# Certified Purity for Cognitive Workflow Executors: From Static Analysis to Cryptographic Attestation

arXiv: https://arxiv.org/abs/2605.01037 · HTML: https://mlsanity.com/paper/2605.01037/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 52 references that are in the map.
- First posted on arXiv 1 May 2026.

## Builds on (most cited first, 4 of 4)

- [Mechanized Foundations of Structural Governance: Machine-Checked Proofs for Governed Intelligence](https://mlsanity.com/paper/2604.27289/) (2026)
- [The Two Boundaries: Why Behavioral AI Governance Fails Structurally](https://mlsanity.com/paper/2604.27292/) (2026)
- [Retrofitting Fine Grain Isolation in the Firefox Renderer (Extended Version)](https://mlsanity.com/paper/2003.00572/) (2020)
- [CT-Wasm: Type-Driven Secure Cryptography for the Web Ecosystem](https://mlsanity.com/paper/1808.01348/) (2018)

## Built on by (most cited first, 1 of 1)

- [Cryptographic Registry Provenance: Structural Defense Against Dependency Confusion in AI Package Ecosystems](https://mlsanity.com/paper/2605.03309/) (2026)

## Abstract (arXiv)

We present a certified purity architecture that converts governance enforcement in cognitive workflow systems from a runtime convention into a structural capability boundary. A prior three-layer governance architecture proves governance completeness, provenance completeness, and the impossibility of ungoverned effects, conditional on the pure module constraint: that step executors cannot perform effects. That constraint was enforced by module import graph analysis, which is insufficient against adversarial bypass on the BEAM virtual machine. This paper closes the gap through four mechanisms: (1) a restricted WebAssembly compilation target where effect-producing instructions are structurally absent; (2) purity certificates, cryptographically signed proofs binding executor binaries to their import classifications; (3) a runtime verification gate that rejects uncertified executors before they enter the governance pipeline; and (4) portable governance credentials via remote attestation for cross-organizational verification. We prove four theorems: structural purity by construction, bypass elimination for all five BEAM bypass classes, certificate integrity, and gate completeness. The guarantee holds relative to an explicit Trusted Computing Base. Evaluation on four implemented executors shows verification latency of 39--42 us, full plan cycle under 400 us, runtime overhead under 0.4% of a 100 ms HTTP request, and zero determinism divergences across repeated invocations.