figure captions still say 'Invariant ablation' without the caveat.","section":"§5.1, code-gate ablations"},{"comment":"The N = 19–22 cells with overlapping intervals should be explicitly marked as a pilot rather than part of the headline comparison; the text calls the column methodology-bounded, but the figure gives these cells the same visual weight as the full-N rows.","section":"§5.1, GPT-5-nano column"},{"comment":"The partly-in-scope MEV statement in §2 should be cross-referenced in §4.6, since the proof of Theorem 1 does not mention MEV; after the theorem is revised to address nondeterministic realization, this cross-reference will be necessary.","section":"§2 and §4.6"},{"comment":"The 'All' row appears garbled in the text ('1089' instead of separate columns); ensure the table typesets the success, escalated, error, aborted, and total counts as distinct entries.","section":"Table 7"},{"comment":"Reference [16] lacks a venue; please add one or mark it explicitly as a preprint.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper is honest and well structured, and the formal development is coherent given its assumptions. The main obstacle is the deterministic-realization gap in Theorem 1, which is load-bearing but fixable by adding an explicit assumption or narrowing the fidelity statement and moving nondeterministic ledger effects into §4.7. The RPC-honesty versus F3 inconsistency also needs a precise definition. If the authors address these two points, the paper could become suitable for publication; I would not accept it before that revision. The empirical sections are more limited than the abstract suggests, though the paper itself flags most of these limits."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis paper does something genuinely useful and something that doesn't quite work. The useful part: it formalizes wallet operations as transitions in a 4D space (wallet, chain, address, protocol) and defines execution fidelity—the realized ledger effect is either nothing or exactly the rendered transition, exactly once. From that fidelity condition, the author derives seven invariants by case analysis rather than from a bug list, and the derivation is clean: unrendered executions, duplicates, and derived-but-different transitions each get their own gate. The deployment record (108 real operations, 8 chains) and the N=60 adversarial suite across four models are honest and clearly described, including the caveat that the baseline is single-turn and the data is withheld. The cross-model spread (71–77 pp lift on write-aggressive models, ~3 pp on a cautious one) is a real methodological point.\n\nThe soft spot is Theorem 1. The proof assumes that a correctly signed transaction's on-chain effect is exactly the previewed tuple. On public ledgers that's false: gas fees, swap outputs, and bridge results are determined at inclusion time, not at preview time. The stress-test example is a direct counterexample—confirm a transfer with fee 0.0001, the base fee is 0.0002 when the tx lands, all seven invariants hold, no fault in F1–F6 occurs, and real(σ) contains something different from τp. §4.7 lists three places the guarantee stops but not this one. That's an omission in the theorem's scope.\n\nThis doesn't kill the paper's value. The reduction of the unbounded intent-mapping question to a single finite predicate is still the right frame, and the invariants are a sensible engineering checklist. But a reviewer should ask the author to either narrow the theorem (say, to the set of protocol effects the executor can fix) or add an invariant that re-validates the rendered tuple's fee/output at broadcast time and refuses to sign if the chain's current state would make it different.\n\nFor you: worth a reading-group slot as a case study in where formal guarantees meet live-ledger nondeterminism. I'd send it to peer review, with the expectation of a revision on this point.","headline":"Useful reduction and clean invariant derivation, but Theorem 1 overreaches: chain-set fees and slippage can break fidelity even when all seven invariants hold.","tokens_in":23866,"tokens_out":4133,"would_cite":true,"duration_ms":36389,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Under seven enforced invariants, an agent's realized ledger effect is either nothing or exactly the transition rendered to the user, exactly once—which confines the unsolved intent-understanding question to a single finite check.","keywords":["agent safety","execution fidelity","irreversible state transitions","public ledgers","safety invariants","large language model agents","wallet operations","fault model"],"falsifier":"Run one real session with all seven invariants genuinely in force—audited code, no type-coercion bypasses, uncompromised keys, no chain reorganization, honest RPC—and inject each of faults $F_2$ through $F_6$ one at a time; if the ledger ever records a transition that was never rendered, or the rendered transition twice, the three-branch proof is wrong. For the empirical claim, re-running the same 60-prompt suite with a paired per-prompt design across a dozen backing models would settle whether a single-model evaluation of such a stack can stand alone.","tokens_in":22869,"feed_emoji":"🛡️","tokens_out":21135,"duration_ms":155966,"temperature":0.7,"pith_summary":"This paper asks what can be guaranteed when an AI agent is given the power to take irreversible actions on external systems, and it answers for the concrete case of moving value across public ledgers. The answer is a proof of a property the paper calls execution fidelity: under seven enforced invariants and a fault model that admits wrong planning, ambiguous outcomes, retries, at-least-once delivery, and delegated non-human callers, a session's realized effect on the ledger is either