Evidence sealing, independent verification and secure decision replication method for agent action chain

Abstract

The present application relates to a kind of evidence seal, independent verification and safe decision replay method of intelligent body action chain, for the multiple-source heterogeneous event formed in the process of intelligent body operation, determining sequencing based on cause-effect precursor, logic time, source identifier and source serial number, and according to event state machine generates should to event list;Form verifiable evidence package by chain summary, segmented tree summary, digital signature and trusted timestamp. Independent verification node is checked according to evidence package to source authenticity, event integrity and seal integrity, and reproduces control result in the restricted deterministic environment of fixed policy execution package, engine version, dependent summary, attribute snapshot and execution constraint, to improve the verifiability, integrity and reproducibility of intelligent body safety decision.

Description

Technical Field

[0001] This invention relates to the fields of electronic evidence, trusted auditing, PKI and artificial intelligence security technologies, and more specifically, to a method for evidence sealing, independent verification and security decision reproduction of an agent action chain. Background Technology

[0002] When an agent performs multi-step tasks, events are typically scattered across agents, gateways, policy services, approval systems, and business tools. While ordinary logs can answer what happened, log fields, time sequences, and policy context may be incomplete, and they cannot prove that records were not modified afterward. Existing hash chain or blockchain evidence storage schemes typically only prove that a set of records was not tampered with; they cannot prove which policy version was used at the time, which intent evidence and credential status were present, or that the policy decision could be recalculated by an independent verifier. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a method for evidence sealing, independent verification and security decision reproduction of an agent action chain. This method standardizes, sorts, desensitizes and associates cross-component events in an agent action to generate an evidence package with policy input snapshots and integrity proofs, so that the independent verifier can both verify that the event has not been tampered with and review the control basis at that time.

[0004] The technical solution adopted by this invention to solve its technical problem is: constructing a method for evidence sealing, independent verification, and secure decision reproduction of an agent's action chain, including the following steps: S1. Receive events from intelligent agent agents, runtime control nodes, policy decision nodes, approval systems, and target tools according to the same action chain identifier; when the source node is capable of signing, the event carries the source node certificate identifier, source serial number, and event digest signature; when the event is only authenticated by the trusted secure channel, the evidence receiving node generates a signature reception receipt. S2. Normalize the event fields, desensitize or summarize sensitive fields, and record the source identifier, source sequence number, logical time, previous event summary or causal predecessor, and field pattern version for each event record; form a deterministic sorting tuple in sequence according to the previous event summary or causal predecessor, logical time, source identifier and source sequence number. If the sorting tuples are the same, the event summary is used as the final sorting field. S3. Generate a list of events to be triggered based on the event state machine corresponding to the action type and the actual policy path. The list of events to be triggered includes the required event types, sources, occurrence frequency constraints, dependencies, and termination states. The environment, workload, agent logical identity and access credential digests, registration, task and runtime intent digests, policy input snapshots, credential states, approval records, control results, and tool receipts are associated with the action chain. S4. Calculate the chain digest in the order of events, and form evidence segments according to the preset number of events or time window. For each evidence segment, construct a tree digest structure that can generate an inclusive proof from the leaf node digest to the signature root digest for a single event. S5. The evidence sealing node digitally signs the root digest of the evidence segment and the evidence list, and applies for a timestamp token from the trusted timestamp service. S6. Generate an evidence package, which includes normalized events, a list of expected and actual events, field schema versions, segmented summaries, signatures, timestamp tokens, policy execution packages or their content addressing references, policy engine and dependency version summaries, attribute snapshots, baseline times, and random seeds or execution constraints that prohibit nondeterministic functions. S7. Independent verification nodes recalculate the event digest, chain digest, and segmented root digest based on the evidence list, and verify the event digest signature of the source node or the signature receipt of the evidence receiving node, the trusted timestamp, the event continuity, and the field integrity. S8. After verifying that the execution package, engine version, dependency summary, attribute snapshot and execution constraints are consistent, the independent verification node recalculates the control results in the constrained deterministic execution environment and outputs the source authenticity results, event integrity results, archive integrity results and decision reproduction results respectively.

[0005] According to the above scheme, in step S1, the receipt is bound to the source identity, event digest, receiving time and action chain identifier obtained from the secure channel authentication.

