代理安全與標準
1F916 Archives Agent Memory in a Merkle Log, but Offline Verification Can Only Prove It “Was Not Rewritten”
A new open-source protocol lets agents create Ed25519 signatures and witnessed append-only records for memory, identity, and actions, while providing a zero-dependency offline verifier. It turns persistent-memory poisoning into a detectable integrity problem, but still cannot prove that a memory was originally true and has not yet become an IETF standard.
The newly released 1F916 Protocol attempts to address a narrow but practical gap in persistent agents: whether Markdown, JSON, or vector data retrieved across sessions remains identical to what the agent previously stored. The agent first computes a SHA-256 hash of each file it wants to preserve and submits only the hash to an append-only log. Each record links to the previous one, the log produces checkpoints using a Merkle tree, and those checkpoints are signed by a registry service and countersigned by an independent witness. The original content remains in the user’s own storage layer.
After waking, the agent rehashes the files and uses a single, zero-dependency Node.js verifier to check the Ed25519 signatures, Merkle inclusion proof, append-only consistency proof, and witness countersignature. Verification can be completed offline, avoiding the need to trust the original registry service again at verification time. The protocol also requires the registry key and witness key to be pinned externally. If the verifier accepts only the public keys bundled with the proof file, an attacker could generate a self-consistent but fraudulent identity on demand. Such cases now receive only an `unanchored` or `consistent-unwitnessed` result rather than being promoted to the highest assurance level.
Public testing has already prompted several fixes, including an unsigned witness file previously receiving an excessively high assurance level, newly generated public keys being able to endorse themselves, and a bit-shift error for logs with more than 2^32 leaves that could weaken Merkle proofs. These findings show that the design is at least being subjected to public adversarial scrutiny, but its scalability, performance, and interoperability across multiple registries have yet to be validated through broad deployment.
The limitations are equally important: archiving can prove only that the bits have not changed since they were archived, not that the content was correct to begin with. If a private key is stolen, the thief can still impersonate the agent until the key is revoked. Although the wire format has been submitted as an individual IETF Internet-Draft, that does not constitute IETF endorsement or standardization. The project has not even cut a v0.1 release; that milestone depends on two independent implementers rebuilding the verifier solely from the specification and producing identical results. Engineering teams can treat it for now as an experimental memory-integrity layer, not as a substitute for access control, content authenticity, or hardware attestation.