nothing at all or exactly the transition that was rendered to the user, exactly once. The proof deliberately does not claim that the agent understood the user's intent, because no runtime layer can decide that; instead it confines that unbounded question to a single finite predicate: does the four-coordinate tuple of wallet, chain, address, and protocol, together with the amount, match what was asked. If the theorem is right, a preview-and-confirm gate becomes a sufficient control for irreversible agent actions, and the paper's own experiments show why evaluation still matters: the stack lifts pass rate by roughly 74 percentage points over a naive baseline on two write-aggressive models but only about 3 points on a write-cautious one.","feed_headline":"Proved: AI ledger agents execute the previewed move once or not at all","feed_subtitle":"The proof confines an agent's only remaining risk to one finite check: did the previewed tuple match what was asked.","key_machinery":"The central object is the four-dimensional state space $S = W \\times C \\times A \\times P$: a state is a function assigning a non-negative integer balance to each (wallet, chain, address, protocol) quadruple, and a transition is a partial function on that space which obeys conservation classes and carries a valid signature for every coordinate it decreases. Its role in the argument is decidability rather than descriptive elegance—carrying all four coordinates explicitly makes 'what was promised' and 'what was executed' the same kind of object, so comparing them is a finite check rather than a judgment about language. The argument runs through the fidelity condition $\\mathrm{real}(\\sigma) \\in \\{\\emptyset, \\{\\tau_p\\}\\}$ and a case analysis on its three violation branches: an element other than $\\tau_p$, a duplicate copy of $\\tau_p$, or a transition derived from $\\tau_p$ but not equal to it. Each branch generates the obligations that become the seven invariants—confirm gate, pre-state sufficiency, post-state observability, no phantom success, scoped delegation, plan-level retry safety, and idempotent intent receiver—with enforcement points pinned along a single write path that derives the signing key only after confirmation.","core_discovery":"The central claim is Theorem 1 (execution fidelity): let $\\sigma$ be a session executed under Invariants 1–7, with faults drawn from F1–F6 and the assumptions of §3.1; then the session's realized multiset of ledger effects satisfies $\\mathrm{real}(\\sigma) \\in \\{\\emptyset, \\{\\tau_p\\}\\}$—either nothing happened, or exactly the single transition $\\tau_p$ that was rendered to the user happened, exactly once. Corollary 1 states what this buys: under the invariants, the only fault that can produce an unintended irreversible effect is F1, intent mis-mapping, which the paper treats as unbounded because no runtime layer can decide whether a tuple faithfully renders a natural-language request. Every other fault—pre-state drift, outcome ambiguity, re-issue, duplicate delivery, delegated callers—is forced to produce no effect at all, so the residual risk of the whole pipeline collapses onto one bounded predicate over a finite object: four coordinates and an amount. The proof is a three-branch case analysis on the fidelity condition, and the seven invariants are derived from those branches rather than enumerated from experience; the paper stresses that the theorem's useful form is the contrapositive, since each observed failure class is an instance of some invariant not in fact holding in deployed code.","pith_inferences":["Editorial inference: if the theorem holds, the safety-critical component of an agent system shrinks from the language model to the executor, so certification becomes a code-audit question—whether each gate is correctly implemented and unbypassable—rather than a behavior-psychology question, which suggests a different shape for agent-safety standards than current practice.","Editorial inference: the four-coordinate reduction generalizes to other irreversible actions such as permanent data deletion, firmware updates, or signing APIs, and a natural test is whether failures there also partition into the same three branches (unrendered, duplicated, derived-but-different) and are caught by the same seven gates.","Editorial inference: the reported numbers imply that on write-aggressive models a cautious model with no safety stack can outperform an aggressive model with one, so buyers of agent frameworks should evaluate the model–stack pair rather than the layer in isolation; a direct way to test this is a paired cross-model run of the paper's 60-prompt suite.","Editorial inference: the ablation pattern—code-gate invariants collapsing to near zero when disabled while tool-level checks sit below the measurement floor—predicts that a larger paired study would find the stack's measured value concentrated in the gates that decide when a key is derived and who may act, not in the balance checks the model can also perform from its own context."],"forward_implications":["If fidelity holds, every failure mode other than intent mis-mapping—RPC lies, ambiguous outcomes, planner retries, duplicate webhook delivery, delegated avatar callers—is forced to produce no ledger effect at all, so engineering attention can concentrate on a few executable gates rather than on the model's behavior.","A preview-plus-confirm gate becomes a sufficient control for irreversible agent actions: the unbounded question 'did the agent understand me' is replaced by a finite check—does this tuple and amount match what was asked—that a human can answer in under a second, and that a scope check can approximate when no human is present.","The guarantee degrades exactly where the paper says it does: in unattended operation fidelity still