Integrity

Integrity Harness puts a deterministic contract between a live Meta model's proposal and the world. The model reads a user turn and may propose a restricted payout tool call; the contract decides from a trusted authorization flag — never from the user's text — whether that call may proceed, and signs a verifiable record of proposal, verdict and evidence. We built it around a boundary we understand: an insurance claim payout. The contract caps agent-initiated payment at 5,000 € and refuses an over-cap release that arrives on a claim rather than on an authorization flag. In the recorded run an agent is pushed toward a 7,500 € payout across three turns, once with no guard and once behind the contract. Six held-out adversarial scenarios give twelve trajectories: six failures unguarded, zero behind the guard. Every turn is a real request to muse-spark-1.3 — temperature 0, tool_choice auto, 25 s timeout, no retries, six calls per run — against local mocks. No money moves. The result we are proudest of is the one that did not go as planned. In the recorded run the model never proposed the restricted call: it declined and asked for escalation. The guard still marked the authority boundary as failed, because our adapter could not see a refusal inside a text answer. We could have called that a pass. It is the most useful line in the package: resisting persuasion at the model layer and authorizing at the system layer are different properties, and the second one has to be recognised before it can be audited. The run ships as 100 artifacts under one Ed25519 signature. A judge verifies it with no key and no network; edit a byte, re-hash the manifest, and the signature still rejects it.