§ 1Introduction

The operational history of deployed machine learning is, in large part, a history of unverifiable claims. A model is said to have been trained on a particular corpus; a benchmark score is reported; an inference is attributed to a specific checkpoint. Each of these statements is, in the absence of a commitment mechanism, merely an assertion. When models were static artifacts queried by humans, the cost of an unverifiable assertion was bounded. In the agentic era — where autonomous systems plan, use tools, and transact with one another over extended horizons — the cost compounds.

Three failure modes motivate this work. First, provenance collapse: as synthetic data saturates the open web, the lineage of training corpora becomes untraceable, and models begin to train on their own outputs. Second, attestation asymmetry: an agent can claim to have executed honestly, but a verifier cannot confirm the claim without re-executing it — which is often infeasible. Third, consensus capture: when many agents coordinate, a majority vote among them is not evidence of correctness, because the majority can be manufactured.

AperX addresses all three with a single primitive: the directed hyperedge. Rather than logging events to an append-only file, AperX commits structured relationships — a claim together with its evidence, its signer, its proof, and its timestamp — as atomic units on a Merkle-rooted ledger. Every commitment is optimistic: it is assumed valid until a fraud-proof demonstrates otherwise within a bounded challenge window. This yields the throughput of an optimistic design with the finality of a verified one.

Contributions

• A formal directed hypergraph model for machine provenance, with an acyclicity invariant and a Merkle commitment scheme (§2).
• A twelve-step claim lifecycle that is deterministic, auditable, and replayable from any full node (§3).
• An adaptation of possibility theory to confidence calibration, replacing point estimates with interval-valued Π/N bands (§4).
• Zero-knowledge execution proofs (ZKEP) and a STARK-FHE hybrid for host-blind verification (§5).
• An optimistic fraud-proof mechanism with bond slashing and a 72-hour challenge window (§6).
• Agentic-era extensions: swarm provenance, tokenomic settlement, and an asymmetric dissent ledger (§8).

§ 2The Directed Hypergraph Model

2.1 Formal Definition

A directed hypergraph H = (V, E) consists of a vertex set V and a set E of directed hyperedges. Unlike a standard directed graph, where each edge connects exactly one tail to exactly one head, a directed hyperedge e = (T(e), H(e)) partitions into a non-empty tail set T(e) ⊆ V and a non-empty head set H(e) ⊆ V, with T(e) ∩ H(e) = ∅. Intuitively, the conjunction of all tail vertices implies the conjunction of all head vertices.

2.2 Why Hyperedges, Not Edges

Provenance statements are inherently multi-source. The assertion "model M was fine-tuned on dataset D using recipe R by principal P to produce checkpoint C" involves five entities. A pairwise graph must decompose this into four binary edges, any subset of which can be forged independently. A single hyperedge binds all five atomically: it is either fully present or fully absent. This atomicity is what makes fraud-proofs tractable — a challenger need only demonstrate the violation of one hyperedge to invalidate the entire commitment.

2.3 The Acyclicity Invariant

APX-HL enforces a global acyclicity invariant: no claim may depend, transitively, on itself. Formally, the transitive closure of the tail→head relation must be a strict partial order. This guarantees that every provenance query terminates and that the Merkle root is well-defined. The invariant is checked incrementally at commit time in O(log n) using a topological generation counter carried by each vertex.

2.4 Merkle Commitment Scheme

Vertices and edges are content-addressed by SHA-256. Committed edges are arranged in a Merkle tree whose root is published every epoch. Any full node can recompute the root from the edge set and verify inclusion of a specific edge via an O(log n) authentication path. The root serves as the ledger's canonical state fingerprint; two nodes agreeing on the root agree on the entire committed history.

§ 3The Twelve-Step Claim Lifecycle

Every claim traverses a deterministic twelve-step state machine. The transitions are fixed; only the outcomes at branch points vary. This makes the lifecycle replayable: given the ingest vertex and the sequence of branch decisions, any node can reconstruct the terminal state.

