RFC-ATF-6: Agent Trust Fabric — Behavioral Execution Verification Protocol. Behavioral Anchor Record, Constraint Conformance Signal, and Cross-Turn Coherence Hash Chain

RFC-ATF-6 specifies the Behavioral Execution Verification Layer (BEV) of the Agent Trust Fabric — the sixth and final RFC in the ATF Open Standard series published by OMNIX QUANTUM LTD. RFC-ATF-6 answers the structural question that no prior RFC in the series addresses: did the agent actually behave within its authorized constraints during execution, turn by turn? This is the Behavioral Execution Gap — the space between authorization evidence and behavioral output attestation. Three protocol components are introduced: Behavioral Anchor Record (BAR): A PQC-signed record produced at each execution turn, binding the SHA3-256 hash of the agent's output to the governing receipt and turn index via contentₕash = SHA3-256 (outputₕash ‖ receiptᵢd ‖ turnᵢndex). The BAR is the first ATF artifact that closes the authorization-to-output chain: every authorized action now has a verifiable, tamper-evident record of what the agent actually produced. A HALTED BAR immediately stops the session. Sealed with Dilithium-3 (ML-DSA-65, FIPS 204). Six invariants: BEV-INV-001 through BEV-INV-004, BEV-INV-015, BEV-INV-016. Constraint Conformance Signal (CCS): A conformanceₛcore ∈ 0. 0, 1. 0 computed atomically with each BAR, measuring behavioral conformance against the constraint vector in the governing receipt. Four components: Output Boundary Score (40 pts), Constraint Satisfaction Score (30 pts), Semantic Drift Score (20 pts), Authority Alignment Score (10 pts). Verdicts: CONFORMANT (≥90) / DRIFTING (70–89. 9) / BREACH (50–69. 9) / VIOLATION (<50). Cumulative drift accumulator per session; HALT triggered when threshold exceeded (default 0. 35). DRIFTING or worse triggers AGVP Proactive Veto Receipt issuance. Six invariants: BEV-INV-005 through BEV-INV-009, BEV-INV-017. Cross-Turn Coherence Hash Chain (CTCHC): A hash chain seeded by governingᵣeceiptᵢd and sessionᵢd, where every link = SHA3-256 (json. dumps ("prev": prevₕash, "turn": outputₕash, "receipt": receiptᵢd, sortₖeys=True) ). The chain seal (ML-DSA-65) is the Session Integrity Proof: offline-verifiable proof that all turns were recorded in order, without omission or substitution. Six invariants: BEV-INV-010 through BEV-INV-014, BEV-INV-018. Together, BAR, CCS, and CTCHC constitute the Behavioral Execution Verification Layer — Layer 6 of the ATF stack. BEV is additive and backward compatible with all prior ATF layers. 18 new invariants are introduced (BEV-INV-001 through BEV-INV-018), bringing the total ATF invariant count to 106 formally specified invariants across 20 protocol families. An implementation complying with RFC-ATF-1 through RFC-ATF-6 is designated ATF-BEV-Compliant — the sixth and highest compliance tier in the ATF stack, superseding ATF-CGL-Compliant (RFC-ATF-5). Compliance hierarchy: ATF-COMPLIANT-L1/L2/L3 → ATF-RGC-Compliant (14 inv. ) → ATF-FEI-Compliant (40 inv. ) → ATF-PGL-Compliant (70 inv. ) → ATF-CGL-Compliant (88 inv. ) → ATF-BEV-Compliant (106 inv. ) Formal verification: Five Z3 SMT proof targets (BEV-FVS-001 through BEV-FVS-005) cover BAR binding completeness, output hash integrity, CCS score bounds, CCS component non-negativity, and CTCHC chain monotonicity. Regulatory alignment: EU AI Act Art. 9/12/14, NIST AI RMF MEASURE 2. 6, ISO/IEC 42001 §8. 4 and §9. 1, GCC/DIFC Art. 9/12, MiFID II Art. 17, SOC 2 Type II CC7. 2. DB tables: atfbehavioralₐnchorᵣecords · atfconstraintconformanceₛignals · atfcoherenceₕashchains (auto-created via CREATE TABLE IF NOT EXISTS). Related ADRs: ADR-181 (BAR) · ADR-182 (CCS) · ADR-183 (CTCHC) · ADR-131 (Execution Integrity Layer foundation). Priority records: OMNIX-PAR-2026-BAR-001 · OMNIX-PAR-2026-CCS-001 · OMNIX-PAR-2026-CTCHC-001.