{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:CH54UXIDYMLLVZVLXHS27WEZ2B","short_pith_number":"pith:CH54UXID","canonical_record":{"source":{"id":"2605.01037","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-01T19:04:37Z","cross_cats_sorted":["cs.AI","cs.PL"],"title_canon_sha256":"43ad543f3bbf32328131ff02825593672ac719e97ec74ad13fe35c03dad3c638","abstract_canon_sha256":"3c3942450cd92f41ee0d6d1802af782ee1d0757050a9cf09f7bfc9ddabccc0af"},"schema_version":"1.0"},"canonical_sha256":"11fbca5d03c316bae6abb9e5afd899d07f7b2aefc4d72ffe93e6c9e9f373576a","source":{"kind":"arxiv","id":"2605.01037","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.01037","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"arxiv_version","alias_value":"2605.01037v3","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.01037","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"pith_short_12","alias_value":"CH54UXIDYMLL","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"pith_short_16","alias_value":"CH54UXIDYMLLVZVL","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"pith_short_8","alias_value":"CH54UXID","created_at":"2026-05-27T01:05:55Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:CH54UXIDYMLLVZVLXHS27WEZ2B","target":"record","payload":{"canonical_record":{"source":{"id":"2605.01037","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-01T19:04:37Z","cross_cats_sorted":["cs.AI","cs.PL"],"title_canon_sha256":"43ad543f3bbf32328131ff02825593672ac719e97ec74ad13fe35c03dad3c638","abstract_canon_sha256":"3c3942450cd92f41ee0d6d1802af782ee1d0757050a9cf09f7bfc9ddabccc0af"},"schema_version":"1.0"},"canonical_sha256":"11fbca5d03c316bae6abb9e5afd899d07f7b2aefc4d72ffe93e6c9e9f373576a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-27T01:05:55.577154Z","signature_b64":"Feh+ULE+oEdoeTmobonITOsA0b7NKJPhkp8Hy/NXbpUbzyaIfD8ky5zg8HsWIbprJlVtgzt3zUqkH3Ja9nT9Bg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"11fbca5d03c316bae6abb9e5afd899d07f7b2aefc4d72ffe93e6c9e9f373576a","last_reissued_at":"2026-05-27T01:05:55.576491Z","signature_status":"signed_v1","first_computed_at":"2026-05-27T01:05:55.576491Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.01037","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-27T01:05:55Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9Cb46R3S38zeFujn2QHVb7BQsud168Sope2Mjs/EDTGszJ1XvCrV9fFKKx0PP6WYbbdt+MOARPkxsNqGGI8BDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-31T22:15:37.257870Z"},"content_sha256":"f2163d60994639e39ce3b2390a17d8c98786b36524908851d115995aa203b3c7","schema_version":"1.0","event_id":"sha256:f2163d60994639e39ce3b2390a17d8c98786b36524908851d115995aa203b3c7"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:CH54UXIDYMLLVZVLXHS27WEZ2B","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Certified Purity for Cognitive Workflow Executors: From Static Analysis to Cryptographic Attestation","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Cognitive workflow executors achieve certified structural purity through WebAssembly restrictions and cryptographic attestation.","cross_cats":["cs.AI","cs.PL"],"primary_cat":"cs.CR","authors_text":"Alan L. McCann","submitted_at":"2026-05-01T19:04:37Z","abstract_excerpt":"We present a certified purity architecture that converts governance enforcement in cognitive workflow systems from a runtime convention into a structural capability boundary. A prior three-layer governance architecture proves governance completeness, provenance completeness, and the impossibility of ungoverned effects, conditional on the pure module constraint: that step executors cannot perform effects. That constraint was enforced by module import graph analysis, which is insufficient against adversarial bypass on the BEAM virtual machine. This paper closes the gap through four mechanisms: ("},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"We prove four theorems: structural purity by construction, bypass elimination for all five BEAM bypass classes, certificate integrity, and gate completeness. The guarantee holds relative to an explicit Trusted Computing Base.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"The pure module constraint (step executors cannot perform effects) from the prior three-layer governance architecture holds, and the Trusted Computing Base (including compilation, signing, and verification components) remains uncompromised.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"A certified purity system for workflow executors combines restricted WebAssembly compilation, signed certificates, and runtime gates to eliminate BEAM bypasses with sub-400us cycle times and under 0.4% overhead.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Cognitive workflow executors achieve certified structural purity through WebAssembly restrictions and cryptographic attestation.