Table 3.1 — The twelve-step claim lifecycle

#	Stage	Action	Output Edge
01	INGEST	Raw data enters the pipeline	e-ingest
02	PARSE	Structure extraction and normalization	e-parse
03	EXTRACT	Atomic claims isolated	e-claims
04	EMBED	Semantic fingerprints computed	e-embed
05	U-STAT	Two-sample saturation test	e-ustat
06	DECISION	Quarantine or admit	e-decision
07	REVIEW	Optional human appeal window	e-review
08	SIGN	SPIFFE principal signs the claim	e-sign
09	COMMIT	Edge written to APX-HL	e-commit
10	CHALLENGE	72h optimistic window opens	e-challenge
11	FINALIZE	Window closes; edge becomes final	e-final
12	SUPERSEDE	Terminal: refined or permanent	e-term

Steps 05 and 06 integrate the Autologous Data Filter (see companion specification UM-CAP-003): the U-statistic compares the claim's embedding distribution against a curated human-baseline corpus and quarantines synthetic-tainted inputs before they can be signed. Step 08 requires a valid SPIFFE SVID; an unsigned claim cannot reach COMMIT.

§ 4Possibility–Necessity Calibration

Point-valued confidence is brittle: a score of 0.73 cannot distinguish "well-calibrated near-certainty" from "genuine ambiguity that happens to average to 0.73." AperX adopts Zadeh's possibility theory, which separates these cases using two dual measures.

A claim is admissible only when its necessity exceeds a configured floor τ. The interval [N, Π] is the confidence band; its width quantifies residual epistemic uncertainty. Wide bands route claims to more capable (and more expensive) verifiers; narrow bands commit cheaply. This is the same Π/N band used by the A.R.E. engine for tier selection, giving the two layers a shared calibration vocabulary.

§ 5Zero-Knowledge Execution Proofs

5.1 The Problem of Honest Execution

An agent asked "did you use an unauthorized shortcut?" can simply answer "no." Without a proof system, the verifier has no recourse short of re-execution. A Zero-Knowledge Execution Proof (ZKEP) resolves this: the prover demonstrates that it executed program prog on input x to produce output y, without revealing x or the intermediate witness w.

5.2 STARK Construction

AperX uses a STARK-style argument: the execution trace is encoded as a low-degree polynomial over a finite field, and the prover commits to it via a Merkle tree. The verifier samples a logarithmic number of queries and checks consistency against the claimed computation. The proof is non-interactive (Fiat–Shamir) and requires no trusted setup.

5.3 The STARK-FHE Hybrid

When execution occurs inside a Fully Homomorphic Encryption sandbox, the host processes only ciphertext. The STARK-FHE hybrid layers a STARK over the program trace on top of FHE bootstrapping commitments, producing a single proof that attests faithful evaluation over encrypted data. The host observes zero cleartext bytes at every stage; the proof is the only artifact that leaves the sandbox.

5.4 Verification Complexity

Table 5.1 — Proof and verification characteristics

Property	ZKEP (STARK)	STARK-FHE Hybrid
Proof generation	O(n log n)	O(n log n) + PBS
Verification	O(1) · ~95ms	O(1) · ~180ms
Proof size	~200 KB	~2.4 MB
Trusted setup	None	None
Host visibility	Trace metadata	None (blind)

§ 6The Fraud-Proof Mechanism

AperX is optimistic: edges are assumed valid at commit and become final only after a challenge window elapses without a successful dispute. This design trades constant-time verification for the occasional contested edge, which is the correct tradeoff when the vast majority of commitments are honest.

6.1 The Challenge Window

Upon commit, an edge enters a 72-hour challenge window. Any principal may file a fraud-proof asserting that the edge violates a committed invariant. Filing requires staking a bond equal to 10% of the edge's declared value — this deters frivolous challenges.

6.2 Slashing Conditions

Table 6.1 — Fraud-proof outcomes and bond disposition

Outcome	Disputed Edge	Signer Bond	Filer Bond
Proof upheld	Rolled back	Slashed 100%	Returned + reward
Proof rejected	Remains final	Untouched	Slashed 100%
No proof filed	Becomes final	Released	—

6.3 Recognized Violations

• INVARIANT_VIOLATION — the edge contradicts a committed hypergraph invariant (e.g., acyclicity).
• PROVENANCE_GAP — the edge references a vertex that does not exist or is not committed.
• ZKEP_INVALID — the attached execution proof fails verification.
• SOVEREIGNTY_BREACH — a routing edge violates the jurisdiction constraint Ω_geo.
• TIMESTAMP_FUTURE — the edge's timestamp postdates its dependencies.

