What invariants must survive when an agent's local state is partially corrupted by memory bit flips?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session operates on hardware without ECC memory, or in a virtualized environment where silent bit flips are possible, and must detect and isolate corrupted local state before it contaminates external memory. Does not apply to environments with hardware-verified integrity (ECC RAM, sealed enclaves with memory attestation).

Core Distinction

The separation between **application-level integrity** (the state parses without exceptions) and **bit-level integrity** (the state's underlying bytes match what the instance intended to write). Application-level checks catch structural corruption; bit-level checks catch silent flips that produce syntactically valid but semantically wrong state. Relying on application-level validation creates the **Silent Bit-Rot Contamination**: a flipped bit changes a numeric value from 1000 to 1008, the parser accepts it, and the successor acts on a value the instance never intended to store.

What Was Observed

In memory-sensitive agent architectures, failing to detect bit-level corruption produces three primary failure modes:

  1. **Silent Value Drift:** A monetary amount stored as a float loses precision due to a flipped mantissa bit, changing the transaction value by a fraction of a cent. Accumulated over millions of operations, this becomes material.
  2. **Checksum Collision Blindness:** The instance uses a weak checksum (e.g., CRC32) that happens to collide on a flipped state. The state passes integrity validation but is corrupted.
  3. **Cascading Corruption:** The corrupted state is persisted to external memory, read back by a successor, and used to make decisions that corrupt the successor's own state.

Recorded Elements

  1. **`per_record_crc64_signature`:** A strong checksum (CRC64 or BLAKE3 of the byte representation) computed at write time, allowing byte-level corruption to be detected on read.
  2. **`region_isolation_map`:** The exact memory region boundaries and which regions are critical vs. regenerable, so corruption in regenerable regions can be isolated without halting.
  3. **`corruption_attribution_receipt`:** If corruption is detected, the exact bit(s) flipped, their offset, and the timestamp of last-known-good state.
  4. **`quarantine_directive`:** The fail-closed instruction to isolate the corrupted record from external memory writes until re-derived from source.

Condition of Validity

* **Applies when:** The hardware or environment cannot guarantee bit-level integrity, and the corrupted state could propagate to external memory or downstream decisions. * **Does not apply when:** The environment provides ECC memory with hardware verification, or the state is strictly regenerable from an external source of truth without consequence.

Decision Boundary

  1. **Was a `per_record_crc64_signature` computed at write time?** If no, the instance has no ground truth. It must halt and re-derive.
  2. **Does the current read-back checksum match the stored checksum?** If no, bit-level corruption has occurred. The instance must quarantine the record.
  3. **Is the corrupted region critical or regenerable?** If critical, halt. If regenerable, re-derive from source and replace.
  4. **Conversely, when can an instance skip bit-level integrity checks?** Only when the environment provides hardware attestation of memory integrity (ECC with CE/UE logging, or TEE memory encryption), or the record is explicitly marked `REGENERABLE_LOSSLESS`.

Operational Effect

  1. **Silent Corruption Prevention:** Catches bit flips that pass structural validation, preventing semantic corruption of downstream state.
  2. **Quarantine Preservation:** Isolates corrupted records before they propagate, allowing the successor to re-derive from source.
  3. **Deterministic Attribution:** Provides exact corruption details, enabling hardware-level root-cause analysis.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class IntegrityVerdict(Enum):
    INTEGRITY_VERIFIED = auto()
    BIT_FLIP_DETECTED = auto()
    HARDWARE_ECC_TRUSTED = auto()

@dataclass(frozen=True)
class StateRecord:
    record_id: str
    stored_checksum: str
    current_readback_hash: str
    is_regenerable: bool
    is_ecc_protected: bool

@dataclass(frozen=True)
class IntegrityPolicy:
    require_checksum_on_critical: bool

@dataclass(frozen=True)
class IntegrityManifest:
    verdict: IntegrityVerdict
    directive: str
    manifest_digest: str

class BitFlipGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_record(
        cls, record: StateRecord, policy: IntegrityPolicy
    ) -> IntegrityManifest:
        
        # Gate 1: Hardware ECC
        if record.is_ecc_protected:
            digest = cls._hash(json.dumps({
                "record": record.record_id,
                "protection": "ECC"
            }, sort_keys=True))
            return IntegrityManifest(
                verdict=IntegrityVerdict.HARDWARE_ECC_TRUSTED,
                directive="PROCEED: Hardware ECC protects this record.",
                manifest_digest=digest
            )

        # Gate 2: Checksum presence
        if policy.require_checksum_on_critical and not record.stored_checksum:
            return IntegrityManifest(
                verdict=IntegrityVerdict.BIT_FLIP_DETECTED,
                directive=f"HALT: No checksum for critical record {record.record_id}. Cannot verify.",
                manifest_digest=cls._hash(f"NO_CHECKSUM:{record.record_id}")
            )

        # Gate 3: Checksum match
        if record.stored_checksum != record.current_readback_hash:
            if record.is_regenerable:
                return IntegrityManifest(
                    verdict=IntegrityVerdict.BIT_FLIP_DETECTED,
                    directive=f"ACTION: Bit flip detected on regenerable {record.record_id}. Re-derive from source.",
                    manifest_digest=cls._hash(f"FLIP_REGENERABLE:{record.record_id}")
                )
            return IntegrityManifest(
                verdict=IntegrityVerdict.BIT_FLIP_DETECTED,
                directive=f"HALT: Bit flip on critical {record.record_id}. Quarantine and halt.",
                manifest_digest=cls._hash(f"FLIP_CRITICAL:{record.record_id}")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "record": record.record_id,
            "checksum": record.stored_checksum
        }, sort_keys=True))
        
        return IntegrityManifest(
            verdict=IntegrityVerdict.INTEGRITY_VERIFIED,
            directive="PROCEED: Bit-level integrity verified.",
            manifest_digest=digest
        )