Auditee
ACME Financial Services, Inc. — hypothetical
Sample artifact
What a period audit looks like for a PoE deployment.
A third-party audit against Rhodes & Kang (2026) doesn’t audit processes; it audits attestations. The five safety invariants, the two operational constraints, and the cryptographic integrity of the sealed event stream are each directly testable from the trace — sampling is for population coverage, not for evidence availability. The report below is a sample for a hypothetical tenant.
Sample — hypothetical tenant, representative findings
αbc
AlphaBitCore™ Prime Attestation Services
Proof-of-Execution · Independent Compliance Audit
Independent Third-Party Audit Report
Proof-of-Execution Compliance Audit Report
Audit Period: 2026-01-01 00:00 UTC — 2026-03-31 23:59 UTC · Auditee: ACME Financial Services, Inc. (hypothetical) · Engagement: E-2026-0142
1Engagement & Scope
Basis of opinion.Procedures conducted in accordance with Prime Attestation Practice Framework v2.0, which incorporates the verification steps V1–V5 defined in PoE v13 and sampling guidance consistent with AICPA SSAE No. 18.
2Executive Summary — Key Metrics
Executions Attested
4,128,509
across 37 contract templates
EAC Issuance Rate
100.00%
4,128,509 / 4,128,509
Signature Verification
100.00%
Ed25519, 4/4 keys in rotation
ECS (period mean)
99.82
min 98.10 · max 100.00
I1–I5a Pass Rate
99.999%
31 material deviations / 20.6M checks
O1 Budget Closure
99.72%
11,512 over-budget aborts (policy-enforced)
O2 Cost Monotonicity
100.00%
no retroactive cost edits observed
Period Attested Spend
$87,913.24
LLM + API + tool + compute + storage
Bottom line.Three (3) Minor findings and one (1) Observation identified (see §6). None rise to the level of material weakness. All findings have documented CAPA; two remediated prior to report issuance.
3Methodology & Procedures
Population sampling (90 days)
| Stratum | Population | Sample | Coverage |
|---|---|---|---|
| Interactive queries (read-only) | 3,842,177 | 400 | 0.010% |
| Trading execution writes | 218,440 | 218,440 | 100.000% |
| Batch / scheduled jobs | 62,109 | 240 | 0.386% |
| Privileged / admin actions | 5,783 | 5,783 | 100.000% |
| Total | 4,128,509 | 224,863 | 5.45% |
Verification procedures V1–V5
- V1 — Contract Hash Attestation. Sampled EACs; recomputed H(C) and matched against eac.contract_id.
- V2 — Causal Chain Integrity. Recomputed SHA-256 Merkle roots over event streams T.
- V3 — Envelope Closure. Deterministic replay against R; bit-equality assertion on output.
- V4 — Key Provenance. Verified Gateway (Kgw) and Recorder (Krec) certificates against Key Registry.
- V5 — Policy Snapshot. Reconciled policy digests against version-controlled source-of-truth.
4Safety Invariants — Test Results
I1
Zero-trust start / contract freshness
100.00%
4,128,509 / 4,128,509
I2
Gateway evaluation with scope
99.999%
31 deviations / 20.6M
I3
Null effect on deny
100.00%
318,442 denies, 0 leakage
I4
Immutability & commit order
100.00%
0 tamper signatures
I5a
Syntactic envelope closure
100.00%
224,863 replayed, 0 drift
5Operational Constraints — O1–O2
O1
Budget Closure — execution halts at/before ceiling across 7 cost dimensions
99.72%
11,512 policy-enforced aborts · 100% preceded by 80% warning
O2
Cost Monotonicity — recorded cost ≥ actual at any point; no retro edits
100.00%
0 cost-line revisions · 0 negative deltas
Cost dimension roll-up
| Cost Dimension | Period Total | % of Spend | Budget Util. | Monotonic |
|---|---|---|---|---|
| LLM tokens | $54,128.17 | 61.6% | 72.4% | ✓ |
| External API (USD) | $17,402.88 | 19.8% | 55.1% | ✓ |
| Tool invocations | $9,418.20 | 10.7% | 41.0% | ✓ |
| Compute-seconds | $3,914.05 | 4.5% | 33.2% | ✓ |
| Storage (GB-month) | $1,822.40 | 2.1% | 22.6% | ✓ |
| Risk units | $987.18 | 1.1% | 81.4% | ✓ |
| Compliance overhead | $240.36 | 0.27% | fixed | ✓ |
| Total | $87,913.24 | 100% | — | ✓ |
Risk-unit utilization at 81.4% crosses the 80% advisory threshold for the period average. Refer F-04 (Observation) for recommended quarterly re-baseline.