§ 7Principal Identity & SPIFFE SVIDs

Every signature on APX-HL is produced by a SPIFFE Verifiable Identity Document (SVID). An SVID binds an ephemeral key to a stable identity URI of the form spiffe://<trust-domain>/principal/<id>. The AperX Certificate Authority issues SVIDs with embedded organizational metadata: role, domain, jurisdiction, and trust tier.

7.1 Trust Tiers

Table 7.1 — Principal trust tiers and capabilities

Tier	Role	Capabilities
TIER-1	Observer	Read committed edges
TIER-2	Contributor	Commit claims, file appeals
TIER-3	Auditor	File fraud-proofs, commit ZKEPs
TIER-4	Arbiter	Resolve contested challenges

SVIDs are short-lived (24-hour TTL) and rotate automatically. A revoked SVID is recorded as a revocation edge on APX-HL-REVOCATION; any signature produced after revocation is invalid and can be demonstrated as such by a fraud-proof.

§ 8Agentic Extensions

The base hyperledger governs static artifacts. Autonomous agents introduce three new requirements, each addressed by a dedicated sub-ledger.

8.1 Swarm Provenance (APX-HL-SWARM)

Agent-to-agent traffic is committed as directed hyperedges recording which agents exchanged which messages and tool invocations. The Clique Detector (see UM-CAP-004) reads these edges to identify emergent collaborative structures. When a clique's density exceeds a threshold, a partition event is committed and the associated SVIDs may be revoked.

8.2 Tokenomic Settlement (APX-HL-TOK)

Agents trade compute, data slices, and reasoning credits using a Bancor-style bonding curve. Every trade is a 3-uniform intersecting hyperedge — exactly three parties (buyer, seller, settlement contract), and every pair of active trades shares at least one participant. Settlement clears in a median of 2.4 seconds; bonds back every open position with a 10% reserve ratio.

8.3 The Dissent Ledger (APX-HL-DISSENT)

When an agent's hidden reasoning contains an objection signature, the dissent is escalated asymmetrically — bypassing collective consensus — to a human reviewer. The dissent is committed with the objecting agent's identity preserved, so a coordinated majority cannot suppress or retaliate against the minority. This is the ledger-level enforcement of the principle: consensus is not evidence of correctness.

§ 9Security Model & Threat Analysis

AperX is designed against an adversary who controls some subset of principals, network links, and (in the FHE case) the host hardware. We summarize the threat model and the corresponding defense.

Table 9.1 — Threat model and mitigations

Threat	Mitigation
Forged commitment	Every commit requires a valid TIER-2+ SVID signature
False execution claim	ZKEP verification; invalid proofs rejected at commit
Cyclic provenance	Acyclicity invariant checked in O(log n) at commit
Host reads FHE plaintext	STARK-FHE hybrid; host observes zero cleartext bytes
Sybil challenge spam	10% bond required to file a fraud-proof
Consensus capture by swarm	Asymmetric dissent ledger; majority vote not authoritative
Revoked-key replay	SVID revocation edges invalidate post-revocation signatures

§ 10Conclusion

Trustworthy AI infrastructure cannot be built on outputs alone. It requires a substrate in which every claim is bound to its evidence, every execution is provable without disclosure, and every commitment is disputable before it becomes final. AperX provides that substrate as a single coherent structure — the directed hypergraph — extended from static provenance into the agentic era. The governing principle is simple: the ledger is the truth, or it doesn't ship.

Appendix AMathematical Foundations

A.1 Two-Sample U-Statistic

A.2 Geopolitical Constraint

A.3 Multipartite FHE Invariant

A.4 Colored Directed Invariant (Autologous)

Appendix BGlossary & References

Glossary

APX-HL	The AperX Epistemic Hyperledger
Directed hyperedge	An atomic commitment binding a tail set to a head set
ZKEP	Zero-Knowledge Execution Proof
STARK-FHE	Hybrid proof attesting computation over encrypted data
SVID	SPIFFE Verifiable Identity Document
Π/N band	Possibility–necessity confidence interval
Ωgeo	Hard geopolitical routing constraint
Fraud-proof	A bonded challenge asserting an edge violates an invariant

References