Monster Accountable Agents

The capstone narrative for the monster family — the UCAN-rooted accountable-agent lifecycle implemented across monster-guard, monster-swarm, monster-resident, and moonshine. This document tells the story top-down: the problem, the principle, the six gates that enforce it, and the one command that proves the whole thing is healthy.

For operator detail — schemas, CLIs, where state lives, how to run each piece — read the MONSTER_AGENTIC_RUNBOOK. This doc is the why and the shape; the runbook is the how.

The problem

An agent that can spawn other agents, hold real capabilities, and run real inference is a process with power. Left ungoverned, that power has four failure modes:

• Unbounded power. An agent granted a capability can use it without limit — more caps, longer lifetimes, wider blast radius than anyone intended.
• Fake agents. An agent registered as "the inference worker" might be broken or synthetic — admitted on its name, never on whether it actually works.
• Orphaned children. An agent that spawns descendants and is then killed can leave that subtree running, unowned and unaccountable.
• Silent history rewrite. A record of what the fleet did is worthless if it can be quietly edited after the fact to hide a spawn, a breach, or a reap.

The principle

Every agent is a leased process with its own DID, admitted only if it proves quality (it works) and swears conduct (how it will behave); every lifecycle event is tamper-evidently audited; and every failure is contained to the subtree that caused it.

Concretely:

• Identity. Each agent is minted its own P-256 DID and keyfile at spawn and signs its own swarm broadcasts. Trust does not attach to the agent (it has a fresh DID per spawn, no history); it attaches to the stable spawner (spawned_by), who is accountable for the agents it spawns.
• Admission is a proof, not a name. A spawn succeeds only if the artifact proves it works (quality) and the request stays within the conduct contract it swears (oath). A bad artifact or an over-reaching request is denied at the spawn boundary — it never gets a lease and never runs.
• Every event is on an append-only, tamper-evident spine. Spawn, update, reap, delegate, and breach are appended to a hash-chained, root-signed audit log that detects any later edit.
• Failure is contained. Reaping or breaching a node reaps its entire spawned subtree, so a revoked or rogue parent never leaves orphaned children running, and the blast radius is exactly that subtree and no wider.

Authority flows down the chain (a0n-auth -> monster-guard -> monster-resident -> monster-swarm); a revocation at any link kills everything below it. See The chain in the runbook.

The six gates

The lifecycle is enforced by six gates. Each is proven by a corresponding gate in monster-swarm/scripts/demo-admission.sh (six gates, exit 0, ~3s) and backed by cargo test.

Gate A — QUALITY

• Property. Admission proves the artifact works. A fake or broken agent cannot register: capability validation answers "is the caller allowed?", and the quality spec answers the orthogonal "does the artifact actually work?", making the latter an acceptance criterion for admission.
• Mechanism. A qspec declares one quality probe. The reference probe, paris-probe-rknot, runs a real forward pass over a small (0.5B) dense knot and passes only if the model argmaxes the expected token (the reference spec argmaxes token 12095, " Paris", for "The capital of France is"). The probe is run before the grant is minted; admission passes iff the probe exits 0.
• CLI. monster-swarm spawn --qspec <file> threads the qspec to monster-guard delegate; a registered .moonshine command carries a quality column. update does not re-probe — quality is proven at spawn.
• Demo gate. GATE A spawns with a good qspec (expected token) and observes ADMITTED, then spawns with a deliberately wrong expect_token and observes DENIED. (Skipped cleanly when the 0.5B knot is absent.)
• Detail. Runbook Quality-gated admission (qspec); monster-guard Quality-gated admission.

Gate B — CONDUCT

• Property. Where a qspec gates quality (works), an oath gates conduct (behaves). An agent is admitted only within the bounds it swears, and the sworn contract travels with the capability for its whole life.
• Mechanism. An oath is JSON { oath, max_caps, ttl_max_secs, sworn_by? }. monster-guard delegate denies admission unless the requested caps are a subset of max_caps and the ttl is within ttl_max_secs, then binds the oath into the grant UCAN fct (via a0n-auth's IssueOptions.facts) so the conduct contract is signed into the capability. At spawn the agent self-signs a Ulysses oath-token (iss == aud — it ties itself to the mast) with its own freshly-minted key; a co-signed oath is a 2-link chain (spawner imposes, agent accepts).
• CLI. monster-swarm spawn --oath <file> (also records the oath in the ledger and surfaces it in the thoth.fleet.swarm.v1 frame as oath_signed / oath_sworn_by); monster-swarm oath mint self-signs a standalone oath-token.
• Demo gate. GATE B spawns with --caps net against an oath whose max_caps = [net] and observes ADMITTED, then spawns with --caps fs,net,exec and observes DENIED (caps exceed the oath).
• Detail. Runbook Oaths and user-spawnable agents; monster-guard Oath-bound admission.