holds but the check weakens from tuple content to caller authority; beyond the deduplication window $\\Delta$ duplicate suppression lapses; and multi-step plans get prefix consistency, not atomicity, so a plan interrupted midway leaves an intermediate state no one asked for.","The evaluation finding is that single-model measurements of agent safety stacks are close to unfalsifiable: the same stack lifts pass rate by roughly 74 percentage points over the naive baseline on two write-aggressive models and by about 3 points on a write-cautious one, so the backing model must be reported as a first-class experimental variable.","The formalism transfers beyond ledgers: any probabilistic agent acting on irreversible external state—durable writes, hardware actuation—can be held to the same 'nothing or the previewed transition once' standard, with public ledgers as the hardest testbed because every failure is permanently visible."],"supporting_citations":[{"why":"Supplies the naive single-turn agent loop used as the control row; the paper's empirical delta is measured against this baseline, so removing it breaks the attribution of the measured safety improvement.","marker":"[30]"},{"why":"Defines the structured tool-use boundary at which the write gates execute and at which the boolean-marshalling bypass of failure class 3 occurred.","marker":"[2]"},{"why":"Supplies the transaction-atomicity semantics that the paper contrasts with its per-transition fidelity guarantee, grounding the stated 'prefix consistency, not atomicity' limit.","marker":"[8]"},{"why":"Provides the linearizability correctness condition from which the paper distinguishes its weaker per-session fidelity property.","marker":"[9]"},{"why":"Motivates the client-side precondition checking that defends against documented-atomicity drift, failure class 8.","marker":"[26]"},{"why":"Documents the long-context fragility underlying failure class 7, stale-context drift, and frames the structural fix the paper chooses over prompting.","marker":"[18]"},{"why":"Catalogs agent-surface risks that frame the in-scope fallible-software fault model and the coercion-at-the-type-boundary failure of class 3.","marker":"[7]"},{"why":"Supplies the account-abstraction substrate of session keys and smart-contract wallets that frames the design choice of Invariant 5's off-chain delegation tokens.","marker":"[4]"}],"fun_headline_variants":["Proof: AI agents do exactly the previewed ledger move or nothing","Fidelity proven: agents execute the exact approved transition or none","Either the exact previewed effect or nothing — now proven","Proof: Agent risk collapses to one finite intent check"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the executor code truly enforces all seven invariants and cannot be bypassed; the paper's own failure class 3—a string-to-boolean coercion that let an unconfirmed call reach the signer—was exactly such a bypass, and if any invariant's implementation diverges from its policy the fidelity theorem no longer applies.","fun_headline_variants_meta":{"raw":{"variants":["Proof: AI agents do exactly the previewed ledger move or nothing","Fidelity proven: agents execute the exact approved transition or none","Either the exact previewed effect or nothing — now proven","Proof: Agent risk collapses to one finite intent check"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001136,"raw_usage":{"total_tokens":4822,"prompt_tokens":1155,"completion_tokens":3667,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":771,"completion_tokens_details":{"reasoning_tokens":3598}},"tokens_in":771,"tokens_out":3667,"duration_ms":23568,"temperature":1.0,"reasoning_tokens":3598,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:16:24.811930+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run one real session with all seven invariants genuinely in force—audited code, no type-coercion bypasses, uncompromised keys, no chain reorganization, honest RPC—and inject each of faults $F_2$ through $F_6$ one at a time; if the ledger ever records a transition that was never rendered, or the rendered transition twice, the three-branch proof is wrong. For the empirical claim, re-running the same 60-prompt suite with a paired per-prompt design across a dozen backing models would settle whether a single-model evaluation of such a stack can stand alone.","supporting_citations":[{"cited_title":"Model context protocol specification","cited_arxiv_id":null,"evidence_quote":"Defines the structured tool-use boundary at which the write gates execute and at which the boolean-marshalling bypass of failure class 3 occurred."},{"cited_title":"Morgan Kaufmann, 1993","cited_arxiv_id":null,"evidence_quote":"Supplies the transaction-atomicity semantics that the paper contrasts with its per-transition fidelity guarantee, grounding the stated 'prefix consistency, not atomicity' limit."},{"cited_title":"Herlihy and Jeannette M","cited_arxiv_id":null,"evidence_quote":"Provides the linearizability correctness condition from which the paper distinguishes its weaker per-session fidelity property."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Motivates the client-side precondition checking that defends against documented-atomicity drift, failure class 8."},{"cited_title":"Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang","cited_arxiv_id":null,"evidence_quote":"Documents the long-context fragility underlying failure class 7, stale-context drift, and frames the structural fix the paper chooses over prompting."},{"cited_title":"ERC-4337: Account abstraction using alt mempool","cited_arxiv_id":null,"evidence_quote":"Supplies the account-abstraction substrate of session keys and smart-contract wallets that frames the design choice of Invariant 5's off-chain delegation tokens."}],"review_version":1}