Attested Execution Framework
AEF
A framework for evidence of work executed by AI agents: what record a run must leave, what makes that record verifiable by someone who trusts neither the operator nor the system that produced it, and what a human sign-off actually attests to.
v0.3Early draft. Current release 11 August 2026. Expected to change in ways that break earlier assumptions.
A verified attested execution record establishes what a signed archive cannot: not that the work was done right, but that its operator sealed a declared scope for it, that the sealed record of what ran is internally consistent with that scope, and that the result names, item by item, what was not established.
Unpacked: the declaration is sealed separately, so revising the scope after the outcome is known breaks a seal, though when it was sealed remains the operator's assertion unless a time anchor bounds it. The act log is digest-chained and tested against the declared boundary. The result vocabulary is closed: a verifier may not report more than its checks established, and every result carries the standing list of things no result of this kind can establish. And the verifier's own conformance is only ever a claim against a pinned, versioned fixture suite that anyone can challenge in public. That is the whole of it; the honest floor below states the same thing as the two sentences a reviewer can actually say. New here? Start at /aef/start.
The honest floor
What a reviewer holding a verified record can safely say, and what they cannot. This is the framework's most important content, quoted from AEF 1100 section 13 as restated in AEF 1400 section 15.
For a record that is not anchored
“this record was sealed at a stated time under a key bound to a named party, has not changed since sealing, and is internally consistent with a scope its operator declared for the run.”
Every recorded time in it is the operator's assertion, including the seal time the sentence leans on.
For a record whose seals are anchored, and whose whole digest an external holder binds
“this record's content existed no later than a stated moment, on the assertion of a named party outside the operator whose standing the trust base states and whose proof I have not necessarily verified; where the declaration's anchor precedes the record's, the declaration existed first, by a margin worth what the anchor clocks are worth; the content has not changed since sealing; and it is internally consistent with a scope its operator declared.”
What neither sentence says
- what happened inside the window and when
- whether anything outside the record occurred
- whether the scope was honestly drawn
- whether the approver saw what the record claims
- whether this is the record the reviewer asked for
- whether other records exist
The series
Documents are numbered in blocks: 1000s foundational, 1100s threat and adversary, 1200s verifier and conformance, 1300s the record itself, 1400s custody and time, 1900s records about the framework itself. Planned documents are listed with their numbers before they are written, because a numbered document is a commitment and an unnumbered one is an intention.
| No. | Title | Status | Version | Date |
|---|---|---|---|---|
| 1000 | Charter | published | v0.3 | 11 August 2026 |
| 1001 | Terminology | published | v0.1 | 11 August 2026 |
| 1100 | Threat model | published | v0.2 | 11 August 2026 |
| 1101 | The trust base | published | v0.2 | 14 August 2026 |
| 1200 | Verifier requirements | published | v0.2 | 14 August 2026 |
| 1201 | Conformance and self-test | published | v0.1 | 14 August 2026 |
| 1300 | Record structure and scope declaration | published | v0.2 | 14 August 2026 |
| 1301 | Approval and signature semantics | published | v0.1 | 14 August 2026 |
| 1400 | Sealing, time, and re-verification | published | v0.1 | 14 August 2026 |
| 1900 | Provenance findings | published | v0.1 | 14 August 2026 |
A record that exists
A specification nothing has satisfied is a hypothesis about a specification. The first conformant record is published at /aef/examples/run-0001, with its declaration, its trust base statement, three verification results, and a tampered copy that fails. The outcome is PASS_WITH_QUALIFICATIONS and carries 12 qualifications, each stated with what it means a reader cannot conclude. An unqualified pass is not reachable today, and AEF 1200 section 7.2 explains why.
You can also run the reference verifier on that record in your own browser, against this page's copy or a record you supply, at /aef/verify. The verifier's conformance claim against AEF 1200 v0.2, the first in the framework's history and partial where it is partial, is at /aef/conformance.
Findings against the series
On two occasions this series asserted more than it had observed. Sixteen statements about an implementation nobody in a position to publish had inspected were printed as observations, and a verifier passed from inside the author's working tree while failing from the position a reviewer actually occupies. Both were caught by the framework's own distinction between a claim and a claim a reader can test, and both are recorded in AEF 1900 rather than edited away, with the classification, what was withdrawn, and what is now unknown.
Reading and disagreeing
The charter states the problem, the scope, the adversary the record is designed against, the principles every later document must trace to, and the conditions under which the framework would be wrong or unnecessary. Start there.
Disagreement is the point. Every substantive objection gets one of three outcomes, in writing and attributed: adopted with the document revised, rejected with the reason stated, or recorded as unresolved and published inside the document itself. The mechanism is in AEF 1000, section 10, and governance, including the fork right and the dormancy clause, is in section 11.
Where the series stands, every number derived from the artifacts. Changelog. Machine-readable series index at /aef/index.json. The charter source is served as Markdown at /aef/1000.md. Licensed under CC BY 4.0.