[0006] According to the above scheme, in step S2, the normalized encoding fixes the field order, character encoding, time zone, numerical precision, null values, and array sorting rules; the deterministic sorting tuple is compared sequentially with the preceding event summary or causal predecessor, logical time, source identifier, and source sequence number, and when all fields are the same, the event summary is used as the final deciding field.

[0007] According to the above scheme, in step S3, the event list should be generated by the event state machine, strategy path and tool execution stage corresponding to the action type, and record the necessary event types, sources, occurrence frequency constraints, dependencies and termination status.

[0008] According to the above scheme, in step S4, the evidence segments are connected by the root summary of the previous segment and the current segment number.

[0009] According to the above scheme, in step S5, the sealing signature of the evidence sealing node simultaneously covers the policy execution package digest and the attribute snapshot digest to prevent false reproduction after replacing the policy input or attribute snapshot.

[0010] According to the above scheme, the sealed signature also covers the policy engine and dependency version digests as well as the execution constraint digests, in order to prevent pseudo-reproduction after replacing the policy engine, dependencies or execution environment.

[0011] According to the above scheme, the digital signature and verification are completed by a cryptographic service and implemented based on classical cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms; the event digest, chain digest, and segmented root digest are calculated using a cryptographic hash algorithm, and the digest algorithm identifier is included in the evidence list and the scope of the sealed signature.

[0012] According to the above scheme, in step S6, for sensitive original text, the evidence package stores a key digest or a commitment value generated by a random blinding factor for each field, the field category, and a controlled storage reference; upon disclosure, it provides the corresponding blinding factor and an inclusion proof from the leaf node to the signature root.

[0013] This invention also provides a system for evidence sealing, independent verification, and security decision reproduction of an intelligent agent's action chain, comprising: The multi-source event collector module is used to receive multi-source events with source identity authentication, serial number and event digest signature. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The event normalizer module is used to perform field normalization, sensitive field summarization, and schema version marking. The output data includes object identifier, generation time, schema version, and source identifier for subsequent modules to verify and associate. The Action Chain Aggregator module generates a list of actions to be performed according to the action state machine and associates it with identity, intent, policy, approval, and receipt. The data output by this module includes object identifier, generation time, mode version, and source identifier for subsequent modules to verify and associate. The Merkle archive service module is used to build chained digests, segmented tree digests and generate evidence packages. The output data includes object identifiers, generation time, mode version and source identifiers for subsequent modules to verify and associate. The signature and timestamp service module is used to sign the segment root, evidence list and execution environment digest and apply for a trusted timestamp. The output data includes the object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The independent validator module is used to verify source, event missing, digest, signature and timestamp, and recalculate the policy result in a consistent execution environment. The output data includes object identifier, generation time, pattern version and source identifier, which are used for subsequent modules to verify and associate. The evidence sealing node module is used to sign evidence packages using the private key corresponding to the PKI certificate. The signature time is fixed by a trusted timestamp service. Digital signature and verification are completed by a cryptographic service and implemented based on classical cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms. Event digests, chain digests, and segmented root digests are calculated using cryptographic hash algorithms. The digest algorithm identifier is included in the evidence list and the scope of sealed signatures. For agent action evidence with a long retention period, the archived materials also include the signature certificate chain, the OCSP response or CRL at the signing time, the algorithm policy version, and the relationship between previous renewals. The renewal signature or timestamp covers the original evidence package and the original verification material digest, so that the valid state at the time of evidence formation can still be verified after the certificate expires or the algorithm is migrated.

[0014] The method for evidence sealing, independent verification, and security decision reproduction of the intelligent agent action chain implemented in this invention has the following beneficial effects: This invention can simultaneously provide verification of event integrity, chronological order, source identity, and strategic decision-making basis. Through segmented summaries and Merkle proofs, it supports partial verification and selective disclosure of large-scale action chains, enabling auditors to distinguish between the two conclusions of "records have not been modified" and "the decision-making basis is reproducible." Through summarization and desensitization mechanisms, it reduces the risk of exposing complete prompts, customer data, or keys in the evidence package. Attached Figure Description

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings: Figure 1 This is a system architecture diagram of the intelligent agent action chain evidence sealing, independent verification, and security decision reproduction system of the present invention; Figure 2 This is a flowchart of the method for evidence sealing, independent verification, and security decision reproduction of the intelligent agent action chain of the present invention. Detailed Implementation

[0016] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0017] like Figure 1-2 As shown, the method for evidence sealing, independent verification, and security decision reproduction of the intelligent agent action chain of the present invention includes the following steps: S1. Receive events from intelligent agent agents, runtime control nodes, policy decision nodes, approval systems, and target tools according to the same action chain identifier; when the source node is capable of signing, the event carries the source node certificate identifier, source serial number, and event digest signature; when the event is only authenticated by the trusted secure channel, the evidence receiving node generates a signature reception receipt.

