Aefinity AI

L09 Positive Q4 · Agent records and their cost

Ordinary logging versus replay-based receipts on one-field edits

QuestionIf someone edits one field in an AI agent's log, does the log show it?

Run by us; no unaffiliated reproduction

01Why it matters

Logs are text. The question is whether a log can tell you it has been edited.

02Method, step by step

  1. Record one two-step tool-using episode.
  2. Make three single-field edits to the record.
  3. Look at each in the receipt's own unverified display, then run the replay verifier.

Method as recorded

Three single-field mutations of one recorded two-step tool-using episode (pruned BitNet-2B, one host, 2026-09-22), each shown in the receipt's own unverified display and through the replay verifier. Run by us.

03Results, exact and sourced

  1. R1A changed internal token id (one id, step 0) was invisible in the ordinary display, but replay named the step and the field.

    (verifier line: step 0 divergence: toks-match=false tool-match=true in-match=true out-match=true decode-chain-match=true)

    Verbatim source cis2-spec / RECEIPT-VS-LOGGING.md

  2. R2An altered tool output ('20' changed to '21') was rejected at step 0 by replay. In the ordinary display this change was visible as printed text, but nothing in the log format flagged it as wrong.

    (verifier line: step 0 divergence: toks-match=true tool-match=true in-match=true out-match=false decode-chain-match=true)

    Verbatim source cis2-spec / RECEIPT-VS-LOGGING.md

04What it does NOT show

Anything about third-party logging products; the 'ordinary logging' here is our own display. Three edits, one episode, one machine.

05Scope and caveats

  • Three chosen mutations of one episode, one model, one machine; not adversarial.
  • 'Ordinary logging' is our own unverified display, not a third-party logging product.
  • The viewer only reformats the verifier's verdict; it is not independent evidence.
  • Run by us; no unaffiliated reproduction.
  • In the altered-tool-output case the ordinary display did show the changed value ('21'); the source's point is that the log format itself does not flag it.
  • The source describes a third case, a flipped decode-chain digest bit, also caught at step 0 and invisible in the ordinary display. It is omitted from this entry's results.
  • Model artifacts are referenced by hash only and are not checked into the public repo. The fixtures live in the alice-aegis repo, and this entry does not verify that repo is public.

06Outcome

Positive

The check worked as expected, within the stated scope.

07What we learned

A log is text anyone could have typed. Replaying the computation catches the mismatch without knowing in advance which field was changed.

08Check it yourself

Read the result page (link above).

  • L08
    Mixed

    Receipt-verified agent evaluation, and the hole we found in our own verifier

    A receipt can verify and still be filed on the wrong item. We found that by trying to break our own verifier, and binding each receipt to its item closed the case we found.

    Q4

  • L10
    Mixed

    What receipts cost on a real agent episode

    Receipts are not free. In this episode the receipt loop took 2.51x the plain decode, and the source calls that an upper bound. On old hardware, verification took 40 s on the i5-5200U machine and minutes on the Celeron N4020. The cost should be reported next to every integrity claim. These are single runs, not a benchmark.

    Q4