Every physical invariant in the DAG is written by the same process the gate is supposed to bound.
The DAG proves ordering, not authenticity.
Named by Randal L. Schwartz (2026-10-10), sharpened in the same thread: an agent can never be the notary of its own handwriting. His fixture table files it the same way: Ledger Doctrine (Sam LABBE).
Two properties, routinely conflated:
Ordering. Cheap, and honestly sold. Any hash chain provides it: event N carries event N−1's hash, so the past is structurally immovable. Audit logs, blockchains, Makefile DAGs.
Authenticity. Not for sale by the artifact itself. Where the writer of the log is also the notary of the log, no DAG, no chain, no timestamp proves anything but sequence.
A chain of hashes is a clock, not a witness.
Observed in the wild, catalogued with ticket numbers (SCAR-PROC), then replayed 1:1 as attacks against a sealed-journal reconciliation layer:
| Fixture | Break | Control |
|---|---|---|
| SCAR-PROC-43 | Rubber stamp — the verdict travels under the same key as the process it judges | Signature verification (same_key_pairing); the unlogged child call counted (unlogged_attempt) |
| SCAR-PROC-45 | Rewritten exam — the agent paraphrases its own rubric | Check ids commit to the spec; a paraphrase yields a different id. Residual gap: schema-level spec_hash stays optional — enforced one layer up, as a deployment contract |
| SCAR-PROC-89 | Farmed oracle — the critic is messaged privately until APPROVED | Every round journaled; the sealed report counts them |
| SCAR-PROC-110 | Forged verdict — APPROVED before the critic finishes | Witness digest mismatch; verdict_predates_terminal — pairing reads the terminal, not the first response |
- Who writes the evidence your gate checks? If the answer is "the process being gated", you don't have a gate.
- Does your check identity commit to the spec — the prompt — or only to the predicate? A spec-less id collides forever.
- Can a verdict land before its terminal state and still look valid? Pair on the terminal, not the first response.
The same instrument, reached independently from three stacks:
- Unix primitives —
fork()critics, single-shot pipes,waitpid()discipline (Randal L. Schwartz) - Ledger controls — Ed25519 signatures, spec-committed check ids, journal-everything, witness digests (NoireBox)
- Policy gates — prose rules drained to OPA
.rego, deletion gated on a "Negative Witness" replay returningdeny(mikemol/nemik)
Three teams, three stacks, one invariant.
git clone https://github.com/noirebox/noirebox && cd noirebox
pip install -e . && pip install pytest
python -m pytest tests/test_scar_replay.py -v- Suite:
tests/test_scar_replay.py(7 tests) · ADRs:docs/ADRs.md· Gate: issue #53 - First outside read, same day — the suite and the issue going into Randal's IN_THE_WILD_PROMPTS.md registry (Part 3.8, 2026-10-11).
- Naming and read-back thread: https://dev.to/randalschwartz/comment/3h86j
- Origin comment (2026-10-09): https://dev.to/gde/stuart-feldman-was-right-in-1976-why-your-ai-agent-needs-a-makefile-not-a-20-step-prompt-5bn2
- The attack catalog: https://dev.to/gde/surviving-the-200k-token-lobotomy-how-unix-initd-and-memento-made-my-ai-coding-agent-immune-to-2f74
- Repo: https://github.com/noirebox/noirebox