Gate C — ENFORCEMENT

• Property. A sworn oath only bites if breaking it has a consequence. Enforcement closes the conduct loop — swear -> bind -> prove -> enforce — by turning a breach into a revoke plus an append-only audit record.
• Mechanism. oath-breach REVOKES the agent (its lease is killed at the next tick) and APPENDS a record to breaches.json capturing both halves of the contract: the oath that was sworn and the breach that broke it ({ id, name, oath_sworn_by, oath, caste, reason, reported_by, ts }). It is a guarded mutation — it needs a UCAN authorizing the reap, exactly like reap. The breach docks the spawner's trust, gating that spawner's future spawns. The lease-level reflex (mechanical revoke + record) lives here; the semantic conduct judgment (did the agent actually misbehave) belongs to the monster-badchild rogue-bodyguard layer, which reads the bound oath at runtime and calls oath-breach.
• CLI. monster-swarm oath-breach --ucan <token> --id <id> --reason <reason>; monster-swarm breaches lists the append-only log; monster-swarm auto --enforce-oaths [--breach-at <n>] enforces on a timer.
• Demo gate. GATE C spawns a rogue (admitted within the oath), reports a breach (revoke + record), and shows the breach audit log.
• Detail. Runbook Oath enforcement (breach -> revoke + audit); swarm Enforcement.

Gate D — DELEGATION

• Property. No escalation down the tree. A parent agent may spawn a child, but delegation attenuates: no node hands a child more authority than it holds. The swarm is a fully-accountable delegation tree, every node UCAN-rooted, caps and oath bounds strictly narrowing downward.
• Mechanism. delegate-spawn mints an attenuated agent/spawn cap carrying the constraint {caps: subset}. a0n-auth's verify_chain rejects a non-subset, and ops::spawn independently enforces that the requested sandbox caps stay within the authorizing chain's permitted caps (root agent/* is unrestricted; a delegated holder is bounded by its {caps} constraint). Conduct attenuates too: monster-guard denies an "oath escalation" if a child's oath max_caps exceed the parent's or its ttl ceiling is higher. The lineage is recorded — the ledger and the thoth.fleet.swarm.v1 frame carry the chain depth and spawned_by (the parent DID).
• CLI. monster-swarm delegate-spawn --ucan <parent-token> --issuer-secret <hex> --to <child-did> --caps <subset> [--ttl <secs>].
• Demo gate. GATE D mints a child DID, delegates an attenuated agent/spawn cap (subset = net), spawns within the subset (ADMITTED), then spawns with --caps net,fs,exec and observes DENIED (attenuation held).
• Detail. Runbook Recursive accountability (the delegation tree); swarm Recursive delegation.

Gate E — TAMPER-EVIDENCE

• Property. History cannot be silently rewritten. Every lifecycle event — spawn, update, reap, delegate, breach — is on an append-only, hash-chained, root-signed log, so the record of what the fleet did cannot be quietly edited after the fact.
• Mechanism. Each entry of audit.jsonl carries prev_hash (the prior entry's hash) and its own hash (over its content plus prev_hash), and is ECDSA-signed by the fleet root key. This makes five classes of corruption detectable — modification, insertion, deletion, reordering, forgery — plus malformed lines. audit --verify walks the chain and catches all of them.
• CLI. monster-swarm audit / audit --json (read), audit --verify / audit --verify --json (check). The verdict JSON is { ok, entries, first_bad, reason, head }; exit code 0 when the chain verifies, 3 when tampering is detected — usable as a fail-closed tripwire. The verified state rides front of mind in the thoth.fleet.swarm.v1 frame as audit: { head, verified, entries }.
• Demo gate. GATE E runs audit --verify on the live chain (ok=true after Gates A-D appended events), then flips a byte on disk and re-verifies (ok=false with a first_bad seq), then restores the file.
• Detail. Runbook Tamper-evident audit chain; swarm Tamper-evident audit chain.

