The mechanism

Large language models produce plausible text; that includes text that looks like device output. VIRP's answer is structural. A process-separated collector (the O-Node, a designated collector deployed separately from the requesting agent) executes or refuses typed operations against configured infrastructure targets and applies an HMAC-SHA256 authentication tag to each resulting record, binding the response to the request that produced it. The requesting agent consumes those records; it does not produce them.

An actor without the observation key cannot produce a record accepted by the verifier. Agent-generated text carries no valid authentication tag, so it is flagged as unverified instead of being presented as collected evidence. Refusals are authenticated too, under a distinct record type, so a rejection cannot be re-presented as a successful read without failing verification.

The boundary

This is a trust boundary, not magic. Under the documented deployment boundary, the requesting agent is not provisioned with the observation key. Because the authentication is symmetric, any component that verifies tags either holds the key or delegates verification to a trusted component that does. Security therefore depends on collector, host, and key isolation, and every symmetric key holder must be treated as trusted. The collector is a concentrated trust point on purpose: compromise the collector and you compromise the guarantee. VIRP provides no security against a compromised collector; external anchoring and hardware-backed keys are designed, not done.

Authentication is also not the same as truth. A valid tag establishes that the designated collector authenticated this record for this request. It does not establish that the target device was honest, uncompromised, or current, and it does not establish that every statement the AI makes about the record is accurate.

Where to go deeper

  • Security: the authoritative list of established results and open limitations.
  • Walkthrough: the mechanism running live, allow and refuse, with real session output.
  • Specification: the protocol documents, wire format, and trust primitives.