XGML v1.0-rc · Patent 63/896,282

Evidence graphs are infrastructure

XGML is the eXplainable Governance Markup Language — an open, vendor-neutral standard for AI evidence graphs. Every agent action produces a cryptographic receipt. Receipts chain into provenance graphs. Graphs are verifiable offline, across vendors, and under formal proof.

1Agent acts → XGML event emitted

2Event hashed (SHA-256 canonical JSON) → receipt stored in ProofDB

3Receipt linked to prior receipts → evidence graph grows

4Graph exported as XGML → verifiable by any conforming verifier

5Formal proof obligations attached → Lean 4 kernel checks structural invariants

Standard

What XGML encodes

Every XGML document is a directed acyclic graph of evidence nodes with cryptographic integrity, formal proof obligations, and human-gate annotations.

Evidence Nodes

Content-addressed by SHA-256 canonical JSON. Each node carries an event type, timestamp, actor identity, and payload hash. Nodes are immutable once sealed.

v1.0

Provenance Edges

Directed edges link each receipt to its causal predecessors. Edge types: generated_by, reviewed_by, amends, retracts, depends_on.

v1.0

Proof Obligations

Each claim-bearing node may carry a Lean 4 theorem reference. The graph is valid only if all referenced theorems compile (lake build EXIT=0).

v1.0

Human Gates

Nodes carry clearance tokens: AUTO_PASS, OWNER_REVIEW, HUMAN_GATE_REQUIRED, CLEARANCE_REQUIRED. Gates are enforced at export time.

v1.0

Claim Ceilings

Every claim-bearing node declares its evidence ceiling: UNVERIFIED through LEAN_LAKE_BUILD_HASH_CONFIRMED. Ceilings are inherited by downstream nodes.

v1.0

Cross-Vendor Portability

XGML is a flat XML schema with canonical JSON normalization. Any conforming verifier can validate an XGML bundle without Aevion infrastructure.

v1.0-rc

Schema

XGML document structure

Minimal valid XGML v1.0 document. The schema is stable; tooling emits and validates against this contract.

<?xml version="1.0" encoding="UTF-8"?>
<xgml version="1.0" xmlns="https://xgml.org/ns/1.0">
  <header>
    <generator>aevion-proofdb-canonical/1.0</generator>
    <created_at>2026-06-13T12:00:00Z</created_at>
    <schema_hash>sha256:ae7b...</schema_hash>
  </header>
  <graph root="node-001">
    <node id="node-001" type="receipt">
      <payload_hash>sha256:3f8a...</payload_hash>
      <event_type>aevion.agent.action</event_type>
      <actor>aevion-implementer/7</actor>
      <timestamp>2026-06-13T12:00:00Z</timestamp>
      <claim_ceiling>PRIMARY_ABSTRACT_CONFIRMED</claim_ceiling>
      <human_gate>OWNER_REVIEW</human_gate>
    </node>
    <edge from="node-002" to="node-001" type="generated_by"/>
    <edge from="node-001" to="node-003" type="depends_on"/>
  </graph>
  <proof_obligations>
    <obligation node="node-001">
      <lean_theorem>Aevion.Receipts.Integrity.receipt_hash_matches_payload</lean_theorem>
      <lake_build_hash>sha256:c301f358...</lake_build_hash>
    </obligation>
  </proof_obligations>
</xgml>

Ecosystem

Why XGML exists

AI governance needs a common evidence format. XGML is the only standard that binds cryptographic receipts, formal proof obligations, and human gates into one verifiable artifact.

Capability	XGML	SysML v2	OPA/Rego	SPDX	CycloneDX
Cryptographic receipt chain	SHA-256 canonical	No	No	Hash only	Hash only
Formal proof obligations	Lean 4 theorem refs	No	No	No	No
Human-gate annotations	4-level clearance	No	No	No	No
Claim ceiling inheritance	DAG-inherited	No	No	No	No
Vendor-neutral verifier	XML + JSON schema	Yes	Yes	Yes	Yes
Content-addressed storage	ProofDB	No	No	No	No
Offline verification	Yes	Partial	Yes	Yes	Yes

Patent disclosure

XGML is covered by U.S. Provisional Patent 63/896,282 (Aevion LLC, SDVOSB). The schema and tooling are published under open terms. Patent disclosure ensures the standard remains open and defensively protected — not locked to a single vendor. Conforming implementations are welcome without royalty.

Open

Tooling & conformance

XGML ships with open-source verifiers, generators, and a conformance suite. Every Aevion receipt is valid XGML.

xgml-validate

Rust-based XGML schema validator. Validates structural integrity, hash chains, and proof obligation references. 6/6 conformance tests passing.

v0.2 · 6/6 pass

trust-verify

Cross-lang cryptographic verifier. Validates SHA-256 canonical JSON hashes match payloads. 5/5 conformance tests passing.

v0.2 · 5/5 pass

xgml-binding

Lean 4 binding that links XGML evidence nodes to formal theorem statements. Structural invariants verified by the Lean kernel.

v0.2 · 4/4 pass

xgml-generator (Python)

Reference implementation: emits valid XGML 1.0 from ProofDB objects. Used by every Aevion receipt pipeline.

v1.0 · in ProofDB

Merkle Binding v0.2

RFC 6962 Merkle tree binding for XGML evidence chains. Preimage collision proof in Lean (EXIT=0). 29/29 tests.

v0.2 · 29/29

Conformance Suite

Public test vectors for independent XGML verifier implementations. Vendor-neutral, no Aevion dependencies required.

Planned