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"9078165fc9465160d75dbeccd3991a795470150efcb6f3805a2512e056c0bcfd"},"source":{"id":"2605.01037","kind":"arxiv","version":3},"verdict":{"id":"8e33f3ab-110d-44a5-87c9-72f6cfb94f3d","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-09T18:44:49.404966Z","strongest_claim":"We prove four theorems: structural purity by construction, bypass elimination for all five BEAM bypass classes, certificate integrity, and gate completeness. The guarantee holds relative to an explicit Trusted Computing Base.","one_line_summary":"A certified purity system for workflow executors combines restricted WebAssembly compilation, signed certificates, and runtime gates to eliminate BEAM bypasses with sub-400us cycle times and under 0.4% overhead.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"The pure module constraint (step executors cannot perform effects) from the prior three-layer governance architecture holds, and the Trusted Computing Base (including compilation, signing, and verification components) remains uncompromised.","pith_extraction_headline":"Cognitive workflow executors achieve certified structural purity through WebAssembly restrictions and cryptographic attestation."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.01037/integrity.json","findings":[],"available":true,"detectors_run":[{"name":"ai_meta_artifact","ran_at":"2026-05-20T18:39:30.912149Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_compliance","ran_at":"2026-05-19T17:41:01.703149Z","status":"completed","version":"1.0.0","findings_count":0}],"snapshot_sha256":"cf24ef6bd623480f35d7c1c0458336547e780ab9ebf8bbafab68087cc441bf13"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":"8e33f3ab-110d-44a5-87c9-72f6cfb94f3d"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-27T01:05:55Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zaBKu3lHqPfazIzGMIlJOgfc6mUaqJSq1MxlbB5obfuV9kQ4saEFRpU50ee0gD0KOt0Djw1MtsQ3pygAp0e4CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-31T22:15:37.258872Z"},"content_sha256":"ccd65b9f67ebbf5d40d5ddf00c987a9e76dc77d75f60c50e077081b117c32385","schema_version":"1.0","event_id":"sha256:ccd65b9f67ebbf5d40d5ddf00c987a9e76dc77d75f60c50e077081b117c32385"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/CH54UXIDYMLLVZVLXHS27WEZ2B/bundle.json","state_url":"https://pith.science/pith/CH54UXIDYMLLVZVLXHS27WEZ2B/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/CH54UXIDYMLLVZVLXHS27WEZ2B/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-31T22:15:37Z","links":{"resolver":"https://pith.science/pith/CH54UXIDYMLLVZVLXHS27WEZ2B","bundle":"https://pith.science/pith/CH54UXIDYMLLVZVLXHS27WEZ2B/bundle.json","state":"https://pith.science/pith/CH54UXIDYMLLVZVLXHS27WEZ2B/state.json","well_known_bundle":"https://pith.science/.well-known/pith/CH54UXIDYMLLVZVLXHS27WEZ2B/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:CH54UXIDYMLLVZVLXHS27WEZ2B","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3c3942450cd92f41ee0d6d1802af782ee1d0757050a9cf09f7bfc9ddabccc0af","cross_cats_sorted":["cs.AI","cs.PL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-01T19:04:37Z","title_canon_sha256":"43ad543f3bbf32328131ff02825593672ac719e97ec74ad13fe35c03dad3c638"},"schema_version":"1.0","source":{"id":"2605.01037","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.01037","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"arxiv_version","alias_value":"2605.01037v3","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.01037","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"pith_short_12","alias_value":"CH54UXIDYMLL","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"pith_short_16","alias_value":"CH54UXIDYMLLVZVL","created_at":"2026-05-27T01:05:55Z"},{"alias_kind":"pith_short_8","alias_value":"CH54UXID","created_at":"2026-05-27T01:05:55Z"}],"graph_snapshots":[{"event_id":"sha256:ccd65b9f67ebbf5d40d5ddf00c987a9e76dc77d75f60c50e077081b117c32385","target":"graph","created_at":"2026-05-27T01:05:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"We prove four theorems: structural purity by construction, bypass elimination for all five BEAM bypass classes, certificate integrity, and gate completeness. The guarantee holds relative to an explicit Trusted Computing Base."},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"The pure module constraint (step executors cannot perform effects) from the prior three-layer governance architecture holds, and the Trusted Computing Base (including compilation, signing, and verification components) remains uncompromised."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"A certified purity system for workflow executors combines restricted WebAssembly compilation, signed certificates, and runtime gates to eliminate BEAM bypasses with sub-400us cycle times and under 0.4% overhead."