IRL: Immutable Reasoning Log
Protocol Specification

Abstract

Autonomous trading agents are increasingly prevalent in systematic finance, yet no standard mechanism exists for proving the reasoning behind individual trading decisions at the moment they were made. Post-hoc log analysis is insufficient: logs can be altered, they do not prove what the agent knew at decision time, and they cannot demonstrate that pre-execution compliance rules were actually enforced.

This paper introduces IRL — the Immutable Reasoning Log — a pre-execution compliance gateway that addresses these deficiencies through a combination of cryptographic sealing, bitemporal timestamping, and post-trade binding. IRL produces a final_proof for every trade: an unforgeable record that links the agent's reasoning, the market state it operated under, the policies that were enforced, and the exchange confirmation it produced.

IRL is signal-agnostic. Any cryptographically signed regime source may serve as the Market Truth Anchor (MTA). MacroPulse provides a turnkey MTA implementation using Ed25519-signed HMM/PCA regime broadcasts.

The Ownership Gap

When a human trader executes a position, intent is implicit: the trader was present, made a judgment, and bears direct accountability. When an autonomous agent executes the same position, the chain of accountability dissolves. The agent acted on a model, under market conditions that existed at a precise moment, subject to policies that may or may not have been enforced. None of these facts are provable from a standard execution log.

We define this as the Ownership Gap: the absence of a verifiable link between an autonomous agent's decision and the conditions under which it was made.

Why logs are not enough

Application logs record what happened. They do not prove:

• What the agent knew — the exact market state at the moment of decision, not reconstructed after the fact
• That policies were enforced — a log entry saying "policy check passed" is indistinguishable from one that was written retroactively
• That the reasoning was not altered — any log stored in a mutable system can be modified by a sufficiently privileged actor
• That the decision preceded the outcome — without a bitemporal record, an agent could theoretically be claimed to have decided after the fact

The regulatory trend

Regulators across jurisdictions are converging on a common requirement: autonomous systems making consequential decisions must be able to demonstrate, to an external auditor, that those decisions were made under specific conditions, subject to specific controls, and that the record has not been altered. The EU AI Act, SEC AI examination priorities, and MiFID II algorithmic trading requirements all point in this direction. IRL is designed around these requirements from the ground up.

The IRL Protocol

IRL operates as a sidecar between the agent and the exchange. Every trade that passes through IRL acquires a cryptographic chain: a sequence of signed, timestamped, and bound records that collectively prove what happened and when.

Market Truth Anchor (MTA)

The Market Truth Anchor is the source of ground truth about the market state at decision time. IRL requires any MTA to provide signed broadcasts satisfying the following interface:

The signature field is computed over the RFC 8785 canonical JSON serialization of all other fields. Any party holding the MTA operator's public key can independently verify the broadcast without trusting any intermediary. The MTA operator's public key is published and stable — it does not rotate without advance notice. IRL rejects any broadcast that carries no valid signature or whose signature fails verification. An unsigned MTA source cannot be used with IRL in production mode.

Custom MTA implementations are supported. Any operator who can produce signed payloads conforming to the above schema can serve as the MTA for an IRL deployment. This includes proprietary factor models, alternative data providers, or internal risk systems.

CognitiveSnapshot

Before any order is submitted to an exchange, the agent must construct a CognitiveSnapshot — a structured record of its decision context — and submit it to IRL for sealing. The snapshot captures everything the agent knew and intended at the moment of decision.

IRL computes the reasoning_hash as the SHA-256 of the RFC 8785 canonical JSON serialization of the CognitiveSnapshot. This hash is deterministic — any auditor who holds the original snapshot can reproduce it independently.

The Audit Chain

The IRL audit chain is a sequence of five verifiable events, each dependent on the one before it. Altering any event invalidates all subsequent events.

Post-Trade Verifier

Every sealed snapshot enters a lifecycle managed by the IRL post-trade verifier. The lifecycle has three terminal states:

An async expiry worker monitors all open snapshots. Snapshots that exceed the binding window without a bind-execution call transition to EXPIRED. This prevents agents from accumulating authorized-but-never-executed snapshots as a form of option on market conditions.

Cryptographic Guarantees

Ed25519 MTA signatures

Ed25519 (RFC 8032) provides 128-bit security with fast verification and small signature size (64 bytes). The MTA operator's private key is used to sign each broadcast. The corresponding public key is published and stable. Any party can verify a broadcast without trusting any intermediary, including IRL itself.

RFC 8785 canonical JSON

All hashes are computed over RFC 8785 canonical JSON — a deterministic serialization that sorts object keys lexicographically and removes insignificant whitespace. This ensures that the same logical document always produces the same hash regardless of how it was serialized by the producer.

