The NovaFabric system paper is on arXiv as a preprint: the question it asks, what the system does, what its eight research questions test, and its limits.
The paper is arXiv:2609.12582, by Mohsen Seyedkazemi Ardebili. It is the design, threat model and evaluation of NovaFabric in one place. This post is a map of what is inside, so you can decide which parts are worth your time.
When an autonomous AI agent does something consequential, what can be proven about what it did?
Agent-observability tools already capture detailed traces. The paper's argument is that a trace is a different kind of object from evidence. It sits in a database where a record can be altered without anyone noticing, it carries no recipe for re-running the run it describes, and it says nothing about whether a secret captured along the way was removed. Rules such as the EU AI Act's logging duty, ISO/IEC 42001 and the NIST AI Risk Management Framework assume records that an independent party can check. The paper calls evidence with the properties it needs audit-grade, and says plainly that the term is its own and denotes no certification.
NovaFabric works as a pipeline: capture, seal, replay, diff, audit. Capture wraps an agent run, without changes to the agent's code, and writes a Run Capsule: a portable directory over a fifteen-entity schema. A capsule can be sealed with a DSSE signature, optionally an RFC 3161 timestamp, an append-only Merkle log entry and a redaction attestation, and verified later without a server. Sealing is opt-in. A replay protocol gives each mode its own stated guarantee, and only mocked replay actually re-executes anything. A PROV-aligned provenance graph links capsules across runs, and an Evidence Bundle packages one for a third party to verify with standard tools. The paper says outright that the bundle path is specified and has not yet been exercised by an independent verifier.
The contribution is integration, not new cryptography. OpenTelemetry, DSSE and in-toto, and W3C PROV are composed into one deployable substrate at the granularity of an agent session. The two mechanisms the paper believes are new are the replayable whole-session capsule and a redaction attestation for agent records.
| Part | What it covers |
|---|---|
| Introduction | Why agent runs are hard to prove: they span model weights, prompts, tools, context and environment, and no single layer exonerates the others |
| Related work | Agent tracing and observability, how "replay" is used elsewhere, provenance and lineage, tamper-evident logging and supply-chain attestation, ML reproducibility and AI governance, and the gap none of them closes |
| Architecture | The capsule schema, sealing and its trust model, the replay protocol, the evidence graph, the Evidence Bundle, and the design invariants |
| Evaluation | Eight research questions, each reported at the scope it was measured |
| Discussion | What the guarantee means and does not mean, a proposed maturity model, limitations |
The evaluation asks one question per mechanism, and reports each at the scope where it was measured rather than as a headline number.
The scope paragraphs are a large part of the paper:
The paper also reports the defects its own evaluation found in NovaFabric and in the evaluation corpus, each with a status, including one that invalidated a measurement the author then withdrew.
It closes with a proposal rather than a result: NOVA-EL, a four-level maturity model for execution evidence, from a structured capsule at L1 to a sealed, logged and offline-verifiable one at L4. The paper presents it as a design contribution to refine with the community, not as an adopted standard.
Added to this blog on 28 October 2026. The date above is the paper's arXiv posting date, 11 September 2026.