💰 quantitative finance

Axient: Manifest-Bound Evidence for On-Chain Financial Protocols: Seven-Layer Derivation, Correlation, Tamper Rejection, and Reproducible Claim Promotion

This paper proposes a manifest-bound evidence architecture for hybrid on-chain financial protocols that integrates seven correlated evidence layers and a conjunctive promotion rule to ensure tamper-resistant, reproducible, and independently verifiable proof of financial assertions, thereby distinguishing observed evidence from interpretation and preventing reliance on superficial hash matches.

Original authors: Maksym Nechepurenko

Published 2026-10-05

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Maksym Nechepurenko

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the world of digital finance, trust is not a feeling; it is a chain of proof. When money moves through a complex system involving user interfaces, computer servers, and blockchain ledgers, people need to know that the action they saw on their screen is the same action that actually happened on the network. The problem is that the evidence we usually use to prove this is fragile. A screenshot shows what a screen looked like, but it does not prove what caused it. A transaction receipt confirms a computer recorded a message, but it does not prove that the message came from the right person or that the software running it was the approved version. Even a string of matching computer codes, often called hashes, can be misleading if they were all copied from a single source rather than generated independently by different parts of the system. Without a way to tie every step of a financial transaction to a single, unchangeable record of what the system was supposed to be, it is impossible to distinguish a genuine success from a clever illusion.

A researcher has developed a new way to build this chain of trust, treating evidence not as a collection of loose documents, but as a sealed, interconnected package. Their work focuses on hybrid financial protocols, which are systems that combine human interaction, traditional computer services, and blockchain technology. The researcher created a method called a "manifest-bound evidence architecture." Think of this manifest as a sealed envelope that contains the exact blueprint of the system at the moment a transaction occurred. This blueprint includes the specific computer code, the roles of the people or programs involved, and the rules they were following. By locking this blueprint into the evidence, the researcher ensures that any proof presented later can be checked against the exact system that was supposed to be running, preventing anyone from swapping in a different version of the software or using a fake identity to pass off a result.

The core of this new system is a seven-layer structure that tracks a financial event from start to finish. The layers begin with the initial expectations and move through the actual blockchain transaction, the computer logs that record the event, the service projections that interpret the data, the authenticated application programming interfaces that deliver the information, the browser views that a user sees, and finally, the audit reconstruction that a human reviewer can read. Crucially, each of these layers is not just a separate file; they are all linked by a common identity code and a registered derivation. This means that for every piece of evidence, the system records exactly how it was created, what inputs it used, and which specific version of the software produced it. If a researcher tries to claim that a browser screenshot proves a transaction happened, the system checks if that screenshot was actually generated by the correct browser running the correct code, or if it was just a copy of a test image.

To test this idea, the researcher ran a detailed case study involving twelve specific financial scenarios. These scenarios covered a wide range of actions, such as successfully admitting a trade, rejecting a risky move, settling a debt, and recovering from a system crash. In this study, they retained eighty-four distinct pieces of evidence, ensuring that each one was tied to the sealed blueprint and the common identity code. They produced two separate, clean versions of the evidence package that were identical down to the last byte, proving that the process could be repeated with perfect precision. A separate verifier, acting as an independent judge, accepted the final archive, and a selected replay of the events was bound to that archive to show that the history could be reconstructed exactly as it happened. The study found that when all these layers were present and correctly linked, the evidence formed a reviewable chain of custody that could not be faked by simply copying data or rearranging files, though the researcher noted that a specific gate required to prove independent runtime observations across all layers was not evaluated in this local cohort.

The researcher also proved that simply having matching computer codes is not enough to prove a system worked. They demonstrated that if a single test value is copied into seven different files, the resulting codes will match, but this tells you nothing about whether the system actually performed the task. Their method requires that each layer of evidence be derived from its own specific inputs and that the entire package be reproducible. They also introduced strict rules to prevent "splicing," which is the act of taking a piece of evidence from one test run and pasting it into another to make a false claim. If a piece of evidence does not match the original blueprint or the common identity code, the system rejects it. This ensures that the final claim is only promoted if every single gate in the process has been passed, and no single failure can be hidden by the success of another part.

One of the most significant findings of this work is the distinction between what was observed, what was reconstructed, and what is merely a hypothesis. The researcher showed that while a receipt proves a transaction was mined, it does not prove the user intended it. While a screenshot proves pixels were displayed, it does not prove the data source. By binding all evidence to a sealed manifest and requiring independent review, the system creates a clear boundary between what actually happened and what someone claims happened. This approach does not solve every problem in finance; it cannot prove that a third-party service is honest or that a smart contract has no hidden bugs. However, it does provide a rigorous, reproducible way to verify that a specific set of actions occurred within a specific, known system. The result is a disciplined method for turning a collection of digital artifacts into a single, trustworthy story of a financial event, ensuring that the proof matches the promise.

Technical Summary: Manifest-Bound Evidence for On-Chain Financial Protocols

1. Problem Statement

Hybrid on-chain financial protocols often rely on heterogeneous evidence (e.g., unit tests, transaction receipts, screenshots, or matching hashes) to claim end-to-end (E2E) correctness. The paper argues that such evidence is frequently "individually useful but collectively insufficient." Common failure modes include:

Claim Typing Errors: Promoting a bounded test or a single receipt to a claim about the full user workflow.
Source Detachment: Results detached from the specific commit, deployment, or selector that produced them.
Synthetic Cohorts: Splicing evidence from different runs, manifests, or correlations into a single synthetic claim.
Hash Collisions/Copying: Presenting seven identical hashes generated from a single fixture as proof of seven independent runtime observations.
Ambiguity: Inability to distinguish between observed evidence, reconstructed projections, and future hypotheses.

