AI 中文总结
CATP通过绑定策略与规范化操作，生成可离线验证的授权审计证据，实验发现缺失检查并验证钩子与验证开销，确保决策可审计但依赖可信环境。
AI 中文摘要
签名授权记录验证了签名者所断言的内容，但本身并不能确立该断言与运行时决策所用的策略和操作一致。CATP规定了将本地执行前决策携带到可离线验证的证据所需的绑定。其钩子提交到执行时策略和适配器规范化操作，并在返回权限之前持久记录决策。后续收据将记录绑定到自包含的审计导出。针对Claude Code和Codex的实现支持对这些绑定的实证检验。受控的、有效签名的反例暴露了五个缺失的一致性检查；添加这些检查后，相同输入上的接受情况发生变化，所有13个预期结果均得到满足。一项单独的探测发现，不同的参数向量在哈希之前可能变成相同的规范化操作，这限制了即使一致的收据也能确立的内容。八个脚本化的运行时案例验证了钩子传递和允许/拒绝行为；故障测试涵盖篡改、替换、重放、并发和持久性错误。中位配对钩子开销约为85毫秒，离线验证在测试平台上端到端约需174毫秒。证据仍以可信的运行时、监视器、主机和签名密钥为条件。它认证了关于规范化操作的决策，而不证明执行真实性、完全披露或自主任务效用。可选的Groth16研究涵盖了更窄的电路谓词；评估并未确立相对于其他系统的优越性。
英文摘要
A signed authorization record authenticates what a signer asserted, but does not by itself establish that the assertion agrees with the policy and action used for a runtime decision. CATP specifies the bindings needed to carry a local pre-execution decision into offline-verifiable evidence. Its hook commits to the enforcement-time policy and adapter-normalized action and durably records the decision before returning permission. A later receipt binds the record to a self-contained audit export. An implementation for Claude Code and Codex supports an empirical examination of these bindings. Controlled, validly signed counterexamples expose five missing consistency checks; adding them changes acceptance on the same inputs, with all 13 expected outcomes satisfied. A separate probe finds that distinct argument vectors can become the same normalized action before hashing, limiting what even a consistent receipt can establish. Eight scripted runtime cases verify hook delivery and allow/deny behavior; failure tests cover tampering, substitution, replay, concurrency and persistence errors. Median paired hook overhead is approximately 85 ms, and offline verification takes approximately 174 ms end to end on the testbed. The evidence remains conditional on a trusted runtime, monitor, host and signing key. It authenticates a decision about the normalized action, without proving execution truth, complete disclosure or autonomous task utility. The optional Groth16 study covers a narrower circuit predicate; the evaluation does not establish superiority over other systems.
Comments13 pages, 1 figure. Code: https://github.com/lfzkoala/catp
