CHRONOS composes homomorphic encryption, a verifiable delay function, and a zero-knowledge erasure proof so that a 128-byte artifact shows an autonomous agent stopped on time and destroyed its key — without trusting the agent or whoever ran it.
Autonomous agents are being handed real credentials — cloud accounts, payment rails, code execution — for bounded periods. Increasingly the party bearing the risk is not the party operating the agent.
Logs are written and held by the operator. They record what the agent reported, which establishes the provenance of a claim rather than its truth.
Scope enforcement runs inside operator-controlled code. Nothing outside that code can confirm the boundary held.
Key deletion is operator-attested. A console showing "deprovisioned" is not evidence that key material is gone.
Today, no. Every answer above reduces to the operator asserting it — the party with the strongest incentive to assert it.
This is not a claim that operators lie. It is a claim that a guarantee which depends on the honesty of the party with the most to lose from admitting otherwise is not a guarantee.
The agent's key is sealed under a value that requires T sequential squarings to compute. No parallelism shortens it, no policy decision governs it, and no network connection is needed for it to hold. The deadline is a property of arithmetic, not of anyone's cooperation.
Containment is expressed as five order-theoretic invariants over a lattice-valued capability state: capabilities only shrink, budgets only decrease, the lifecycle only advances, no admitted operation outlives the deadline, and shutdown is reachable from every state. The execution summary is bound into the same proof that attests key destruction.
One record therefore covers both what the agent destroyed and how it behaved. An agent that ran a mission but never erased cannot produce the proof at all. The nearest existing work is certified deletion, which certifies the fate of a ciphertext; the composition here binds classical erasure to a capability-monitor trace instead.
Every figure below comes from a test in the repository, on a recorded machine. Earlier revisions of this work asserted numbers that did not hold; those corrections are catalogued in the audit log.
| Network | Multiplications | Inference | Per multiplication |
|---|---|---|---|
| 8 → 4 → 2 | 40 | 79.0 s | 1975 ms |
| 16 → 8 → 10 | 208 | 383.9 s | 1846 ms |
| 32 → 8 → 10 | 336 | 696.9 s | 2074 ms |
Nothing in the demonstration is staged. The VDF performs real sequential squarings, the key is genuinely sealed and genuinely opened, and the proof is produced by the agent then verified against commitments the agent did not choose.
# Clone and run the full protocol end to end git clone https://github.com/ChronosResearch/project-chronos cd project-chronos # Windows pwsh scripts/demo.ps1 -T 500000 # Linux and macOS bash scripts/demo.sh --t 500000 # Every measurable claim, collected with a machine spec cargo test --workspace
CHRONOS is a verification primitive, not an alignment technique. It does not make an agent's objectives safer, detect deception, or constrain what a sufficiently capable system might do inside its window. It narrows one thing: the distance between what an operator asserts about shutdown and scope, and what a third party can check.
If ground control can sign a revocation, why build a cryptographic deadline? Because the two fail differently: revocation fails open when the channel is gone, expiry fails closed. CHRONOS is a complement to revocation, not a replacement — but only one of them leaves evidence a third party can check afterwards.
SAFETY_CASE.md sets out why this is worth building and what it does not do. AUDIT.md lists every defect found in this codebase, including four critical ones in our own prior revisions.