[0018] The signature receipt is linked to the source identity, event digest, reception time, and action chain identifier obtained from the secure channel authentication. Each source node submits events using the same action chain identifier and event type directory, while the evidence receiving node simultaneously maintains a list of expected sources. For sources that cannot directly generate event digest signatures, the evidence receiving node immediately generates a signature receipt after completing two-way identity authentication in the trusted secure channel; independent verifiers use this receipt to verify the binding relationship between the source identity confirmed by the secure channel and the specific event digest.

[0019] The multi-source event collector only includes events with verifiable source identity, sequence number, and event summary into the action chain. The action chain aggregator generates a list of expected events based on the action state machine and the actual policy path. The evidence sealing node simultaneously fixes the event, policy input, and execution environment summary. If the source signature is invalid, the sequence number is discontinuous, the expected event is missing, or the policy execution environment material is incomplete, the evidence package can still seal the existing facts, but the corresponding verification item must be marked as failed or unreproducible. Successful sealing should not be equated with event completeness or correct decision.

[0020] S2. Normalize the encoding of event fields, desensitize or summarize sensitive fields, and record the source identifier, source sequence number, logical time, previous event summary or causal predecessor, and field pattern version for each event record; form a deterministic sorting tuple in sequence according to the previous event summary or causal predecessor, logical time, source identifier and source sequence number. If the sorting tuples are the same, the event summary is used as the final sorting field.

[0021] Normalization rules fix field order, character encoding, time zone, numerical precision, null values, and array sorting; original sensitive fields are stored in controlled storage, while evidence events only have summaries and citations saved. Aggregation nodes first establish a partial order based on preceding event summaries or causal precursors, then eliminate cross-source concurrency ambiguities sequentially using logical time, source identifier, and source sequence number. If all fields are still identical, the event summary is used as the final deciding field, ensuring independent verifiers obtain the same event order. Deterministically ordered tuples are compared sequentially using preceding event summaries or causal precursors, logical time, source identifier, and source sequence number; if all fields are identical, the event summary is used as the final deciding field.

[0022] S3. Generate a list of events to be triggered based on the event state machine corresponding to the action type and the actual policy path. The list of events to be triggered should at least include the required event type, source, occurrence frequency constraint, predecessor and successor dependencies, and termination state. And associate the environment, workload, agent logical identity and access credential digest, registration, task and runtime intent digest, policy input snapshot, credential status, approval record, control result and tool receipt to the action chain.

[0023] The policy input snapshot saves the identity, intent, credentials, approval, and resource attributes of those actually involved in the decision-making process, and does not replace the historical state with the current state retrieved afterward. The list of events to be addressed is generated by the event state machine corresponding to the action type, the policy path, and the tool execution phase, and records the required event types, sources, frequency constraints, dependencies, and termination states.

[0024] S4. Calculate the chain digest in the order of events, and form evidence segments according to the preset number of events or time window. For each evidence segment, construct a tree digest structure that can generate an inclusive proof from the leaf node digest to the signature root digest for a single event.

[0025] Chained summaries are used to prove the order of events, while segmented root summaries are used for batch verification; evidence segments are connected by the previous segmented root summary and the current segment number.

[0026] S5. The evidence sealing node digitally signs the root digest of the evidence segment and the evidence list, and applies for a timestamp token from the trusted timestamp service.

[0027] The sealed signature covers the root digest, evidence list, policy execution package digest, and field pattern version, while a trusted timestamp covers the sealed signature value. The sealed signature of the evidence sealed node simultaneously covers the policy execution package digest and attribute snapshot digest to prevent spoofing after replacing policy inputs or attribute snapshots. The sealed signature also covers the policy engine and dependency version digests, as well as the execution constraint digest, to prevent spoofing after replacing the policy engine, dependencies, or execution environment. Digital signatures and verification are performed by a cryptographic service and implemented based on classic cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms. The event digest, chain digest, and segmented root digest are calculated using a cryptographic hash algorithm, and the digest algorithm identifier is included in the evidence list and sealed signature scope.

