Decern Technical Architecture: Pre-Signing Boundary, Shared Budget Controls & Public Signet Evidence
This page outlines the assurance goals, execution-path placement, and reproducible Bitcoin Signet test transactions for Decern. Agents hold zero live keys by design. Implementation mechanics are reserved for private briefing under NDA.
How Decern Is Structured to Enforce Policy Before Signing
Decern is designed to evaluate authorization rules outside the AI agent runtime before any signing key or payment credential is invoked. Public materials describe assurance goals and external boundaries; internal mechanics are reserved for private briefing under NDA.
Rail-Aware Pre-Signing Boundary (Stripe, USDC & Bitcoin Taproot)
Agents hold zero live keys by design. Rather than trusting an agent's self-reported summary, Decern is structured to inspect the outbound transfer request at the adapter boundary across Stripe payouts, USDC transfers, and Bitcoin Taproot transactions, blocking any transfer whose recipient or amount diverges from the approved policy.
Concurrent Sub-Agent Budget Serialization & Retry Holds
When multiple AI sub-agents draw from a shared parent CFO budget, Decern is designed to evaluate and lock parent and child budget limits together before a transfer proceeds. If a downstream network timeout leaves an in-flight payment in an ambiguous state, the budget allocation is placed on hold and duplicate retries are blocked until operator review.
Pre-Signing Typestate Enforcement
The Decern executor is written in Rust and uses compile-time typestate boundaries so that downstream signing interfaces cannot be called until policy checks and budget reservations complete. In internal testing (258 workspace tests passing), 11 attack scenarios were blocked pre-signing with 0 unauthorized signing attempts.
NIST FIPS 204 ML-DSA-65 Co-Signatures & ReceiverEvidenceBundle
High-value treasury policies are structured to require a 2-of-3 quorum approval carrying a post-quantum NIST FIPS 204 ML-DSA-65 co-signature. Each decision exports a portable ReceiverEvidenceBundle receipt designed for standalone offline checking without contacting PriviNet servers.
Execution Path Placement
business action proposed by AI agent (0 live keys held)
|
existing policy engine decision made here, unchanged
|
Decern Airlock pre-signing policy & shared budget check
|
HSM or signing service key material protected here, unchanged
|
signature to the network + ReceiverEvidenceBundle for offline check
Public Signet Txids & Internal Test Suite
Internal reproducible engineering results from the Decern research prototype (Bitcoin signet test network only, no real assets):
- Signet Tx 1 (July 12, 2026): 0cd810955c54...69b6289
- Signet Tx 2 (July 14, 2026): 4e9b7c7bd3db...0487227
- Internal Test Results: 258 workspace tests passing. 11 attack scenarios blocked pre-signing in internal testing, 0 unauthorized signing attempts.
- Patent & Review Status: U.S. provisional patent 64/130,485 pending. Frozen review candidate ready for independent review; external cryptographic review being arranged. Inspect public signet evidence →
Questions from CTOs, Systems Engineers & Security Reviewers
Why keep the full implementation mechanics private?
The design is patent-pending (U.S. provisional patent 64/130,485 pending). Public materials describe assurance goals, external boundaries, and reproducible Signet artifacts; internal implementation mechanics are reserved for private briefing under NDA.
How is Decern structured to protect Bitcoin Taproot custody against key compromise?
Decern assumes a key share can eventually be compromised and is designed to limit what an attacker can do. No single key piece can move funds; a 2-of-3 quorum of independent holders must approve each transaction. Internal authority pieces are structured to refresh on a schedule so stale material is rejected before signing, while the Bitcoin Taproot address remains unchanged.
What about quantum computers and NIST FIPS 204 ML-DSA-65?
No one can offer quantum-resistant Bitcoin on-chain signatures today, and we do not claim to. In the Decern prototype, policy approval decisions carry a post-quantum NIST FIPS 204 ML-DSA-65 co-signature inside the exported ReceiverEvidenceBundle so the authorization record can be checked offline.
Why did the October 2026 x402 disclosures make external pre-signing boundaries urgent?
On October 22, 2026, V12 disclosed 25 vulnerabilities in x402 agent-payment SDKs (including uncapped default spending), followed by the October 25, 2026 Cloud Security Alliance (CSA) research note. When spending controls live inside an agent SDK, a single malicious response or prompt injection can drain the wallet. Decern is designed to enforce caps and recipient checks outside the agent runtime.
Design Partner Program: limited slots. Scoped pilot following phase-1 independent review.
Contact Brad Listermann directly to request a private architecture briefing under NDA or discuss a scoped design-partner pilot following phase-1 independent review.