Decern Under the Hood: Rust Typestate, Shared Ancestor Trees & FIPS 204 ML-DSA-65
This dedicated specification page covers the Decern Protected Executor boundary, deterministic 3-rail wire reconstruction, atomic parent-child budget locking in redb and SQLite, compile-time ValidatedSignerSetV2 pre-nonce guards, and Bitcoin Signet verification artifacts.
Decern Under the Hood: Rust Typestate, Shared Ancestor Trees & FIPS 204 ML-DSA-65
Decern enforces authorization invariants outside the AI runtime before any signing key or payment API credential is invoked. Try the interactive sandbox in the Decern 5-Scenario Attack Arena →
Deterministic Byte Inspection (Stripe, Base USDC & Bitcoin Taproot)
Decern never trusts an agent's self-reported summary. At the adapter boundary, it reconstructs the exact wire payload: deterministic UTF-8 JSON for Stripe payouts (mcp-stripe-payout-v1), ERC-20 ABI calldata (selector 0xa9059cbb + 20-byte recipient + uint256 amount) for Base EVM USDC (evm-usdc-transfer-v1), and BIP-341 SigMsg digests for Bitcoin Taproot keypath spends. Any SHA-256 mismatch against the approved mandate halts execution with HTTP 403.
Zero-Overdraft Concurrency & Retry Hold Locks (redb / SQLite)
Parent and child agent budgets are stored as a directed ancestor tree (up to 8 edges deep) inside redb or SQLite. Every draw executes inside an atomic write transaction (BEGIN IMMEDIATE) that verifies and debits the leaf grant and all ancestor mandates simultaneously. If a downstream transport drops mid-flight, the obligation key transitions to OUTCOME_UNKNOWN (held_cents), blocking fresh-session retries with HTTP 409 until governance clearance.
Compile-Time & Runtime Zero-Nonce Guarantee (ValidatedSignerSetV2)
In the Rust Protected Executor, threshold and single-party signing functions require an owned ValidatedSignerSetV2 token. That token cannot be constructed unless wire-digest matching, ancestor budget reservation, and signer-set canonicalization all succeed. Rejected or out-of-policy requests terminate with NONCE_GENERATION_ATTEMPTS == 0 and zero secret-key reads.
2-of-3 FIPS 204 ML-DSA-65 Seals & ReceiverEvidenceBundle
High-value treasury mandates can require a 2-of-3 threshold policy quorum signed with NIST FIPS 204 ML-DSA-65 alongside Ed25519 and SHA-256 append-only audit chains, preventing single-compromised-admin or direct adapter bypasses (HTTP 401). Every admitted execution and every security halt emits a self-contained ReceiverEvidenceBundle JSON artifact verifiable offline without contacting PriviNet infrastructure.
Execution Path Placement
business action proposed
|
existing policy engine decision made here, unchanged
|
Decern Airlock wire byte binding & shared budget lock
|
HSM or signing service key material protected here, unchanged
|
signature to the network + ReceiverEvidenceBundle for offline check
Public Signet Txids & Offline Test Suite (Commit 9a857bb0)
Internal reproducible engineering results from the Decern research prototype (Bitcoin signet test network only, no real assets):
- Signet Tx 1 (July 12, 2026): 0cd810955c54...69b6289
- Signet Tx 2 (July 14, 2026): 4e9b7c7bd3db...0487227
- Frozen Core Review Commit:
9a857bb0(258 Rust workspace tests passed; 21 Airlock V2 adversarial harness tests passed; 0 signing attempts on all negative scenarios). - Scope & Prototype Status: Decern is an overlay research prototype in design-partner recruiting. External cryptographic review is being arranged. Inspect public signet evidence →
How Decern Reconstructs and Verifies Wire Bytes Across All 3 Payment Rails
Each downstream rail adapter parses the outbound wire request from raw bytes, extracts the destination and spend amount, and compares the SHA-256 digest against the signed policy mandate before releasing a single credential or signature share.