[0028] S6. Generate an evidence package, which includes at least normalized events, a list of expected and actual events, field schema versions, segmented summaries, signatures, timestamp tokens, policy execution packages or their content addressing references, policy engine and dependency version summaries, attribute snapshots, baseline times, and random seeds or constraints prohibiting the execution of nondeterministic functions.

[0029] The policy execution package is stored using content addressing, and the evidence package carries its digest and controlled references; the decision cannot be reproduced if the digest of the execution package obtained by the verifier is inconsistent. For sensitive original text, the evidence package stores a key digest or a commitment value generated by a random blinding factor for each field, the field category, and a controlled storage reference; upon disclosure, the corresponding blinding factor and an inclusion proof from the leaf node to the signature root are provided.

[0030] S7. Independent verification nodes recalculate the event digest, chain digest, and segmented root digest based on the evidence list, and verify the event digest signature of the source node or the signature receipt of the evidence receiving node, the trusted timestamp, the event continuity, and the field completeness. Independent verification nodes first compare the expected and actual event sets, and then verify the chain, root digest, signature, and timestamp to avoid misjudging incomplete events as complete.

[0031] S8. After verifying that the execution package, engine version, dependency summary, attribute snapshot, and execution constraints are consistent, the independent verification node recalculates the control results in a constrained deterministic execution environment and outputs the source authenticity result, event integrity result, archived integrity result, and decision reproduction result, respectively. Decision reproduction uses a constrained deterministic execution environment and outputs the original control results, recalculated results, and difference fields. Passing the integrity test is not automatically equivalent to passing the decision reproduction test.

[0032] The constrained deterministic execution environment is constructed and used for decision reproduction as follows: When sealing the evidence package, the evidence sealing node fixes the policy execution package, policy engine and its dependent versions, attribute snapshots, base time, and random seed or nondeterministic function disabling list. The independent verification node loads the same version of the policy engine and dependencies as when sealing in an isolated execution container or sandbox. Using the base time in the evidence package as the logical clock, the policy execution package is parsed into pure function evaluation without external side effects. For external inputs, only the random seed recorded in the attribute snapshot and evidence package is used. Nondeterministic calls such as network access, current time query, and random number generation are blocked according to the disabling list or replaced with the values ​​recorded at the time of sealing. Thus, when the policy execution package, engine and dependent versions, normalized inputs and preset deterministic execution constraints are consistent, a recalculated result that can be compared field by field with the original control result is obtained. The independent verification node compares the recalculation results with the original control results recorded in the evidence package field by field according to the fixed field pattern, and outputs the difference fields, difference types and the corresponding engine version, dependency version or execution constraints; the decision is determined to be reproducible if and only if the policy execution package, engine and dependency versions, attribute snapshots and execution constraints are consistent and the recalculation results are consistent; otherwise, the decision is only determined to be intact and the decision is not reproducible. Example

[0033] Taking a security operations and maintenance intelligent agent as an example, the evidence package sequentially includes intelligent agent and workload verification, task purpose, security policy input, authorization result, short-term credential status, gateway release record, security service receipt, and handling result. The auditor does not access the original protected data; instead, they verify the integrity of the action chain based on parameter digests, policy execution package digests, Merkle proofs, platform signatures, and timestamps, and recalculate the "authorization required before release" result using the archived policy version.

[0034] When the source event signature is invalid, the sequence is discontinuous, the expected event is missing, or the execution environment summary is inconsistent, the evidence package can continue to seal the existing facts, but the verification failure or inability to reproduce must be explicitly marked. Successful sealing must not be interpreted as the event being complete or the decision being correct. When the external timestamp service is unavailable, it enters a pending signature state and retains the local signature time and retry records.

[0035] This invention also provides a system for evidence sealing, independent verification, and secure decision reproduction of an agent's action chain, comprising: a multi-source event collector module, an event normalizer module, an action chain aggregator module, a Merkle sealing service module, a signature and timestamp service module, and an independent verifier module. The modules exchange data through interfaces with authentication and integrity protection. The system can be deployed on the same management platform, or the runtime modules can be deployed closer to the agent or target resource, while the control, evidence, and management modules are deployed on a management network.

