As part of the Advanced AI Society, the Open Verification Lab bridges AI safety research directly into openly verifiable production-grade tools for enterprise deployment.

Extending build-time manifests to cover dynamic, runtime context composition.

Open: what belongs in an agent bill of materials (P10). Solid mechanisms exist for signing and software bills of materials; runtime composition is where they stop.

Implementing zero-knowledge commitment paths that verify access without payload leakage.

Open: evidence that reveals nothing (P09). The standard specified a zero-knowledge path and never built it.

Standardizing evidence-chain continuity across multi-cloud and cross-infrastructure boundaries.

Open: evidence continuity across trust domains (P07). The roadmap calls this the least developed domain and the one where an evidence chain most obviously breaks.

Hardening path-aware policy evaluation at the Action Interception Gateway.

Done: from message authorization to effect binding (P02). Establishing mathematical guarantees for when a cryptographically signed capability bound to a request strictly enforces the physical action an endpoint performs.

Open: are bounded path summaries soundly bounded? (P04); delegation without amplification (P06).

Binding dynamic agent identifiers directly to attested enclave states.

Done: accountable but unlinkable agent identity (P05). Constructing cryptographic identity schemes that allow agents to be verifiable and attributable during disputes while remaining unlinkable across relying parties during routine execution.

Open: delegation without amplification (P06).

Hardening hardware TEE quote verification against reference-value drift.

Open: the cost of knowing what ran (P03). This domain leans hardest on hardware, which is where the trust story breaks.

Measured: The reference implementation measured on real Intel TDX hardware: running inside a trust domain costs 6.2%; a single hardware quote costs 39.5 ms. Per-action attestation is too slow for most agent workloads, so every deployment must batch. Practical Rust engines, TEE harnesses, and verification proxies that stress-test requirements on real hardware.

Open: the cost of knowing what ran (P03). Hardware attestation is expensive enough that no deployment can afford it per action. What is the right refresh policy, and what exactly is exposed in the window between quotes?

Open: what a serial log costs a fleet (P08). The evidence chapter is the deepest in the standard; what it has not measured is the ordering cost at fleet scale.

Done: a trust calculus for attestation tiers (P01). Formally computing residual trust sets from system descriptions to evaluate whether ordinal verifiability tiers hold across disparate architectures.

Open: whether conformance is suspended on a detected control failure, and who holds the halt (standard Appendix D, issue 1). This is the Lab’s new program, and what happens when the chain breaks: Containment →

Open: who pays for verification (P11); why assurance regimes fail (P12). The history of assurance standards suggests adoption is decided by institutions and incentives, not by proofs.