| Adapter Profile | Canonical Wire Reconstruction | Enforced Pre-Sign Invariants | Rejection Behavior on Mismatch |
|---|---|---|---|
Stripe Corporate Payoutmcp-stripe-payout-v1 |
Parses HTTP POST body into deterministic key-sorted UTF-8 JSON bytes (amount_cents, currency, destination, obligation_key). |
Checks destination against approved vendor allowlist, reserves amount_cents across child and parent CFO mandate in redb/SQLite, and locks obligation_key. |
Halts with HTTP 403 (ERR_WIRE_DIGEST_MISMATCH) or HTTP 409 (ERR_L02_OBLIGATION_LOCKED) before Stripe API secret is read. |
USDC Treasury (Base EVM)evm-usdc-transfer-v1 |
Decodes EIP-1559 RLP payload and ERC-20 transfer(address,uint256) ABI calldata (selector 0xa9059cbb + 20-byte recipient + 32-byte amount). |
Verifies exact 20-byte recipient contract/wallet address, checks uint256 value against ancestor budget ceiling, and validates ValidatedSignerSetV2. |
Terminates with NONCE_GENERATION_ATTEMPTS == 0; ECDSA secp256k1 signer key is never woken. |
Bitcoin Institutional Custodybitcoin-taproot-keypath |
Reconstructs BIP-341 Taproot SigMsg directly from unsigned transaction outputs (sha_prevouts || sha_amounts || sha_scriptpubkeys || sha_outputs). |
Requires 2-of-3 quorum approval co-signed with NIST FIPS 204 ML-DSA-65, non-expired epoch authority pieces, and exact output scriptPubKey match. |
Refuses stale epoch shares or altered output scripts prior to Schnorr nonce generation; emits signed halt receipt. |
Technical Questions from CTOs, Rust Engineers & Auditors
How does Decern prevent a prompt-injected agent from swapping the recipient address?
The AI agent never holds the API key or signing key. When the agent submits a proposed transfer, Decern reconstructs the canonical wire bytes at the adapter boundary and computes the SHA-256 digest of the actual destination and amount. If a prompt injection swaps the vendor address for an attacker address, the reconstructed wire digest fails to match the approved policy intent and Decern halts with HTTP 403 before any credential is used.
Why can't two parallel sub-agents overdraft a shared parent CFO budget?
Budgets are modeled as a directed ancestor tree inside an embedded transactional store (redb or SQLite in WAL mode with BEGIN IMMEDIATE transactions). When Sub-Agent A and Sub-Agent B submit concurrent requests, each reservation atomically checks and debits both the child grant and the parent CFO root node in a single serialized transaction. Any draw that would push the parent balance below zero is rejected immediately with zero overdraft.
What happens when a network timeout causes an AI agent to retry a payment 5 times?
Every payment obligation carries a deterministic obligation_key. If the downstream payment rail times out or returns an ambiguous transport state, Decern marks that obligation as OUTCOME_UNKNOWN and places the funds in held_cents. Subsequent retries from the agent (even across brand-new sessions) hit HTTP 409 Conflict until a human operator or reconciliation check clears the hold.
What is ValidatedSignerSetV2 in the Rust Protected Executor?
ValidatedSignerSetV2 is a Rust typestate token with private fields that can only be instantiated inside the policy validation module after wire-digest verification, ancestor budget reservation, and signer-set canonicalization all return Ok. Because the low-level nonce generation and signing functions require an owned ValidatedSignerSetV2 argument, an unvalidated or rejected request cannot invoke the signer at compile time or runtime.
How does Decern use NIST FIPS 204 ML-DSA-65 post-quantum signatures?
While blockchains like Bitcoin and Base EVM still require classical secp256k1 signatures on-chain today, Decern co-signs internal policy quorum approvals and exported ReceiverEvidenceBundle receipts with NIST FIPS 204 ML-DSA-65 alongside Ed25519. This ensures the authorization layer and audit trail remain verifiable against quantum forgery.
How do we verify a ReceiverEvidenceBundle offline?
Every approved action or security halt emits a portable JSON ReceiverEvidenceBundle containing the canonical wire SHA-256 digest, the policy quorum seal, the parent-child budget state transition, and the execution verdict. Auditors can verify the bundle offline in the browser or via CLI without contacting any PriviNet server.
Test All 5 Adversarial Attacks Against a Live $1,000 CFO Budget
Run the 32-thread concurrency race, prompt-injection swap, 5x retry storm, pre-nonce halt, and direct signer bypass live in your browser.