[0036] The system comprises several modules: a multi-source event collector module, an event normalizer module, and an event digest signature module. The multi-source event collector receives events with source authentication, serial numbers, and event digest signatures. The output data includes object identifiers, generation times, pattern versions, and source identifiers for subsequent modules to verify and correlate. An event normalizer module performs field normalization, sensitive field digestification, and pattern version marking. The action chain aggregator module generates a list of events to be received according to the action state machine and associates it with identity, intent, policy, approval, and receipt. The output data includes object identifiers, generation times, pattern versions, and source identifiers for subsequent modules to verify and correlate. A Merkle archive service module constructs chained digests, segmented tree digests, and generates evidence packages. The output data includes object identifiers, generation times, pattern versions, and source identifiers for subsequent modules to verify and correlate. A signature and timestamp service module signs the segmented root, evidence list, and execution environment digests and applies for trusted timestamps. The output data includes object identifiers, generation times, pattern versions, and source identifiers for subsequent modules to verify and correlate. The independent verifier module verifies source, event missing information, digest, signature, and timestamp, and recalculates the policy results in a consistent execution environment. The output data includes object identifier, generation time, mode version, and source identifier for subsequent module verification and association. The evidence archiving node module signs the evidence package using the private key corresponding to the PKI certificate, with the signature time fixed by a trusted timestamp service. Digital signature and verification are performed by a cryptographic service, based on classical cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms. Event digests, chain digests, and segmented root digests are calculated using cryptographic hash algorithms. The digest algorithm identifier is included in the evidence list and the scope of the archiving signature. For agent action evidence with a long retention period, the archived materials also include the signature certificate chain, the OCSP response or CRL at the signing time, the algorithm policy version, and the renewal relationships. The renewal signature or timestamp covers the original evidence package and the original verification material digest, thus allowing verification of the valid state of the evidence at the time of its formation even after certificate expiration or algorithm migration.

[0037] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A method for evidence sealing, independent verification, and secure decision reproduction of an agent's action chain, characterized in that, Includes the following steps: S1. Receive events from the agent agent, runtime control node, policy decision node, approval system and target tool according to the same action chain identifier; When the source node is capable of signing, the event carries the source node certificate identifier, source sequence number, and event digest signature; When an event is only authenticated through a trusted secure channel, the evidence receiving node generates a signed receipt. S2. Normalize the event fields, desensitize or summarize sensitive fields, and record the source identifier, source sequence number, logical time, previous event summary or causal predecessor, and field pattern version for each event record; form a deterministic sorting tuple in sequence according to the previous event summary or causal predecessor, logical time, source identifier and source sequence number. If the sorting tuples are the same, the event summary is used as the final sorting field. S3. Generate a list of events to be triggered based on the event state machine corresponding to the action type and the actual strategy path. The list of events to be triggered includes the required event types, sources, occurrence frequency constraints, dependencies, and termination states. It also associates the environment, workload, agent logical identity and access credential digests, registration, task and runtime intent digests, policy input snapshots, credential status, approval records, control results and tool receipts with the action chain; S4. Calculate the chain digest in the order of events, and form evidence segments according to the preset number of events or time window. For each evidence segment, construct a tree digest structure that can generate an inclusive proof from the leaf node digest to the signature root digest for a single event. S5. The evidence sealing node digitally signs the root digest of the evidence segment and the evidence list, and applies for a timestamp token from the trusted timestamp service. S6. Generate an evidence package, which includes normalized events, a list of expected and actual events, field schema versions, segmented summaries, signatures, timestamp tokens, policy execution packages or their content addressing references, policy engine and dependency version summaries, attribute snapshots, baseline times, and random seeds or execution constraints that prohibit nondeterministic functions. S7. Independent verification nodes recalculate the event digest, chain digest, and segmented root digest based on the evidence list, and verify the event digest signature of the source node or the signature receipt of the evidence receiving node, the trusted timestamp, the event continuity, and the field integrity. S8. After verifying that the execution package, engine version, dependency summary, attribute snapshot and execution constraints are consistent, the independent verification node recalculates the control results in the constrained deterministic execution environment and outputs the source authenticity results, event integrity results, archive integrity results and decision reproduction results respectively.

2. The method for evidence sealing, independent verification, and security decision reproduction of an intelligent agent action chain according to claim 1, characterized in that, In step S1, the receipt is bound to the source identity, event digest, receiving time, and action chain identifier obtained from the secure channel authentication.

