DROS: A Four-Layer Deterministic Runtime Operation System Bridging the Agent-to-Execution Attribution Gap in Autonomous AI Workloads / DROS:彌合自主AI 負載中「代理人至執行歸因 鴻溝」之四層確定性執行期作業系統

Autonomous AI agents increasingly operate with legitimate credentials, delegated capabilities, and access to consequentialtools, creating an attribution gap between high-level agent intent and low-level physical execution. We present DROS, a four-layer runtime substrate that separates agent identity from execution authority and enforces capability constraints at a binary C-ABI boundary. Rather than treating security as a priori established, we formulate DROS as an experimentally falsifiable execution-governance boundary and introduce a progressive adversarial validation methodology combining autonomous attack search, negative controls, mutation testing, independent groundtruth oracles, concurrency stress, and open reproducibility. The evaluation decomposes the causal chain into intent, authorization, execution, and physical effect, allowing enforcement decisions to be independently cross-validated against kernel and external state observations. Across the instantiated evaluation corpus, including adaptive attack attempts, multi-agent delegation chains, revocation races, mutation tests, and oracle probes, we observe no unauthorized physical effects within the explicitly instrumented observation boundary. We report the resulting guarantees as empirical invariants over the evaluated state space rather than universal security proofs, and release the evaluation harness and counterexample protocol to enable continued adversarial falsification. 隨著自主 AI Agent 普遍持有合法憑證、委託能力並能調用具實體後果之工具,高層 Agent 意圖與底層物理執行之間產生了嚴重的歸因斷層(Attribution Gap)。本文提出 DROS,一套將 Agent 身分與執行授權解耦、並在二進位 C-ABI 邊界強制執行能力約束的四層執行期作業基板。本文不預設安全已被先驗證明,而是將 DROS 表述為一個可被實驗證偽的執行治理邊界,並引入結合自主攻擊搜尋、負向對照、變形測試、獨立帶外神諭(Ground-Truth Oracle)、並發壓力與開源可重現性的漸進式對抗驗證方法論。本評測體系將因果鏈解構為「意圖、授權、執行與物理效應」,使強制決策得與內核及外部狀態觀測進行獨立交叉驗證。在涵蓋自適應攻擊、多 Agent 委託鏈、撤銷競態、突變測試與神諭探針的實例化評測語料庫中,於明確儀表化之觀測邊界內未觀測到任何未授權物理效應。本文將所得保證宣告為評測狀態空間上的實證不變量而非全域安全證明,並開源評測基板與反例協議以實現持續之對抗性證偽。