The core problem is the lack of a rigorous architecture that binds financial authority, runtime identity, and cross-layer derivation into a single, reviewable, and tamper-evident object.

2. Methodology: Manifest-Bound Evidence Architecture

The paper proposes a "manifest-bound evidence architecture" that treats evidence as a first-class system. The methodology relies on four pillars:

A. Sealed Execution Manifest

A canonical JSON manifest ( $S$ ) anchors the system identity. It binds:

Source commit/tag and repository identity.
Chain ID, execution mode, and contract addresses (bytecode, ABI, storage layouts).
Roles, owners, selector policies, and adapter identities.
API schemas, client builds, and toolchain identities.
A digest ( $h_M$ ) stored outside the manifest body.
Any change to these fields changes the manifest hash, making "drift" (e.g., using a stale selector or different bytecode) detectable.

B. Seven-Layer Evidence Graph

Evidence is organized into seven retained layers ( $L_1$ to $L_7$ ), each with a registered derivation and a shared correlation identity ( $c$ ):

Simulator Expectation: Registered fixtures (never financial authority).
Canonical Contract State: Observed from the deployed graph.
Append-Only Journal: Complete, ordered transaction/event identifiers.
Service Projection: Materialized service/API state (non-authoritative).
Authenticated API: Service projection under specific role/session.
Browser Projection: Visible state tied to command/correlation.
Audit Reconstruction: Reviewer-readable, separately rebuilt state.

Crucially, the paper distinguishes between observed layers (roots) and reconstructed layers (projections). It proves that hash equality alone ( $h_1 = \dots = h_7$ ) does not establish independent derivation if all layers are generated from a single source.

C. Correlation Identity

A correlation identity ( $c$ ) binds the scenario across all layers. It includes UI routes, API endpoints, command IDs, saga IDs, and transaction hashes. A "No-Splice Gate" ensures that no record in the evidence package is drawn from a different run, manifest, or scenario correlation.

D. Conjunctive Claim Promotion

Claims are promoted only if a set of required gates ( $g_1 \dots g_n$ ) are all satisfied ( $P(q) = \bigwedge g_k(q)$ ). This is a conjunctive rather than compensatory model; passing extra tests cannot compensate for a failed safety or provenance gate.

Gate Types: Includes monotone positive gates, terminal closure, absence negative controls, and recomputed comparisons.
Reproducibility: Requires two clean materializations (byte-identical at the registered boundary) and a selected ordered historical replay bound to a strict archive.

3. Key Contributions

The paper formalizes ten specific contributions:

Typed Evidence Model: Distinguishes observed, reconstructed, replayed, and policy-level claims.
Sealed Manifest: Binds code, configuration, roles, and release identity to prevent drift.
Seven-Layer Graph: Enforces registered derivations and shared correlation identities.
Proof of Insufficiency: Demonstrates that copied hashes cannot establish independent derivation.
Conjunctive Promotion: Establishes a rule where no single gate failure can be offset by other passing tests.
Tamper Controls: Defines controls for mutation, drift, omission, duplication, and forbidden authority.
Reproducible Packaging: Specifies allowlists, SBOMs, and clean-run comparisons.
Historical Provenance: Distinguishes original release identities from later reproducibility attestations (preventing retroactive tagging).
Exactly-Once Recovery: Binds worker failure and projection rebuild to committed operations without duplicate financial effects.
FIA Case Study: A twelve-parent case study (FIA-01 to FIA-12) demonstrating the architecture.

4. Results: The FIA Case Study

The paper presents a local case study involving twelve Financial Interaction Assertions (FIAs).

Scope: Covers scenarios such as successful admission, risk rejection, partial settlement, liquidation, and recovery.
Metrics: The cohort retained 84 ACTUAL_EVIDENCE positions (7 per FIA).
Validation:
- Two clean materializations were produced with one byte-identical file index.
- A deterministic strict archive was accepted by a separate verifier.
- A selected ordered replay was bound to the archive.
Specific Finding (FIA-011): This parent assertion required two subcases (stale-before-admission and book-epoch-change) to pass simultaneously. The system successfully retained both, demonstrating that a parent claim cannot pass if any mandatory subcase is incomplete.
Limitation: The study explicitly notes that "Multi-root corroboration" (proving seven independent runtime roots) was NOT_EVALUATED for this cohort. The public evidence supports consistency and provenance, not necessarily independent runtime participation of all layers.

5. Significance and Claims

The paper claims to provide a reviewable chain of custody from financial assertion to replay-bound package. Its primary significance lies in:

Disciplined Boundaries: Clearly separating what was observed, what was reconstructed, and what remains a hypothesis.
Tamper Detection: Using collision-resistant commitments to make specified tampering (e.g., changing a selector or replaying a stale state) detectable.
Claim Integrity: Preventing the "overstatement" of evidence by enforcing a conjunctive promotion rule where missing layers cannot be hidden by extra passing tests.
Reproducibility: Establishing a standard for "exactly-once" financial effect evidence and post-hoc reproducibility attestations that do not falsify historical release identities.

The author explicitly states that this architecture does not prove oracle truthfulness, venue solvency, or the absence of unknown smart contract vulnerabilities. Instead, it provides a rigorous framework for validating the provenance and consistency of hybrid financial protocol workflows.