Gate F — CONTAINMENT

• Property. Failure is bounded to its subtree. Reaping or breaching a node reaps its entire spawned subtree, so a revoked or rogue parent never leaves orphaned delegated children running; the blast radius is exactly that subtree and no wider (siblings and the root survive).
• Mechanism. Lineage is the spawned_by graph (each agent records the parent DID that authorized it plus its depth). The descendants of a node are the recursive closure over that graph. reap --cascade reaps the target and every node in its spawned subtree; an enforced oath-breach auto-cascades the same way. Each cascaded reap appends a hash-chained, root-signed Reap entry to the audit chain, so the containment is recorded per-node and the chain still verifies afterward.
• CLI. monster-swarm reap --cascade --ucan <token> --id <id> [--json] (--json emits { "reaped": [...], "count": N }). Plain reap (no --cascade) keeps single-agent behavior; the two-queen floor still protects the last persistent breeder.
• Demo gate. GATE F builds a parent -> child -> grandchild lineage plus a sibling, cascade-reaps the child branch (count=2: child + grandchild), confirms the sibling + root survive (bounded blast radius), confirms the chain still verifies afterward, then cascade-reaps the parent (parent + sibling).
• Detail. Runbook Cascade revocation; swarm Cascade revocation (containment).

Identity and trust (what makes the gates accountable)

The six gates only add up to accountability because of two cross-cutting properties:

• Per-agent identity. Each subagent is minted its own P-256 DID + 0600 keyfile at spawn; the node signs its own swarm broadcasts and the receiver verifies against the ledger DID. The agent is its own identity, not merely the monster-guard grant. See swarm Subagent identity.
• Trust attaches to the spawner. Because each agent has a fresh DID (no history), trust is scored on the stable spawner (spawned_by): trust_of(spawner) = clamp(1 - 0.34 * recent_breach_count, 0..1). ops::spawn denies a spawn when the requesting spawner's trust is below a floor (default 0.34, env MONSTER_SWARM_MIN_TRUST), locking out a repeat offender until its recent breaches decay. This closes the loop: swear -> bind -> prove -> enforce -> score -> gate. See swarm Trust.

The same lineage that propagates a child's breach up to its spawner is the lineage the cascade reaps down — accountability up the tree, containment down it.

Autonomic re-fork (inside the rails)

The swarm now self-regulates on a live box: a controller loop (monster-swarm auto --interval) reads the collective consciousness off the partyline and buds a scout when hot / reaps an idle scout when calm. It is not a bypass of the A-F rails but runs inside them: every bud/reap is UCAN-scoped (it acts only within the capability it is handed), FRF-bounded (never past the DECAGON ceiling or below the two-queen floor), and audited (each action a signed entry in the Gate E chain, tagged actor auto). The autonomic loop is therefore as accountable as any hand-driven mutation — the homeostat is just another caller the gates judge. Drive/observe it with broadcast.

User-spawnable

The human is a first-class spawner, peer to Thoth: the same spawn runs under a user's own UCAN. Bootstrap once with monster-swarm/scripts/grant-user.sh, then spawn via moonshine agent spawn, which shells to monster-swarm spawn under that capability. An agent is one definition regardless of who minted it — leased process + own DID + qspec (works)

• oath (conduct) — spawnable by Thoth or the user.

Surfaced over MCP

All CRUD is surfaced as monster-resident MCP tools so Thoth drives the lifecycle over MCP: subagent_create / subagent_list / subagent_update / subagent_reap (with cascade), swarm_vibe / swarm_autotick / swarm_broadcast, and audit_verify / audit_log. Each verifies agent/<verb> on agent:fleet rooted at the resident, is cost-admitted by the AntColony FRF budget, and then enforced by the monster-guard lease.

Run the proof

# The six-gate end-to-end demonstration against the REAL release binaries
# (six gates A-F, exit 0, ~3s; Gate A skips cleanly if the 0.5B knot is absent).
bash monster-swarm/scripts/demo-admission.sh

# The canonical "is the stack healthy" command: builds all crates, runs all
# tests, the demo, and the bench, and prints a single green/red summary.
bash monster-swarm/scripts/verify-all.sh

demo-admission.sh sets up an isolated, disposable MONSTER_GUARD_HOME, mints a fleet UCAN, and walks each gate printing the OBSERVED result (admitted / denied) with PASS / FAIL banners. verify-all.sh is the one-shot health check across the whole monster family.

Cross-references

• MONSTER_AGENTIC_RUNBOOK — the operator runbook: every CLI, schema, state path, and benchmark.
• monster-swarm/README.md — the distributed-inference guardrails: the two gates, autonomic homeostasis, identity, oaths, enforcement, trust, cascade revocation, the tamper-evident audit chain.
• monster-guard/README.md — the sandbox + lease + revoke enforcement layer; qspec + oath-bound admission.
• monster-resident/README.md — the MCP server and the full tool arg table.
• monster-badchild/README.md — the rogue-bodyguard conduct monitor that makes the semantic judgment and calls oath-breach.
• moonshine/README.md — the FRF shell; moonshine agent spawn (user-spawnable agents).
• monster-swarm/SECURITY.md — threat model and accepted residual risks.