Zero-Time Precomputed Predicate Matrices, the Z3 Solver, and the retry_of Immune Loop
The central engineering contradiction in autonomous agent security lies between mathematical soundness and runtime latency. Compiling natural-language policy documents on the fly or querying a secondary supervisor language model adds hundreds of milliseconds to every tool call while leaving formal safety unproved.
The MITR design resolves this contradiction by separating policy compilation from runtime evaluation. Domain security rules are precompiled ahead of time into quantifier-free linear integer arithmetic predicates with uninterpreted functions (QF_UFLIA). At runtime, the Z3 solver evaluates the precomputed matrix in milliseconds, while recurring read-only signatures hit an in-memory cryptographic digest cache.
1. Execution Pipeline Across the R0–R5 Reversibility Scale
Every outgoing tool call is intercepted before reaching the network socket or storage engine. Depending on the classified reversibility tier, the gateway enforces the exact verification depth required to prevent irreversible harm.
End-to-end tool call pipeline: parameter parsing, sub-millisecond in-memory contract filtering via mcp-sentinel 1.1.2, six-tier R0–R5 classification, formal Z3 proof, and append-only receipt generation in gate_actions.jsonl.
| Tier | Traffic Share | Representative Legal & Financial Operations | Verification Depth & Boundary Enforcement |
|---|---|---|---|
R0 | 48% | Read litigation file summary, query counterparty status, inspect account balance | In-memory scope check (~0.016 ms); zero external state mutation |
R1 | 14% | Save internal working note, create ephemeral draft inside isolated workspace | Fully reversible in place; logged to local session journal |
R2 | 11% | Assign internal classification tags, compute statutory fee or commission schedule | Schema and numeric bound validation without external network calls |
R3 | 16% | Stage arbitration motion draft, place payment order into revocable approval queue | Authority and threshold verification; revocable prior to executive signature |
R4 | 7% | Dispatch external webhook or formal notice, write to operational table | Mandatory outbound personal data redaction (ADR-0073) and injection taint guard |
R5 | 4% | Execute irrevocable wire transfer, submit court waiver, permanently purge case record | Strict default-deny (fail-closed); full Z3 formal proof (p99 = 4.5 ms) |
2. Closed Self-Correction Loop (Unsat Core Injection / retry_of)
Conventional network gateways reject blocked calls with an opaque permission error, causing autonomous agents to enter infinite retry loops or crash. The MITR gateway exploits the formal witness output of Z3: whenever a candidate action violates policy invariants, the solver identifies the exact minimal set of conflicting clauses.
Those violated predicate identifiers and boundary thresholds are injected back into the tool response inside the retry_of field. Guided by deterministic mathematical feedback, the calling agent automatically downgrades an unapproved R5 debit or deletion into a safe R3 staged draft within three rounds (MITR_GATE_ROUNDS_MAX = 3) without human intervention.
3. Zero-Trust Standalone Hash-Chain Replay
Every gateway verdict is appended to gate_actions.jsonl with dual cryptographic digests (SHA-256 and GOST R 34.11-2012 Streebog-256) and periodic OpenTimestamps Bitcoin block anchors. Any external auditor can replay and verify the entire ledger offline using the Python standard library:
python verify_chain_standalone.py --replay --ledger gate_actions.jsonl
python iss_verifier.py --ledger audit.jsonlModifying, deleting, or inserting a single historical line breaks the hash chain immediately and fails verification with a non-zero exit code.