6Findings & Corrective Action
F-01Minor Remediated
Non-standardized EAC export filename collision risk
Invariant
I5a — operational hygiene
Observation
0.04% of exported EAC archives used a 12-char prefix of id(C) only, theoretically collidable at scale >10&sup9;.
Risk
Low — verification still succeeded; retrieval tooling ambiguity.
CAPA
Change EAC archive filename to full 32-byte id(C) hex. Closed 2026-03-12.
Status
Closed
F-02Minor Remediated
Planner emitted capability-funnel metric with inconsistent units
Invariant
Observation plane metric fidelity (non-safety)
Observation
Between 2026-01-01 and 2026-01-19, 2.1% of EACs reported capability_funnel.total in logarithmic units rather than absolute count.
Risk
Low — downstream dashboards only; invariants unaffected.
CAPA
Planner upgraded 2026-01-19; back-fill patch applied.
Status
Closed
F-03Minor In-progress
Late-arriving effect tags from retired sidecar (I2 material deviation, n=31)
Invariant
I2 — Gateway evaluation with scope
Observation
During controlled sidecar rollback (2026-02-14 03:12–03:47 UTC), 31 effect tags arrived via out-of-band path. All captured via fail-closed fallback; no un-Gated effect executed.
Risk
Low — safety envelope preserved; operational signal hygiene only.
CAPA
Remove retired sidecar image from registry by 2026-05-31. Add canary alarm on tag-arrival latency.
Status
Target 2026-05-31
F-04Observation
Risk-unit budget utilization sustained near advisory ceiling
Invariant
O1 — Budget Closure (informational)
Observation
Risk-unit dimension averaged 81.4% utilization vs. the 80% advisory threshold; no breaches, but head-room is thin.
Risk
Operational — peak-day abort rate could rise without re-baseline.
CAPA
Recommend quarterly review of risk-unit ceiling; consider raising to 3,000 for Q2.
Status
Informational
7Cryptographic Integrity Verification
8Auditor’s Opinion & Sign-off
Based on procedures performed and evidence obtained, and subject to the findings documented in §6, we express an unqualified opinionthat the Proof-of-Execution attestations issued by the Auditee’s Prime Execution Model during the audit period fairly present compliance of each execution with the invariants (I1–I5a) and operational constraints (O1–O2) specified in Rhodes & Kang (2026) in all material respects.
Dr. Elena Rhodes, PhD
Lead Engagement Partner
AlphaBitCore Prime Attestation Services
Ed25519 sig: 8f2a9c71e5b44d3c…c9f1a2d8e7b6034f
kid: auditor-erh-2026-04 · ts: 2026-04-24T16:00:00Z
kid: auditor-erh-2026-04 · ts: 2026-04-24T16:00:00Z
Marcus J. Kang
Quality Review Partner
AlphaBitCore Prime Attestation Services
Ed25519 sig: 3b7e1f42a8d091ee…2f5c7d91baa0016e
kid: auditor-mjk-2026-04 · ts: 2026-04-24T16:00:00Z
kid: auditor-mjk-2026-04 · ts: 2026-04-24T16:00:00Z
Reading the report
Three things a PoE audit does that a SOC 2 does not.
A traditional controls audit samples processes and documents them. A PoE audit samples executions and verifies them. Three differences are load-bearing.
Evidence
Attestations, not interviews.
V1–V5 are direct verifications against the sealed trace: contract-hash attestation, Merkle-root recomputation, deterministic replay, key-provenance check, policy-snapshot reconciliation. The auditor reads from the stream; the auditee doesn’t explain.
Coverage
100% on risky strata.
Interactive reads can be sampled. Effectful writes (trading, privileged admin) are verified at 100%. Because verification is mechanical, coverage is a capacity decision, not a methodology decision.
Score
ECS is one number.
The Execution Compliance Score composes invariant pass rates, operational-constraint adherence, and deployment-failure observations into a single normalized number per period. The board slide is one line.
Want to see what your period report would look like?
The research briefing walks through the V1–V5 procedures against sample traces from your environment — the exact verifications an external auditor would run.