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"Cognitive workflow executors achieve certified structural purity through WebAssembly restrictions and cryptographic attestation."}],"snapshot_sha256":"9078165fc9465160d75dbeccd3991a795470150efcb6f3805a2512e056c0bcfd"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[{"findings_count":0,"name":"ai_meta_artifact","ran_at":"2026-05-20T18:39:30.912149Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_compliance","ran_at":"2026-05-19T17:41:01.703149Z","status":"completed","version":"1.0.0"}],"endpoint":"/pith/2605.01037/integrity.json","findings":[],"snapshot_sha256":"cf24ef6bd623480f35d7c1c0458336547e780ab9ebf8bbafab68087cc441bf13","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"We present a certified purity architecture that converts governance enforcement in cognitive workflow systems from a runtime convention into a structural capability boundary. A prior three-layer governance architecture proves governance completeness, provenance completeness, and the impossibility of ungoverned effects, conditional on the pure module constraint: that step executors cannot perform effects. That constraint was enforced by module import graph analysis, which is insufficient against adversarial bypass on the BEAM virtual machine. This paper closes the gap through four mechanisms: (","authors_text":"Alan L. McCann","cross_cats":["cs.AI","cs.PL"],"headline":"Cognitive workflow executors achieve certified structural purity through WebAssembly restrictions and cryptographic attestation.","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-01T19:04:37Z","title":"Certified Purity for Cognitive Workflow Executors: From Static Analysis to Cryptographic Attestation"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.01037","kind":"arxiv","version":3},"verdict":{"created_at":"2026-05-09T18:44:49.404966Z","id":"8e33f3ab-110d-44a5-87c9-72f6cfb94f3d","model_set":{"reader":"grok-4.3"},"one_line_summary":"A certified purity system for workflow executors combines restricted WebAssembly compilation, signed certificates, and runtime gates to eliminate BEAM bypasses with sub-400us cycle times and under 0.4% overhead.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"Cognitive workflow executors achieve certified structural purity through WebAssembly restrictions and cryptographic attestation.","strongest_claim":"We prove four theorems: structural purity by construction, bypass elimination for all five BEAM bypass classes, certificate integrity, and gate completeness. The guarantee holds relative to an explicit Trusted Computing Base.","weakest_assumption":"The pure module constraint (step executors cannot perform effects) from the prior three-layer governance architecture holds, and the Trusted Computing Base (including compilation, signing, and verification components) remains uncompromised."}},"verdict_id":"8e33f3ab-110d-44a5-87c9-72f6cfb94f3d"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f2163d60994639e39ce3b2390a17d8c98786b36524908851d115995aa203b3c7","target":"record","created_at":"2026-05-27T01:05:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3c3942450cd92f41ee0d6d1802af782ee1d0757050a9cf09f7bfc9ddabccc0af","cross_cats_sorted":["cs.AI","cs.PL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-01T19:04:37Z","title_canon_sha256":"43ad543f3bbf32328131ff02825593672ac719e97ec74ad13fe35c03dad3c638"},"schema_version":"1.0","source":{"id":"2605.01037","kind":"arxiv","version":3}},"canonical_sha256":"11fbca5d03c316bae6abb9e5afd899d07f7b2aefc4d72ffe93e6c9e9f373576a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"11fbca5d03c316bae6abb9e5afd899d07f7b2aefc4d72ffe93e6c9e9f373576a","first_computed_at":"2026-05-27T01:05:55.576491Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-27T01:05:55.576491Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Feh+ULE+oEdoeTmobonITOsA0b7NKJPhkp8Hy/NXbpUbzyaIfD8ky5zg8HsWIbprJlVtgzt3zUqkH3Ja9nT9Bg==","signature_status":"signed_v1","signed_at":"2026-05-27T01:05:55.577154Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.01037","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f2163d60994639e39ce3b2390a17d8c98786b36524908851d115995aa203b3c7","sha256:ccd65b9f67ebbf5d40d5ddf00c987a9e76dc77d75f60c50e077081b117c32385"],"state_sha256":"21a2f0a877f9ca784493579b3ce47eb1e640b0a606859ce36ba545ed6e36c36e"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"v4dE2lg9oUOkah00nvSGHg9kQHLoz3+eVdB2g5PGm4CGQw9E4/5h0HbmtBYNVt5dCkOfjjFMV30edSnh08dLBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-31T22:15:37.263362Z","bundle_sha256":"69c56fe8fcdde51b97c7e1c46fb9c9c32c8e9d74ac87e320fe9fc25b0be959ff"}}