SHA-256 snapshot sealing

The reasoning_hash is SHA-256 of the canonical CognitiveSnapshot. SHA-256 is a one-way function: given the hash, it is computationally infeasible to produce an alternative snapshot that hashes to the same value. The snapshot is therefore bound to its hash in both directions.

final_proof binding

The final_proof concatenates the reasoning_hash and the exchange_tx_id before hashing: SHA-256(reasoning_hash ‖ exchange_tx_id). This produces a single value that cryptographically binds the agent's decision to the exchange record. Neither can be substituted without invalidating the proof. For concrete examples of final_proof in context, see the case studies in §9.

L2: Signed heartbeats and replay prevention

L2 deployments add a signed heartbeat protocol that binds each authorization to a specific, fresh MTA broadcast. The mechanism works as follows:

• The MTA assigns a monotonic sequence ID to each broadcast, incrementing by one with every emission.
• When a CognitiveSnapshot is submitted for authorization, IRL checks that the embedded MTA broadcast's sequence ID is within the configured freshness bound (e.g., the last N broadcasts).
• A snapshot referencing a broadcast outside the freshness bound is rejected — the agent cannot use a stale or historical regime state to authorize a present-day trade.
• Each heartbeat is signed by the MTA with the same Ed25519 key as the broadcast, so sequence IDs cannot be fabricated or reordered.

This prevents a class of attacks where an agent accumulates authorized snapshots during a favorable regime and attempts to replay them during a different, unfavorable regime. Without L2 heartbeats, the time window between authorization and binding could in principle be exploited by an adversarial agent.

Bitemporal Audit Ledger

IRL's ledger is bitemporal: every record carries two timestamps that serve distinct functions.

The bitemporal structure provides a fundamental proof of temporal integrity: valid_time ≤ txn_time is enforced by IRL at sealing time. An agent that attempts to submit a snapshot with a decision_time after the MTA's broadcast_time will be rejected — it cannot have decided before it received the information.

Because txn_time is set by IRL and valid_time is bounded by the MTA broadcast, no party — not the agent, not the operator, not the MTA — can retroactively claim a decision was made at a different time than it was recorded.

Multi-Agent Registry (MAR)

The MAR maintains identity records for all agents registered with an IRL deployment. Every POST /irl/authorize call is validated against the MAR before any other check runs.

The model_hash check provides a strong guarantee against unauthorized model substitution: an agent running a model whose hash is not registered cannot obtain authorization, regardless of whether its other parameters are valid.

Policy Engine

IRL's policy engine evaluates a set of operator-defined rules against the CognitiveSnapshot at authorization time. Policies are evaluated atomically with the MAR check — a single failed policy halts the entire authorization and returns an explicit rejection reason.

Built-in policy types (L1)

• Regime gate — reject orders when current regime_id is not in the agent's allowed_regimes set
• Risk score ceiling — reject orders when risk_score exceeds a configured threshold
• Notional cap — reject orders where intended size exceeds the per-agent or per-regime notional limit
• Direction constraint — prevent long exposure during specific regimes (e.g., no long equity in risk_off)
• Blackout window — reject orders during defined calendar windows (e.g., FOMC meeting days)

WebAssembly policy modules (L3)

L3 deployments support hot-reloadable policy modules compiled to WebAssembly. Modules run in a sandboxed environment with no network access and bounded execution time. New policies can be deployed without restarting the IRL engine or modifying its core logic. This enables operators to respond to regulatory changes or risk events without a deployment cycle.

Regulatory Mapping

IRL is designed to satisfy the technical requirements of the primary regulatory frameworks governing autonomous trading systems. The following table maps IRL protocol components to specific regulatory requirements.

Deployment Editions

All editions expose the same REST API surface. Upgrading from L1 to L2 or L3 does not require changes to the agent integration — the agent continues to call the same endpoints. Capabilities are added transparently on the IRL side.

Case Studies

Conclusion

The gap between autonomous agent activity and provable accountability is one of the defining challenges facing systematic finance as AI adoption accelerates. IRL addresses this gap through a protocol that is cryptographically sound, operationally lightweight, and aligned with the direction of regulatory travel across major jurisdictions.

The protocol makes one guarantee: if a trade passed through IRL, there is a final_proof. That proof is unforgeable, permanently stored, and independently verifiable. It links the agent's identity, the market state it operated under, the policies that were enforced, and the exchange execution it produced. No party — including the operator — can alter any link without breaking the chain.

IRL is signal-agnostic. The MacroPulse MTA provides the easiest path to a complete deployment, but any cryptographically signed regime source can serve as the MTA. The protocol is designed to fit the existing infrastructure of systematic trading operations, not to replace it.