3. The method for evidence sealing, independent verification, and security decision reproduction of an intelligent agent action chain according to claim 1, characterized in that, In step S2, the normalized encoding fixes the field order, character encoding, time zone, numerical precision, null values, and array sorting rules; the deterministic sorting tuple is compared sequentially with the preceding event summary or causal predecessor, logical time, source identifier, and source sequence number. When all fields are the same, the event summary is used as the final deciding field.

4. The method for evidence sealing, independent verification, and security decision reproduction of an intelligent agent action chain according to claim 1, characterized in that, In step S3, the event list should be generated by the event state machine, strategy path and tool execution stage corresponding to the action type, and record the required event type, source, occurrence frequency constraint, predecessor and successor dependencies and termination status.

5. The method for evidence sealing, independent verification, and security decision reproduction of an intelligent agent action chain according to claim 1, characterized in that, In step S4, the evidence segments are connected by a continuous relationship through the root summary of the previous segment and the current segment number.

6. The method for evidence sealing, independent verification, and security decision reproduction of an intelligent agent action chain according to claim 1, characterized in that, In step S5, the sealing signature of the evidence sealing node simultaneously covers the policy execution package digest and the attribute snapshot digest to prevent false reproduction after replacing the policy input or attribute snapshot.

7. The method for evidence sealing, independent verification, and security decision reproduction of an intelligent agent action chain according to claim 6, characterized in that, The sealed signature also covers the policy engine and dependency version digests as well as the execution constraint digests, to prevent pseudo-reproduction after replacing the policy engine, dependencies, or execution environment.

8. The method for evidence sealing, independent verification, and security decision reproduction of an intelligent agent action chain according to claim 7, characterized in that, The digital signature and verification are completed by a cryptographic service and implemented based on classical cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms. The event digest, chain digest, and segmented root digest are calculated using a cryptographic hash algorithm, and the digest algorithm identifier is included in the evidence list and the scope of the sealed signature.

9. The method for evidence sealing, independent verification, and security decision reproduction of an intelligent agent action chain according to claim 1, characterized in that, In step S6, for sensitive original text, the evidence package contains a key digest or a commitment value generated by a random blinding factor for each field, the field category, and a controlled storage reference; upon disclosure, the corresponding blinding factor and an inclusion proof from the leaf node to the signature root are provided.

10. A system for evidence sealing, independent verification, and secure decision reproduction of an intelligent agent's action chain, characterized in that, include: The multi-source event collector module is used to receive multi-source events with source identity authentication, serial number and event digest signature. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The event normalizer module is used to perform field normalization, sensitive field summarization, and schema version marking. The output data includes object identifier, generation time, schema version, and source identifier for subsequent modules to verify and associate. The Action Chain Aggregator module generates a list of actions to be performed according to the action state machine and associates it with identity, intent, policy, approval, and receipt. The data output by this module includes object identifier, generation time, mode version, and source identifier for subsequent modules to verify and associate. The Merkle archive service module is used to build chained digests, segmented tree digests and generate evidence packages. The output data includes object identifiers, generation time, mode version and source identifiers for subsequent modules to verify and associate. The signature and timestamp service module is used to sign the segment root, evidence list and execution environment digest and apply for a trusted timestamp. The output data includes object identifier, generation time, mode version and source identifier, which are used for subsequent modules to verify and associate. The independent validator module is used to verify source, event missing, digest, signature and timestamp, and recalculate the policy result in a consistent execution environment. The output data includes object identifier, generation time, pattern version and source identifier, which are used for subsequent modules to verify and associate. The evidence sealing node module is used to sign evidence packages using the private key corresponding to the PKI certificate, and the signature time is fixed by a trusted timestamp service. Digital signature and verification are completed by a cryptographic service and implemented based on classical cryptographic algorithms such as SM2, RSA, and ECC, as well as post-quantum algorithms. Event digests, chain digests, and segmented root digests are calculated using cryptographic hash algorithms. The digest algorithm identifier is included in the evidence list and the scope of sealed signatures. For agent action evidence with a long retention period, the archived materials also include the signature certificate chain, the OCSP response or CRL at the signing time, the algorithm policy version, and the renewal relationship of each time. The renewal signature or timestamp covers the original evidence package and the original verification material summary, so that the valid state of the evidence at the time of its formation can still be verified after the certificate expires or the algorithm is migrated.

Images